Analysis
-
max time kernel
157s -
max time network
174s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 00:58
Static task
static1
Behavioral task
behavioral1
Sample
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe
Resource
win10-en-20211208
General
-
Target
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe
-
Size
207KB
-
MD5
0520c11b31bee6eee6ec85bcef941633
-
SHA1
42920bcb4ac9a7706ab4889c2acf549e9511b399
-
SHA256
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18
-
SHA512
624d9fe993cff34bb4c6dd10fbd8564e0406bf768a9c69ff3d46ee32ed3ca1d813e9690179b021271deab4920f35c9f15f6b0a3c30296739d0c4aafdbefe3bb8
Malware Config
Extracted
C:\1ojtwwuq15-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/01C550AA1D0B3F85
http://decryptor.cc/01C550AA1D0B3F85
Extracted
sodinokibi
19
3135
ianaswanson.com
bookspeopleplaces.com
mirkoreisser.de
yousay.site
sanyue119.com
hebkft.hu
bouncingbonanza.com
shsthepapercut.com
dubnew.com
dubscollective.com
lykkeliv.net
jadwalbolanet.info
norovirus-ratgeber.de
knowledgemuseumbd.com
stefanpasch.me
irinaverwer.com
porno-gringo.com
educar.org
sahalstore.com
nestor-swiss.ch
12starhd.online
qualitus.com
mbfagency.com
mrxermon.de
mapawood.com
macabaneaupaysflechois.com
andersongilmour.co.uk
coffreo.biz
tux-espacios.com
unetica.fr
cleliaekiko.online
international-sound-awards.com
koko-nora.dk
hashkasolutindo.com
euro-trend.pl
acomprarseguidores.com
mikeramirezcpa.com
argenblogs.com.ar
allentownpapershow.com
aco-media.nl
homesdollar.com
adultgamezone.com
devstyle.org
villa-marrakesch.de
lachofikschiet.nl
withahmed.com
lloydconstruction.com
gaiam.nl
gastsicht.de
courteney-cox.net
mmgdouai.fr
oslomf.no
blossombeyond50.com
wari.com.pe
monark.com
centrospgolega.com
strandcampingdoonbeg.com
digi-talents.com
shiftinspiration.com
seagatesthreecharters.com
psa-sec.de
stupbratt.no
denovofoodsgroup.com
cnoia.org
carriagehousesalonvt.com
worldhealthbasicinfo.com
gw2guilds.org
alvinschwartz.wordpress.com
iviaggisonciliegie.it
zzyjtsgls.com
slashdb.com
hairstylesnow.site
talentwunder.com
croftprecision.co.uk
funjose.org.gt
praxis-management-plus.de
boulderwelt-muenchen-west.de
the-domain-trader.com
2ekeus.nl
partnertaxi.sk
mooreslawngarden.com
bsaship.com
deprobatehelp.com
krcove-zily.eu
extensionmaison.info
denifl-consulting.at
theapifactory.com
jbbjw.com
aminaboutique247.com
scenepublique.net
tinyagency.com
y-archive.com
klimt2012.info
plantag.de
apolomarcas.com
greenfieldoptimaldentalcare.com
olejack.ru
podsosnami.ru
zervicethai.co.th
csgospeltips.se
web.ion.ag
darrenkeslerministries.com
galleryartfair.com
bigler-hrconsulting.ch
pierrehale.com
iwelt.de
forestlakeuca.org.au
allfortheloveofyou.com
navyfederalautooverseas.com
notsilentmd.org
liveottelut.com
bouquet-de-roses.com
pogypneu.sk
htchorst.nl
oneheartwarriors.at
polymedia.dk
prochain-voyage.net
deschl.net
sporthamper.com
softsproductkey.com
alysonhoward.com
antenanavi.com
amylendscrestview.com
besttechie.com
innote.fi
anthonystreetrimming.com
haremnick.com
brevitempore.net
bingonearme.org
body-guards.it
marcuswhitten.site
bptdmaluku.com
servicegsm.net
ouryoungminds.wordpress.com
sportiomsportfondsen.nl
paymybill.guru
foryourhealth.live
aodaichandung.com
pawsuppetlovers.com
augenta.com
i-arslan.de
pointos.com
cursoporcelanatoliquido.online
mousepad-direkt.de
joseconstela.com
thefixhut.com
deltacleta.cat
reddysbakery.com
spsshomeworkhelp.com
rafaut.com
stoeferlehalle.de
biapi-coaching.fr
quemargrasa.net
raschlosser.de
epwritescom.wordpress.com
rehabilitationcentersinhouston.net
hushavefritid.dk
itelagen.com
slimidealherbal.com
financescorecard.com
fannmedias.com
urist-bogatyr.ru
sevenadvertising.com
idemblogs.com
stemplusacademy.com
nijaplay.com
the-virtualizer.com
baustb.de
deoudedorpskernnoordwijk.nl
operaslovakia.sk
kath-kirche-gera.de
transportesycementoshidalgo.es
vyhino-zhulebino-24.ru
nokesvilledentistry.com
xoabigail.com
stallbyggen.se
fayrecreations.com
hotelzentral.at
naturavetal.hr
comarenterprises.com
eglectonk.online
c-a.co.in
theduke.de
calxplus.eu
accountancywijchen.nl
candyhouseusa.com
shonacox.com
dr-pipi.de
extraordinaryoutdoors.com
ohidesign.com
burkert-ideenreich.de
35-40konkatsu.net
bayoga.co.uk
jeanlouissibomana.com
hotelsolbh.com.br
thaysa.com
cimanchesterescorts.co.uk
narcert.com
modelmaking.nl
completeweddingkansas.com
ftlc.es
starsarecircular.org
advokathuset.dk
dr-tremel-rednitzhembach.de
beaconhealthsystem.org
fensterbau-ziegler.de
milsing.hr
new.devon.gov.uk
marchand-sloboda.com
antiaginghealthbenefits.com
diversiapsicologia.es
latribuessentielle.com
kunze-immobilien.de
hkr-reise.de
steampluscarpetandfloors.com
noixdecocom.fr
finde-deine-marke.de
smart-light.co.uk
whittier5k.com
gamesboard.info
plastidip.com.ar
blgr.be
sagadc.com
bowengroup.com.au
mymoneyforex.com
baronloan.org
schoolofpassivewealth.com
fax-payday-loans.com
naturalrapids.com
testzandbakmetmening.online
craftleathermnl.com
platformier.com
edrcreditservices.nl
judithjansen.com
vorotauu.ru
edelman.jp
stingraybeach.com
cwsitservices.co.uk
anybookreader.de
mooshine.com
jsfg.com
milltimber.aberdeen.sch.uk
fibrofolliculoma.info
schmalhorst.de
alfa-stroy72.com
lubetkinmediacompanies.com
ralister.co.uk
mountsoul.de
cyntox.com
lescomtesdemean.be
pubweb.carnet.hr
groupe-cets.com
fitnessingbyjessica.com
ymca-cw.org.uk
vesinhnha.com.vn
iqbalscientific.com
johnsonfamilyfarmblog.wordpress.com
love30-chanko.com
milanonotai.it
geisterradler.de
advizewealth.com
onlybacklink.com
tetinfo.in
antonmack.de
kao.at
xltyu.com
troegs.com
promesapuertorico.com
caribbeansunpoker.com
plotlinecreative.com
noskierrenteria.com
homecomingstudio.com
mindpackstudios.com
baptisttabernacle.com
delchacay.com.ar
maxadams.london
atmos-show.com
solinegraphic.com
kirkepartner.dk
oneplusresource.org
strategicstatements.com
adoptioperheet.fi
yassir.pro
teknoz.net
parkstreetauto.net
mank.de
igfap.com
paulisdogshop.de
pv-design.de
leda-ukraine.com.ua
dirittosanitario.biz
pixelarttees.com
iyengaryogacharlotte.com
synlab.lt
logopaedie-blomberg.de
jakekozmor.com
phantastyk.com
zenderthelender.com
bloggyboulga.net
portoesdofarrobo.com
rimborsobancario.net
you-bysia.com.au
run4study.com
ai-spt.jp
stopilhan.com
ncs-graphic-studio.com
charlesreger.com
zewatchers.com
smartypractice.com
aurum-juweliere.de
smokeysstoves.com
katiekerr.co.uk
citymax-cr.com
bigasgrup.com
opatrovanie-ako.sk
summitmarketingstrategies.com
minipara.com
bastutunnan.se
agence-chocolat-noir.com
spylista.com
crowcanyon.com
gantungankunciakrilikbandung.com
imadarchid.com
chrissieperry.com
izzi360.com
carrybrands.nl
almosthomedogrescue.dog
rumahminangberdaya.com
whyinterestingly.ru
imaginado.de
igorbarbosa.com
comparatif-lave-linge.fr
better.town
bouldercafe-wuppertal.de
limassoldriving.com
babcockchurch.org
mercantedifiori.com
ungsvenskarna.se
linnankellari.fi
pomodori-pizzeria.de
creamery201.com
hrabritelefon.hr
theclubms.com
kedak.de
alten-mebel63.ru
aglend.com.au
associationanalytics.com
mediaplayertest.net
pickanose.com
mylolis.com
transliminaltribe.wordpress.com
dutchbrewingcoffee.com
carolinepenn.com
beautychance.se
aakritpatel.com
mezhdu-delom.ru
intecwi.com
tenacitytenfold.com
walter-lemm.de
dsl-ip.de
finediningweek.pl
dpo-as-a-service.com
zflas.com
qlog.de
xn--fnsterputssollentuna-39b.se
newstap.com.ng
vibehouse.rw
atozdistribution.co.uk
fiscalsort.com
vloeren-nu.nl
micahkoleoso.de
insidegarage.pl
quizzingbee.com
kingfamily.construction
higadograsoweb.com
hairnetty.wordpress.com
krlosdavid.com
hmsdanmark.dk
securityfmm.com
jolly-events.com
myzk.site
kojima-shihou.com
abl1.net
DupontSellsHomes.com
pmc-services.de
montrium.com
autopfand24.de
jyzdesign.com
smejump.co.th
camsadviser.com
piajeppesen.dk
firstpaymentservices.com
jobcenterkenya.com
poultrypartners.nl
thailandholic.com
cite4me.org
kaliber.co.jp
torgbodenbollnas.se
cerebralforce.net
miriamgrimm.de
tandartspraktijkhartjegroningen.nl
takeflat.com
chaotrang.com
abuelos.com
mrsplans.net
selfoutlet.com
aselbermachen.com
hhcourier.com
fransespiegels.nl
senson.fi
ruralarcoiris.com
dareckleyministries.com
mediaclan.info
refluxreducer.com
hokagestore.com
freie-baugutachterpraxis.de
div-vertriebsforschung.de
meusharklinithome.wordpress.com
sportverein-tambach.de
zimmerei-deboer.de
bafuncs.org
deepsouthclothingcompany.com
no-plans.com
simoneblum.de
sauschneider.info
rostoncastings.co.uk
parebrise-tla.fr
readberserk.com
songunceliptv.com
dw-css.de
manutouchmassage.com
rota-installations.co.uk
classycurtainsltd.co.uk
rieed.de
gemeentehetkompas.nl
otto-bollmann.de
nuzech.com
jerling.de
kostenlose-webcams.com
jorgobe.at
verifort-capital.de
campus2day.de
revezlimage.com
vibethink.net
echtveilig.nl
appsformacpc.com
tanciu.com
lichencafe.com
sairaku.net
falcou.fr
easytrans.com.au
erstatningsadvokaterne.dk
aunexis.ch
ra-staudte.de
projetlyonturin.fr
bierensgebakkramen.nl
heurigen-bauer.at
ilive.lt
shiresresidential.com
levihotelspa.fi
conasmanagement.de
blood-sports.net
agence-referencement-naturel-geneve.net
ecopro-kanto.com
filmstreamingvfcomplet.be
punchbaby.com
autofolierung-lu.de
smale-opticiens.nl
directwindowco.com
presseclub-magdeburg.de
ausbeverage.com.au
drnice.de
evologic-technologies.com
ikads.org
live-con-arte.de
spectrmash.ru
parking.netgateway.eu
friendsandbrgrs.com
pinkexcel.com
tarotdeseidel.com
kissit.ca
supportsumba.nl
nurturingwisdom.com
ostheimer.at
zso-mannheim.de
herbstfeststaefa.ch
forskolorna.org
chefdays.de
teczowadolina.bytom.pl
luckypatcher-apkz.com
juneauopioidworkgroup.org
d2marketing.co.uk
consultaractadenacimiento.com
leoben.at
wsoil.com.sg
makeurvoiceheard.com
westdeptfordbuyrite.com
maryloutaylor.com
dnepr-beskid.com.ua
eaglemeetstiger.de
zonamovie21.net
gadgetedges.com
americafirstcommittee.org
nativeformulas.com
urmasiimariiuniri.ro
ino-professional.ru
ussmontanacommittee.us
n1-headache.com
blogdecachorros.com
boldcitydowntown.com
saxtec.com
kojinsaisei.info
nsec.se
gasbarre.com
peterstrobos.com
expandet.dk
devlaur.com
wien-mitte.co.at
helenekowalsky.com
outcomeisincome.com
familypark40.com
coastalbridgeadvisors.com
vanswigchemdesign.com
allamatberedare.se
bestbet.com
mediaacademy-iraq.org
luxurytv.jp
dublikator.com
faronics.com
odiclinic.org
highimpactoutdoors.net
insigniapmg.com
daniel-akermann-architektur-und-planung.ch
lapinlviasennus.fi
tigsltd.com
naswrrg.org
hexcreatives.co
atalent.fi
garage-lecompte-rouen.fr
ivivo.es
vitavia.lt
bodyfulls.com
goodgirlrecovery.com
importardechina.info
ecoledansemulhouse.fr
stoneys.ch
tandartspraktijkheesch.nl
ladelirante.fr
dramagickcom.wordpress.com
filmvideoweb.com
nacktfalter.de
kamahouse.net
highlinesouthasc.com
123vrachi.ru
crosspointefellowship.church
sabel-bf.com
zimmerei-fl.de
rebeccarisher.com
wurmpower.at
xn--singlebrsen-vergleich-nec.com
pridoxmaterieel.nl
vox-surveys.com
x-ray.ca
sinal.org
id-vet.com
trackyourconstruction.com
charlottepoudroux-photographie.fr
lukeshepley.wordpress.com
hvccfloorcare.com
argos.wityu.fund
architekturbuero-wagner.net
thedad.com
airconditioning-waalwijk.nl
wacochamber.com
employeesurveys.com
polzine.net
nvwoodwerks.com
carlosja.com
sotsioloogia.ee
mirjamholleman.nl
huissier-creteil.com
ligiercenter-sachsen.de
renergysolution.com
evangelische-pfarrgemeinde-tuniberg.de
sloverse.com
hugoversichert.de
kafu.ch
koken-voor-baby.nl
maratonaclubedeportugal.com
verbisonline.com
marietteaernoudts.nl
braffinjurylawfirm.com
simulatebrain.com
d1franchise.com
behavioralmedicinespecialists.com
lmtprovisions.com
journeybacktolife.com
ftf.or.at
handi-jack-llc.com
tampaallen.com
huesges-gruppe.de
gratispresent.se
ontrailsandboulevards.com
vermoote.de
madinblack.com
markelbroch.com
crediacces.com
ilcdover.com
bodyforwife.com
samnewbyjax.com
birnam-wood.com
notmissingout.com
commonground-stories.com
esope-formation.fr
schutting-info.nl
manifestinglab.com
ditog.fr
webcodingstudio.com
aarvorg.com
philippedebroca.com
fitovitaforum.com
tstaffing.nl
commercialboatbuilding.com
beyondmarcomdotcom.wordpress.com
levdittliv.se
memaag.com
healthyyworkout.com
pasivect.co.uk
gopackapp.com
twohourswithlena.wordpress.com
art2gointerieurprojecten.nl
apprendrelaudit.com
julis-lsa.de
cuppacap.com
dinslips.se
waveneyrivercentre.co.uk
brigitte-erler.com
controldekk.com
labobit.it
visiativ-industry.fr
basisschooldezonnewijzer.nl
leeuwardenstudentcity.nl
resortmtn.com
victoriousfestival.co.uk
jenniferandersonwriter.com
ceid.info.tr
lascuola.nl
themadbotter.com
bimnapratica.com
pier40forall.org
corona-handles.com
4net.guru
micro-automation.de
collaborativeclassroom.org
allure-cosmetics.at
bauertree.com
arteservicefabbro.com
sobreholanda.com
dr-seleznev.com
liliesandbeauties.org
8449nohate.org
darnallwellbeing.org.uk
tradiematepro.com.au
schoellhammer.com
ateliergamila.com
exenberger.at
officehymy.com
binder-buerotechnik.at
wraithco.com
caffeinternet.it
associacioesportivapolitg.cat
solerluethi-allart.ch
backstreetpub.com
osterberg.fi
latestmodsapks.com
groupe-frayssinet.fr
promalaga.es
lebellevue.fr
christ-michael.net
theletter.company
c2e-poitiers.com
klusbeter.nl
digivod.de
corola.es
schraven.de
wolf-glas-und-kunst.de
buymedical.biz
mbxvii.com
tanzprojekt.com
verytycs.com
desert-trails.com
boompinoy.com
kikedeoliveira.com
elpa.se
seminoc.com
uimaan.fi
jacquin-maquettes.com
longislandelderlaw.com
gmto.fr
helikoptervluchtnewyork.nl
baumkuchenexpo.jp
nhadatcanho247.com
elimchan.com
siluet-decor.ru
urclan.net
sandd.nl
www1.proresult.no
abogadoengijon.es
bhwlawfirm.com
slwgs.org
lusak.at
winrace.no
triggi.de
sweering.fr
kuntokeskusrok.fi
musictreehouse.net
hannah-fink.de
nakupunafoundation.org
destinationclients.fr
uranus.nl
ceres.org.au
chandlerpd.com
castillobalduz.es
lynsayshepherd.co.uk
4youbeautysalon.com
calabasasdigest.com
tastewilliamsburg.com
drinkseed.com
noesis.tech
ilso.net
frontierweldingllc.com
rosavalamedahr.com
hatech.io
harpershologram.wordpress.com
spacecitysisters.org
rerekatu.com
videomarketing.pro
smithmediastrategies.com
lange.host
daklesa.de
travelffeine.com
stemenstilte.nl
vietlawconsultancy.com
mepavex.nl
space.ua
fundaciongregal.org
corendonhotels.com
myteamgenius.com
rhinosfootballacademy.com
cranleighscoutgroup.org
sachnendoc.com
waynela.com
lionware.de
maasreusel.nl
nandistribution.nl
patrickfoundation.net
hypozentrum.com
richard-felix.co.uk
mdacares.com
trapiantofue.it
spargel-kochen.de
greenpark.ch
lucidinvestbank.com
kaminscy.com
delawarecorporatelaw.com
tennisclubetten.nl
austinlchurch.com
sipstroysochi.ru
simpliza.com
degroenetunnel.com
qualitaetstag.de
buroludo.nl
oldschoolfun.net
petnest.ir
iwr.nl
mrtour.site
littlebird.salon
lillegrandpalais.com
christinarebuffetcourses.com
happyeasterimages.org
joyeriaorindia.com
bridgeloanslenders.com
roadwarrior.app
psnacademy.in
assurancesalextrespaille.fr
homng.net
faizanullah.com
campusoutreach.org
blewback.com
abitur-undwieweiter.de
panelsandwichmadrid.es
precisionbevel.com
mdk-mediadesign.de
myhealth.net.au
jameskibbie.com
pelorus.group
houseofplus.com
cafemattmeera.com
ravensnesthomegoods.com
quickyfunds.com
muamuadolls.com
vickiegrayimages.com
dutchcoder.nl
sojamindbody.com
kosterra.com
cityorchardhtx.com
oncarrot.com
dezatec.es
asiluxury.com
enovos.de
mytechnoway.com
gonzalezfornes.es
thedresserie.com
danholzmann.com
mariposapropaneaz.com
compliancesolutionsstrategies.com
socstrp.org
artige.com
retroearthstudio.com
nmiec.com
mrsfieldskc.com
drugdevice.org
first-2-aid-u.com
bargningavesta.se
unim.su
autodujos.lt
danielblum.info
systemate.dk
smhydro.com.pl
devok.info
justinvieira.com
layrshift.eu
thewellnessmimi.com
globedivers.wordpress.com
manijaipur.com
edgewoodestates.org
xn--rumung-bua.online
ncuccr.org
jandaonline.com
rksbusiness.com
simplyblessedbykeepingitreal.com
body-armour.online
slupetzky.at
xn--thucmctc-13a1357egba.com
pcp-nc.com
socialonemedia.com
lbcframingelectrical.com
bargningharnosand.se
cortec-neuro.com
coursio.com
ledmes.ru
asgestion.com
blog.solutionsarchitect.guru
balticdentists.com
cursosgratuitosnainternet.com
paradicepacks.com
spd-ehningen.de
nosuchthingasgovernment.com
personalenhancementcenter.com
brandl-blumen.de
pcprofessor.com
harveybp.com
wmiadmin.com
spinheal.ru
hellohope.com
coding-marking.com
shadebarandgrillorlando.com
kariokids.com
puertamatic.es
ivfminiua.com
galserwis.pl
fotoscondron.com
newyou.at
milestoneshows.com
corelifenutrition.com
bunburyfreightservices.com.au
ctrler.cn
symphonyenvironmental.com
toponlinecasinosuk.co.uk
humancondition.com
testcoreprohealthuk.com
thenewrejuveme.com
jobmap.at
stormwall.se
fotoideaymedia.es
copystar.co.uk
oemands.dk
purposeadvisorsolutions.com
rushhourappliances.com
naturstein-hotte.de
onlyresultsmarketing.com
sla-paris.com
mountaintoptinyhomes.com
blacksirius.de
hihaho.com
alsace-first.com
perbudget.com
plv.media
wasmachtmeinfonds.at
marketingsulweb.com
sportsmassoren.com
bee4win.com
offroadbeasts.com
craigvalentineacademy.com
sterlingessay.com
heidelbergartstudio.gallery
edv-live.de
fizzl.ru
geoffreymeuli.com
gasolspecialisten.se
i-trust.dk
instatron.net
stacyloeb.com
kevinjodea.com
bundabergeyeclinic.com.au
celularity.com
proudground.org
bordercollie-nim.nl
lapinvihreat.fi
truenyc.co
caribdoctor.org
bxdf.info
veybachcenter.de
marathonerpaolo.com
smogathon.com
berlin-bamboo-bikes.org
flexicloud.hk
myhostcloud.com
smalltownideamill.wordpress.com
xn--logopdie-leverkusen-kwb.de
physiofischer.de
satyayoga.de
ora-it.de
cactusthebrand.com
cirugiauretra.es
theshungiteexperience.com.au
berliner-versicherungsvergleich.de
101gowrie.com
actecfoundation.org
iyahayki.nl
skanah.com
ziegler-praezisionsteile.de
modestmanagement.com
facettenreich27.de
walkingdeadnj.com
eadsmurraypugh.com
maureenbreezedancetheater.org
stampagrafica.es
polychromelabs.com
catholicmusicfest.com
thee.network
mylovelybluesky.com
ncid.bc.ca
coding-machine.com
irishmachineryauctions.com
geekwork.pl
waermetauscher-berechnen.de
launchhubl.com
theadventureedge.com
parks-nuernberg.de
tomaso.gr
tinkoff-mobayl.ru
pmcimpact.com
vancouver-print.ca
mastertechengineering.com
dlc.berlin
boosthybrid.com.au
kaotikkustomz.com
jiloc.com
schlafsack-test.net
farhaani.com
architecturalfiberglass.org
people-biz.com
pferdebiester.de
jvanvlietdichter.nl
fairfriends18.de
dekkinngay.com
havecamerawilltravel2017.wordpress.com
restaurantesszimmer.de
anteniti.com
tulsawaterheaterinstallation.com
psc.de
norpol-yachting.com
siliconbeach-realestate.com
fitnessbazaar.com
profectis.de
lefumetdesdombes.com
zieglerbrothers.de
rollingrockcolumbia.com
danskretursystem.dk
dontpassthepepper.com
thomasvicino.com
aniblinova.wordpress.com
solhaug.tk
vihannesporssi.fi
cheminpsy.fr
henricekupper.com
kampotpepper.gives
ogdenvision.com
sofavietxinh.com
hiddencitysecrets.com.au
artotelamsterdam.com
greenko.pl
broseller.com
admos-gleitlager.de
kidbucketlist.com.au
radaradvies.nl
wellplast.se
durganews.com
bockamp.com
live-your-life.jp
girlillamarketing.com
danubecloud.com
lenreactiv-shop.ru
leather-factory.co.jp
amerikansktgodis.se
thomas-hospital.de
trystana.com
parkcf.nl
crowd-patch.co.uk
romeguidedvisit.com
femxarxa.cat
autodemontagenijmegen.nl
team-montage.dk
toreria.es
katketytaanet.fi
interactcenter.org
tsklogistik.eu
executiveairllc.com
eco-southafrica.com
1kbk.com.ua
loprus.pl
chavesdoareeiro.com
remcakram.com
pt-arnold.de
maineemploymentlawyerblog.com
yamalevents.com
sw1m.ru
kindersitze-vergleich.de
oceanastudios.com
evergreen-fishing.com
imperfectstore.com
bbsmobler.se
syndikat-asphaltfieber.de
woodworkersolution.com
answerstest.ru
werkkring.nl
kadesignandbuild.co.uk
microcirc.net
drfoyle.com
vetapharma.fr
botanicinnovations.com
365questions.org
moveonnews.com
modamilyon.com
bildungsunderlebnis.haus
ccpbroadband.com
alhashem.net
praxis-foerderdiagnostik.de
xn--vrftet-pua.biz
global-kids.info
slimani.net
webhostingsrbija.rs
ahouseforlease.com
tanzschule-kieber.de
grupocarvalhoerodrigues.com.br
kmbshipping.co.uk
connectedace.com
ampisolabergeggi.it
blumenhof-wegleitner.at
xlarge.at
midmohandyman.com
vdberg-autoimport.nl
neuschelectrical.co.za
abogadosaccidentetraficosevilla.es
tonelektro.nl
321play.com.hk
ventti.com.ar
jusibe.com
otsu-bon.com
pay4essays.net
all-turtles.com
roygolden.com
saarland-thermen-resort.com
triactis.com
insp.bi
nancy-informatique.fr
ihr-news.jp
iphoneszervizbudapest.hu
shhealthlaw.com
mooglee.com
herbayupro.com
conexa4papers.trade
clos-galant.com
woodleyacademy.org
work2live.de
asteriag.com
glennroberts.co.nz
streamerzradio1.site
liikelataamo.fi
lapmangfpt.info.vn
igrealestate.com
bricotienda.com
morawe-krueger.de
smessier.com
seitzdruck.com
balticdermatology.lt
makeitcount.at
abogadosadomicilio.es
abogados-en-alicante.es
celeclub.org
jasonbaileystudio.com
miraclediet.fun
pocket-opera.de
vannesteconstruct.be
seevilla-dr-sturm.at
pivoineetc.fr
tophumanservicescourses.com
creative-waves.co.uk
webmaster-peloton.com
rocketccw.com
tuuliautio.fi
bradynursery.com
xn--fn-kka.no
sexandfessenjoon.wordpress.com
freie-gewerkschaften.de
zweerscreatives.nl
analiticapublica.es
lecantou-coworking.com
southeasternacademyofprosthodontics.org
bristolaeroclub.co.uk
xtptrack.com
bigbaguettes.eu
huehnerauge-entfernen.de
heliomotion.com
tomoiyuma.com
hoteledenpadova.it
ecpmedia.vn
licor43.de
baylegacy.com
craigmccabe.fun
nataschawessels.com
embracinghiscall.com
yourobgyn.net
mardenherefordshire-pc.gov.uk
bogdanpeptine.ro
upplandsspar.se
saka.gr
kalkulator-oszczednosci.pl
teresianmedia.org
icpcnj.org
brawnmediany.com
deko4you.at
nicoleaeschbachorg.wordpress.com
boisehosting.net
ulyssemarketing.com
kenhnoithatgo.com
entopic.com
tongdaifpthaiphong.net
centuryrs.com
nachhilfe-unterricht.com
ki-lowroermond.nl
trulynolen.co.uk
grelot-home.com
vitalyscenter.es
merzi.info
despedidascostablanca.es
id-et-d.fr
sanaia.com
makeflowers.ru
humanityplus.org
foretprivee.ca
penco.ie
upmrkt.co
dushka.ua
kamienny-dywan24.pl
faroairporttransfers.net
kisplanning.com.au
colorofhorses.com
fatfreezingmachines.com
tips.technology
pasvenska.se
1team.es
haar-spange.com
eraorastudio.com
gporf.fr
gymnasedumanagement.com
hardinggroup.com
lorenacarnero.com
centromarysalud.com
sarbatkhalsafoundation.org
todocaracoles.com
effortlesspromo.com
real-estate-experts.com
cuspdental.com
surespark.org.uk
simpkinsedwards.co.uk
serce.info.pl
tecnojobsnet.com
figura.team
karacaoglu.nl
suncrestcabinets.ca
michaelsmeriglioracing.com
wychowanieprzedszkolne.pl
rozemondcoaching.nl
aprepol.com
malychanieruchomoscipremium.com
mir-na-iznanku.com
stoeberstuuv.de
planchaavapor.net
turkcaparbariatrics.com
biortaggivaldelsa.com
artallnightdc.com
ausair.com.au
seproc.hn
skiltogprint.no
waywithwords.net
datacenters-in-europe.com
lightair.com
em-gmbh.ch
chatizel-paysage.fr
-
net
true
-
pid
19
-
prc
thunderbird
excel
synctime
firefox
msaccess
ocautoupds
visio
steam
onenote
agntsvc
infopath
dbeng50
mspub
oracle
powerpnt
encsvc
dbsnmp
tbirdconfig
mydesktopservice
sql
ocomm
outlook
sqbcoreservice
wordpad
xfssvccon
winword
isqlplussvc
thebat
ocssd
mydesktopqos
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3135
-
svc
backup
sql
sophos
vss
veeam
svc$
mepocs
memtas
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 1 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exepid process 1092 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\ReceiveRequest.tiff d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File renamed C:\Users\Admin\Pictures\CompareStop.raw => \??\c:\users\admin\pictures\CompareStop.raw.1ojtwwuq15 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File renamed C:\Users\Admin\Pictures\ConnectShow.png => \??\c:\users\admin\pictures\ConnectShow.png.1ojtwwuq15 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File renamed C:\Users\Admin\Pictures\DebugUninstall.tif => \??\c:\users\admin\pictures\DebugUninstall.tif.1ojtwwuq15 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File renamed C:\Users\Admin\Pictures\PushPublish.raw => \??\c:\users\admin\pictures\PushPublish.raw.1ojtwwuq15 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File renamed C:\Users\Admin\Pictures\ReceiveRequest.tiff => \??\c:\users\admin\pictures\ReceiveRequest.tiff.1ojtwwuq15 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File renamed C:\Users\Admin\Pictures\WaitRequest.png => \??\c:\users\admin\pictures\WaitRequest.png.1ojtwwuq15 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Loads dropped DLL 3 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exepid process 1648 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe 1648 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe 1648 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\k51299BQXH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe" d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exedescription ioc process File opened (read-only) \??\U: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\A: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\E: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\K: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\Q: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\R: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\M: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\T: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\V: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\N: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\P: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\W: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\B: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\F: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\G: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\H: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\L: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\X: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\Z: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\D: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\I: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\J: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\O: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\S: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened (read-only) \??\Y: d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Drops file in System32 directory 1 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ndr8e8z0074b.bmp" d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exed37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exedescription ioc process File opened for modification \??\c:\program files\RegisterDebug.nfo d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File created \??\c:\program files (x86)\1ojtwwuq15-readme.txt d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\DenyUpdate.mp3 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\HideMeasure.mht d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\CompareComplete.xltm d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\1ojtwwuq15-readme.txt d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\InitializeSelect.3gp2 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\MoveRevoke.asx d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\RegisterFind.emf d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\WriteSend.mpeg d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\OutRevoke.i64 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\RemoveFormat.au d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\1ojtwwuq15-readme.txt d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\ExitClose.mov d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\MeasureOut.ppsx d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File created \??\c:\program files\1ojtwwuq15-readme.txt d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification \??\c:\program files\OutSend.wps d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Drops file in Windows directory 1 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exedescription ioc process File opened for modification C:\Windows\svchost.com d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exepowershell.exepid process 1092 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe 1076 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1092 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe Token: SeDebugPrivilege 1076 powershell.exe Token: SeBackupPrivilege 1552 vssvc.exe Token: SeRestorePrivilege 1552 vssvc.exe Token: SeAuditPrivilege 1552 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exed37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exedescription pid process target process PID 1648 wrote to memory of 1092 1648 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe PID 1648 wrote to memory of 1092 1648 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe PID 1648 wrote to memory of 1092 1648 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe PID 1648 wrote to memory of 1092 1648 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe PID 1092 wrote to memory of 1076 1092 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe powershell.exe PID 1092 wrote to memory of 1076 1092 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe powershell.exe PID 1092 wrote to memory of 1076 1092 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe powershell.exe PID 1092 wrote to memory of 1076 1092 d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe"C:\Users\Admin\AppData\Local\Temp\d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exeMD5
465ee6b9235b03681d7c6a13fd9dc5d2
SHA1fd23632145fe9490f30717664e847095b2bc2625
SHA25675fb2138b23af02cdc5d4ba3b61c4b8cb9a3608c2ed39ababe39dd9e0e731086
SHA51282f5d40f69f0f992fbd021a943f9f3d8d5999cab5970d79f185925c8bf18dfbfe7835830ecc490a0ec492e3ad9283ee691f432269b773b3d8f214666717132d2
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEMD5
9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\Users\Admin\AppData\Local\Temp\3582-490\d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exeMD5
465ee6b9235b03681d7c6a13fd9dc5d2
SHA1fd23632145fe9490f30717664e847095b2bc2625
SHA25675fb2138b23af02cdc5d4ba3b61c4b8cb9a3608c2ed39ababe39dd9e0e731086
SHA51282f5d40f69f0f992fbd021a943f9f3d8d5999cab5970d79f185925c8bf18dfbfe7835830ecc490a0ec492e3ad9283ee691f432269b773b3d8f214666717132d2
-
\Users\Admin\AppData\Local\Temp\3582-490\d37ad27b1857cf85fbe15ac9484c05b059c750987290ee46c3f50ee8e4ea1f18.exeMD5
465ee6b9235b03681d7c6a13fd9dc5d2
SHA1fd23632145fe9490f30717664e847095b2bc2625
SHA25675fb2138b23af02cdc5d4ba3b61c4b8cb9a3608c2ed39ababe39dd9e0e731086
SHA51282f5d40f69f0f992fbd021a943f9f3d8d5999cab5970d79f185925c8bf18dfbfe7835830ecc490a0ec492e3ad9283ee691f432269b773b3d8f214666717132d2
-
memory/1076-60-0x000007FEFB791000-0x000007FEFB793000-memory.dmpFilesize
8KB
-
memory/1076-62-0x0000000002590000-0x0000000002592000-memory.dmpFilesize
8KB
-
memory/1076-63-0x0000000002592000-0x0000000002594000-memory.dmpFilesize
8KB
-
memory/1076-64-0x0000000002594000-0x0000000002597000-memory.dmpFilesize
12KB
-
memory/1076-61-0x000007FEF2A10000-0x000007FEF356D000-memory.dmpFilesize
11.4MB
-
memory/1076-65-0x000000000259B000-0x00000000025BA000-memory.dmpFilesize
124KB
-
memory/1648-55-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB