Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:44
Static task
static1
Behavioral task
behavioral1
Sample
7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe
Resource
win10-en-20211208
General
-
Target
7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe
-
Size
158KB
-
MD5
0cbd8c3308382fa4accd5667339b6f7f
-
SHA1
6fcdd459d0605cd16f01dcb864082cff023c33c1
-
SHA256
7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae
-
SHA512
850d8cdd4cd22b0a569f91d770f6994f05542b21b1d65eaf1ce22699d09bc7606143eae501dea9ebe3eb2e03092ab6b816605bca208cd12501eb693ab8970652
Malware Config
Extracted
C:\c80pl3h3l1-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/32FB57BF41A4B36A
http://decryptor.top/32FB57BF41A4B36A
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\UseLimit.tiff 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File renamed C:\Users\Admin\Pictures\NewEnable.png => C:\Users\Admin\Pictures\NewEnable.png.c80pl3h3l1 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File renamed C:\Users\Admin\Pictures\PingBlock.png => C:\Users\Admin\Pictures\PingBlock.png.c80pl3h3l1 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File renamed C:\Users\Admin\Pictures\RenameClear.tif => C:\Users\Admin\Pictures\RenameClear.tif.c80pl3h3l1 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File renamed C:\Users\Admin\Pictures\SwitchBlock.tif => C:\Users\Admin\Pictures\SwitchBlock.tif.c80pl3h3l1 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened for modification C:\Users\Admin\Pictures\ResetDismount.tiff 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File renamed C:\Users\Admin\Pictures\InstallTrace.tif => C:\Users\Admin\Pictures\InstallTrace.tif.c80pl3h3l1 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File renamed C:\Users\Admin\Pictures\ExitOut.raw => C:\Users\Admin\Pictures\ExitOut.raw.c80pl3h3l1 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File renamed C:\Users\Admin\Pictures\UseLimit.tiff => C:\Users\Admin\Pictures\UseLimit.tiff.c80pl3h3l1 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File renamed C:\Users\Admin\Pictures\ResetDismount.tiff => C:\Users\Admin\Pictures\ResetDismount.tiff.c80pl3h3l1 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exedescription ioc process File opened (read-only) \??\P: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\Q: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\S: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\V: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\G: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\J: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\N: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\R: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\T: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\X: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\Y: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\K: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\L: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\O: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\U: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\Z: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\A: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\E: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\M: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\I: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\W: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\D: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\B: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\F: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe File opened (read-only) \??\H: 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\76kjp20mg6.bmp" 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1080 vssadmin.exe -
Processes:
7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\SystemCertificates\CA\Certificates\4DEEA7060D80BABF1643B4E0F0104C82995075B7 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\SystemCertificates\CA\Certificates\4DEEA7060D80BABF1643B4E0F0104C82995075B7\Blob = 0300000001000000140000004deea7060d80babf1643b4e0f0104c82995075b7140000000100000014000000a3c85e6554e53078c105ea070a6a59ccb9fede5a04000000010000001000000042672e72f86c9ba154608d36bccd3c610f0000000100000020000000a2ffac7663c45d94e0bb448815febe55f1ed76a0bdab23cba1080a7e810b2f97190000000100000010000000a11334ea9745e3adfe3d13cffef49c541800000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee20000000010000008d0400003082048930820371a0030201020210025a8aef196f7e0d6c2104b21ae6702b300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3137313130363132323335325a170d3237313130363132323335325a305c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d311b30190603550403131254686177746520525341204341203230313830820122300d06092a864886f70d01010105000382010f003082010a0282010100ca085ee5538a971c1e432fb68aa756e98b8443a8ac9d7a55827a144b86b72f8f529f1ccab1205b6fba22dda69c2d78dae906084ebe13a6ebcbbb3eb9050c3e4ae1f0321f134ef506c54773893e80a38bf101249ba39966926b68ad0d2db4cd72a2f4f9385a65a6b48c53c1081a84f8fd2ef311756edc6a3129ac0d87cc936078df25ba265991c6835235a6ca9cb8281aced71cee14bf765c65ab381e79e97ccc492326a2525066d05961ffa0fe9a4c0c9ff9e88ede098bb815c1a4084c269c7b06dbfd8a745b587ecd63a4912f45f07a3c940b8a7cb205a967939f68e5956360d858955fe055ef93a7113b7ce692d86644e0abbda78fcda48578412454e7d8030203010001a38201403082013c301d0603551d0e04160414a3c85e6554e53078c105ea070a6a59ccb9fede5a301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b0601050507030230120603551d130101ff040830060101ff020100303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d30420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d200436303430320604551d2000302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f435053300d06092a864886f70d01010b05000382010100444d85e5dd1c828ce164d5a89022df761865ea65d23b25374a83da9987167cb1f50b33300fc6b5fa916fc072107ef9705c51fc32b8c1dc2fa35686cd6d5591ae0a92dc9b1ad25b511ff15fb3a65380fe162589b548da546e047b2d6503d85f8f4ef28133f81ff5e4b2a8fe0e889b2561a6b7f0d535695031648d79a3ee315f845932a2972080531b657ea0f063435a0f9871800bfc96b7679386f6fcfeb7bb3a94a951d2727c67fded778ce0f889025ebee07417863c0ded93d92ab42ff40cb7dcc82660b55003ec7d1ce3595f1f6fbf2f2997d6eef8d55858a1b1cc6c412b4081a3399550279740f24a3d3665798b8d335f295353fc5e1d420e0b8cf991287b 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exepid process 1584 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1984 vssvc.exe Token: SeRestorePrivilege 1984 vssvc.exe Token: SeAuditPrivilege 1984 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.execmd.exedescription pid process target process PID 1584 wrote to memory of 936 1584 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe cmd.exe PID 1584 wrote to memory of 936 1584 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe cmd.exe PID 1584 wrote to memory of 936 1584 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe cmd.exe PID 1584 wrote to memory of 936 1584 7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe cmd.exe PID 936 wrote to memory of 1080 936 cmd.exe vssadmin.exe PID 936 wrote to memory of 1080 936 cmd.exe vssadmin.exe PID 936 wrote to memory of 1080 936 cmd.exe vssadmin.exe PID 936 wrote to memory of 1080 936 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe"C:\Users\Admin\AppData\Local\Temp\7d0a7b508d1ccc7ce49b234a25bff26c487a85ec7e81ddf6325e8e301516ceae.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1584-55-0x0000000075191000-0x0000000075193000-memory.dmpFilesize
8KB