Malware Analysis Report

2025-01-18 19:39

Sample ID 220124-bg8l4ahcd7
Target c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18
SHA256 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18
Tags
$2a$10$dgfmm1b4y9mglsge2k95w.drh6ylpng0uakt.md2hsbphq0yyt5gi 4065 sodinokibi persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18

Threat Level: Known bad

The file c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18 was found to be: Known bad.

Malicious Activity Summary

$2a$10$dgfmm1b4y9mglsge2k95w.drh6ylpng0uakt.md2hsbphq0yyt5gi 4065 sodinokibi persistence ransomware

Sodin,Sodinokibi,REvil

Sodinokibi family

Modifies extensions of user files

Enumerates connected drives

Adds Run key to start application

Drops file in System32 directory

Sets desktop wallpaper using registry

Drops file in Program Files directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-24 01:08

Signatures

Sodinokibi family

sodinokibi

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-24 01:08

Reported

2022-01-24 01:24

Platform

win7-en-20211208

Max time kernel

134s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification \??\c:\users\admin\pictures\ShowGrant.tiff C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\ShowGrant.tiff => \??\c:\users\admin\pictures\ShowGrant.tiff.y05apg8ela C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\UnblockExit.tif => \??\c:\users\admin\pictures\UnblockExit.tif.y05apg8ela C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\UpdateGet.tiff => \??\c:\users\admin\pictures\UpdateGet.tiff.y05apg8ela C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\MountGrant.raw => \??\c:\users\admin\pictures\MountGrant.raw.y05apg8ela C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\PushUnregister.raw => \??\c:\users\admin\pictures\PushUnregister.raw.y05apg8ela C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\users\admin\pictures\StopSet.tiff C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\StopSet.tiff => \??\c:\users\admin\pictures\StopSet.tiff.y05apg8ela C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\users\admin\pictures\UpdateGet.tiff C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\ExpandGet.png => \??\c:\users\admin\pictures\ExpandGet.png.y05apg8ela C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DNXeNcyLON = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe" C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\CatRoot2\dberr.txt C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1qj23512d.bmp" C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\CompleteCheckpoint.pptm C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ConvertEdit.jfif C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\InvokeUpdate.dotx C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\PopOut.vssm C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\RevokeDebug.rtf C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File created \??\c:\program files\y05apg8ela-readme.txt C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\InstallShow.htm C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\NewBlock.xml C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\RedoSplit.TTS C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\RemoveInitialize.ppt C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ResetDebug.ex_ C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ResolveRequest.ods C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\StartDisconnect.7z C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\EditSwitch.ttf C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\UnlockClear.wps C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\y05apg8ela-readme.txt C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\StepRestore.odt C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\CheckpointSubmit.docx C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\DisconnectRemove.xsl C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\GetEnable.mpp C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ResetRevoke.asf C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\AddInitialize.mpeg3 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ResetUninstall.ttc C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\UnlockBlock.easmx C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\UnprotectExit.reg C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ClosePush.M2TS C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ConvertToNew.TS C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\FormatExpand.xps C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\y05apg8ela-readme.txt C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File created \??\c:\program files (x86)\y05apg8ela-readme.txt C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\MountNew.mpg C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\RequestPublish.gif C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\SubmitTest.mpg C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\y05apg8ela-readme.txt C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\CopyConfirm.mov C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ConvertToSync.pptm C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\PingPush.svgz C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\GroupResume.js C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe

"C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ziegler-praezisionsteile.de udp
FR 92.51.135.182:443 ziegler-praezisionsteile.de tcp
US 8.8.8.8:53 www.ziegler-praezisionsteile.de udp
FR 92.51.135.182:443 www.ziegler-praezisionsteile.de tcp
US 8.8.8.8:53 winrace.no udp
NO 77.88.77.99:443 winrace.no tcp
US 8.8.8.8:53 architekturbuero-wagner.net udp
DE 37.17.229.133:443 architekturbuero-wagner.net tcp
DE 37.17.229.133:443 architekturbuero-wagner.net tcp
US 8.8.8.8:53 rota-installations.co.uk udp
GB 89.145.65.235:443 rota-installations.co.uk tcp
US 8.8.8.8:53 buroludo.nl udp
NL 185.37.70.69:443 buroludo.nl tcp
NL 185.37.70.69:443 buroludo.nl tcp
US 8.8.8.8:53 antenanavi.com udp
US 8.8.8.8:53 noesis.tech udp
IN 143.110.186.61:443 noesis.tech tcp
US 8.8.8.8:53 mercantedifiori.com udp
US 70.32.1.32:443 mercantedifiori.com tcp
US 8.8.8.8:53 globedivers.wordpress.com udp
US 192.0.78.12:443 globedivers.wordpress.com tcp
US 192.0.78.12:443 globedivers.wordpress.com tcp
US 8.8.8.8:53 elpa.se udp
SE 46.21.99.220:443 elpa.se tcp
US 8.8.8.8:53 rocketccw.com udp
BG 194.1.147.29:443 rocketccw.com tcp
BG 194.1.147.29:443 rocketccw.com tcp
US 8.8.8.8:53 spacecitysisters.org udp
US 198.185.159.145:443 spacecitysisters.org tcp
US 198.185.159.145:443 spacecitysisters.org tcp
US 8.8.8.8:53 themadbotter.com udp
US 8.8.8.8:53 vyhino-zhulebino-24.ru udp
US 8.8.8.8:53 mmgdouai.fr udp
FR 188.165.53.185:443 mmgdouai.fr tcp
US 8.8.8.8:53 binder-buerotechnik.at udp
DE 87.230.41.243:443 binder-buerotechnik.at tcp
DE 87.230.41.243:443 binder-buerotechnik.at tcp
US 8.8.8.8:53 iviaggisonciliegie.it udp
GB 185.181.117.56:443 iviaggisonciliegie.it tcp
GB 185.181.117.56:443 iviaggisonciliegie.it tcp
US 8.8.8.8:53 alsace-first.com udp
FR 213.186.33.4:443 alsace-first.com tcp
US 8.8.8.8:53 bxdf.info udp
ES 185.107.227.241:443 bxdf.info tcp
US 8.8.8.8:53 daniel-akermann-architektur-und-planung.ch udp
CH 217.26.52.17:443 daniel-akermann-architektur-und-planung.ch tcp
CH 217.26.52.17:443 daniel-akermann-architektur-und-planung.ch tcp
US 8.8.8.8:53 milanonotai.it udp
DE 3.124.181.24:443 milanonotai.it tcp
US 8.8.8.8:53 www.milanonotai.it udp
DE 3.124.181.24:443 www.milanonotai.it tcp
US 8.8.8.8:53 bhwlawfirm.com udp
US 64.91.238.104:443 bhwlawfirm.com tcp
US 64.91.238.104:443 bhwlawfirm.com tcp
US 8.8.8.8:53 mousepad-direkt.de udp
FR 5.175.14.15:443 mousepad-direkt.de tcp
FR 5.175.14.15:443 mousepad-direkt.de tcp
US 8.8.8.8:53 juneauopioidworkgroup.org udp
DE 91.195.240.13:443 juneauopioidworkgroup.org tcp
US 8.8.8.8:53 waermetauscher-berechnen.de udp
DE 92.204.37.106:443 waermetauscher-berechnen.de tcp
DE 92.204.37.106:443 waermetauscher-berechnen.de tcp
US 8.8.8.8:53 huissier-creteil.com udp
FR 213.186.33.4:443 huissier-creteil.com tcp
US 8.8.8.8:53 charlottepoudroux-photographie.fr udp
FR 213.186.33.3:443 charlottepoudroux-photographie.fr tcp
US 8.8.8.8:53 amerikansktgodis.se udp
SE 46.246.30.147:443 amerikansktgodis.se tcp
SE 46.246.30.147:443 amerikansktgodis.se tcp
US 8.8.8.8:53 ausair.com.au udp
AU 116.90.61.204:443 ausair.com.au tcp
US 8.8.8.8:53 ouryoungminds.wordpress.com udp
US 192.0.78.13:443 ouryoungminds.wordpress.com tcp
US 192.0.78.13:443 ouryoungminds.wordpress.com tcp
US 8.8.8.8:53 chrissieperry.com udp
AU 35.213.220.12:443 chrissieperry.com tcp
AU 35.213.220.12:443 chrissieperry.com tcp
US 8.8.8.8:53 tanzprojekt.com udp
FR 5.175.14.11:443 tanzprojekt.com tcp
FR 5.175.14.11:443 tanzprojekt.com tcp
US 8.8.8.8:53 sevenadvertising.com udp
US 52.71.57.184:443 sevenadvertising.com tcp
US 54.209.32.212:443 sevenadvertising.com tcp

Files

memory/960-55-0x0000000076371000-0x0000000076373000-memory.dmp

memory/428-56-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

memory/428-58-0x00000000028F0000-0x00000000028F2000-memory.dmp

memory/428-59-0x00000000028F2000-0x00000000028F4000-memory.dmp

memory/428-60-0x00000000028F4000-0x00000000028F7000-memory.dmp

memory/428-57-0x000007FEF2A70000-0x000007FEF35CD000-memory.dmp

memory/428-61-0x00000000028FB000-0x000000000291A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-24 01:08

Reported

2022-01-24 01:25

Platform

win10-en-20211208

Max time kernel

183s

Max time network

190s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\SuspendGroup.raw => \??\c:\users\admin\pictures\SuspendGroup.raw.3nwm89 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\SyncAssert.tif => \??\c:\users\admin\pictures\SyncAssert.tif.3nwm89 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\CompareUninstall.png => \??\c:\users\admin\pictures\CompareUninstall.png.3nwm89 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\InitializeRename.crw => \??\c:\users\admin\pictures\InitializeRename.crw.3nwm89 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\OptimizeRename.raw => \??\c:\users\admin\pictures\OptimizeRename.raw.3nwm89 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\SelectDebug.raw => \??\c:\users\admin\pictures\SelectDebug.raw.3nwm89 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\DisableRepair.crw => \??\c:\users\admin\pictures\DisableRepair.crw.3nwm89 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\users\admin\pictures\ReceiveConvertFrom.tiff C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File renamed C:\Users\Admin\Pictures\ReceiveConvertFrom.tiff => \??\c:\users\admin\pictures\ReceiveConvertFrom.tiff.3nwm89 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DNXeNcyLON = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe" C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\program files (x86)\3nwm89-readme.txt C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\UnregisterConvert.m3u C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\UseResolve.odp C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ApproveProtect.dotx C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ConfirmExport.tmp C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\UpdateSync.ttf C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ConvertFromMerge.css C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\GrantProtect.xltx C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\MergeUnprotect.mp2 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\WriteUninstall.search-ms C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\BlockMerge.dwg C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\DisableSplit.csv C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\InstallConfirm.css C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ResetUninstall.vssm C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ShowTest.mhtml C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File created \??\c:\program files\3nwm89-readme.txt C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\ConfirmCheckpoint.i64 C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\GroupDebug.WTV C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\HideInitialize.wpl C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\MeasurePing.ADT C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\RedoOut.DVR C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\SelectResume.kix C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\SetBlock.dwfx C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\TestBlock.jpeg C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\CompareComplete.tif C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\StartDisconnect.vstx C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\SyncBlock.xltm C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\UnprotectDeny.aif C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\CompareStep.fon C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\MoveClose.vb C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
File opened for modification \??\c:\program files\OutImport.mp4v C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe

"C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe"

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Files

memory/4508-123-0x000001B17B9E0000-0x000001B17B9E2000-memory.dmp

memory/4508-124-0x000001B17B9E3000-0x000001B17B9E5000-memory.dmp

memory/4508-125-0x000001B17B970000-0x000001B17B992000-memory.dmp

memory/4508-130-0x000001B17DC40000-0x000001B17DCB6000-memory.dmp