Analysis
-
max time kernel
127s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:06
Static task
static1
Behavioral task
behavioral1
Sample
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe
Resource
win10-en-20211208
General
-
Target
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe
-
Size
164KB
-
MD5
5265f0a3ac7923dbd8652b26f6a6a66d
-
SHA1
2965318e838ebde9132f1fd847c4f8be2f6d10b2
-
SHA256
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff
-
SHA512
649daab72ce47949921c3d69abe620d7465470988b141535eafc4237b997881450936ec42b4db14b4caf407df9da03eecfe32516d611952489b3493fadad5917
Malware Config
Extracted
C:\r283xtfl-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D0F9A74BB1CBF3DD
http://decryptor.top/D0F9A74BB1CBF3DD
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\SearchSync.tiff c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File renamed C:\Users\Admin\Pictures\InvokePush.tiff => \??\c:\users\admin\pictures\InvokePush.tiff.r283xtfl c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File renamed C:\Users\Admin\Pictures\OutPublish.raw => \??\c:\users\admin\pictures\OutPublish.raw.r283xtfl c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File renamed C:\Users\Admin\Pictures\SearchSync.tiff => \??\c:\users\admin\pictures\SearchSync.tiff.r283xtfl c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File renamed C:\Users\Admin\Pictures\ConnectClose.tif => \??\c:\users\admin\pictures\ConnectClose.tif.r283xtfl c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\users\admin\pictures\InvokePush.tiff c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File renamed C:\Users\Admin\Pictures\RestoreStop.png => \??\c:\users\admin\pictures\RestoreStop.png.r283xtfl c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File renamed C:\Users\Admin\Pictures\SaveClear.tif => \??\c:\users\admin\pictures\SaveClear.tif.r283xtfl c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File renamed C:\Users\Admin\Pictures\UnblockDeny.png => \??\c:\users\admin\pictures\UnblockDeny.png.r283xtfl c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File renamed C:\Users\Admin\Pictures\SyncClear.crw => \??\c:\users\admin\pictures\SyncClear.crw.r283xtfl c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exedescription ioc process File opened (read-only) \??\O: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\P: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\Q: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\V: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\A: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\B: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\E: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\K: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\W: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\Y: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\M: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\X: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\N: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\R: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\T: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\Z: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\F: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\G: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\J: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\L: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\D: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\H: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\I: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\S: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened (read-only) \??\U: c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe -
Drops file in System32 directory 1 IoCs
Processes:
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kd8554537amme.bmp" c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe -
Drops file in Program Files directory 38 IoCs
Processes:
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exedescription ioc process File opened for modification \??\c:\program files\ReadMount.mpg c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\StartDeny.scf c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ConnectOpen.asp c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\EditClear.xml c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\GetExit.vssx c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\GrantReceive.fon c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ImportSkip.mht c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ProtectEnter.xls c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\r283xtfl-readme.txt c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ApproveOut.xml c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ResetPop.emf c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ResolveBackup.docx c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\SetLimit.jpeg c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\SetUnprotect.mpeg c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File created \??\c:\program files\r283xtfl-readme.txt c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\CheckpointStart.m4v c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ConfirmFormat.ttc c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\RepairBlock.xsl c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\WaitSwitch.rm c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\WriteRestart.xml c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ExpandConnect.aifc c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ExpandTrace.wmf c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\LimitPop.pps c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ResetWait.potm c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\r283xtfl-readme.txt c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File created \??\c:\program files (x86)\r283xtfl-readme.txt c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\PushRestore.wpl c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\RegisterJoin.temp c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\RegisterPing.emf c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\SubmitResolve.emf c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\CloseBlock.tif c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ConvertToUnpublish.ods c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\PublishResume.vsw c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\r283xtfl-readme.txt c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\AssertSplit.crw c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\ConvertOut.wmv c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\CopyConvertFrom.AAC c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe File opened for modification \??\c:\program files\DenyMeasure.wmf c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1960 vssadmin.exe -
Processes:
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877619000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exepid process 1548 c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1280 vssvc.exe Token: SeRestorePrivilege 1280 vssvc.exe Token: SeAuditPrivilege 1280 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.execmd.exedescription pid process target process PID 1548 wrote to memory of 1072 1548 c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe cmd.exe PID 1548 wrote to memory of 1072 1548 c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe cmd.exe PID 1548 wrote to memory of 1072 1548 c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe cmd.exe PID 1548 wrote to memory of 1072 1548 c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe cmd.exe PID 1072 wrote to memory of 1960 1072 cmd.exe vssadmin.exe PID 1072 wrote to memory of 1960 1072 cmd.exe vssadmin.exe PID 1072 wrote to memory of 1960 1072 cmd.exe vssadmin.exe PID 1072 wrote to memory of 1960 1072 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe"C:\Users\Admin\AppData\Local\Temp\c5f71ac7aa3ec91e71febd389a8b7ac5279dca96b1dcd94003c0a5e8f187c7ff.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:1960
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1248
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1280
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1548-54-0x0000000076491000-0x0000000076493000-memory.dmpFilesize
8KB