sodinokibi | c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67

General

Target

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
Size

144KB
MD5

e2a18b5d4f05c4708e4763c6d2e1529c
SHA1

28b3f748da6911033ef1d77966c6592eb787e2f3
SHA256

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67
SHA512

4f3b77fbfe8a8356f454bbb167cfc2f29dc9e7419df4259c9bfc70f16654dedd2a252bcdfbe34fe4b5d7415a40ca7ee25aca6898aad0450b23ebf6f1c110468e

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\k7vkxh6-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion k7vkxh6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/22D51EFF4EF38748 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/22D51EFF4EF38748 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: bf9KxOFBeyAHDe0RZaU0vAAXIbelZjUh+3uyzNm+aYHwQ1vHuLh83L+NNlnA33iN Wfj1pP03TXVbvIwkSpJDW17NBcg9ihVOzCxh6Qz9cKQD7iqY5CkddJH8RZI860hf Rn0yQRA0gFPIgey/BwZ174gjsp0ppN65yxg1jEorAAPUHrjmd8F4mBngnZtH0slQ dykHBm++eIQ9tyeaULyTjpNYT1VhOIR+2yafKy52njAm/zyHm5hU7/ps4OKtPKzb YsOe0Q4zC5HedIhkd9+yHTqQqPyZJBJ/AAShhVqPcCC25BolSpkW7lQpkTxVPB7K +DDMmCcupPEr3Z0YqXjNvqeWr8wxJP6ebhncnljQW/QFGzboqnjUvtjRoKfSCE6U BVMk/QgmiIpVgRlmJTYEC37MAexswyIRkI39fFffjB0OrYmBsnHpOjJP4USmFsYz aDHIssii6yHl2kUZWMUFccN+IQIAxz9v8oql5k/9/sgGNW5lvxzgZPNuxj/4x5tA h7FeebeBeM2UCWs3VZsxIi8OZQDEGOhp91B6sC33Htsf12RPXW3f+N3/CHYOsqCU FUMppVlHsAthZ7hJ5K8rOlkxc1ztfpyWUPZHrpWHt+7ei0cQNQlbz+lUE8yZ2H9t Kq2QPHy01i4IezK68gU3erjMJZhs3sgPPJBqRaj2aQoP3a3fikQAeOo1fMDdORzo bdSHYaIp29VJlTHlSXNDvd7VuOh1wGqiKAmC3cBW3C6oeCgp/iFGE5ByjgNtSLYs G6jejXKwMysIUSeXtvzB+OxPMHkGfsYdD315On7lH3hAY1Zkt/cwZf8gjhZPR8gN xwtwiREQhCVzZAlc2ZtAyJeD5hFoMTlmOw7B/z+dk1mJrT/9blLboPEgqVa+FT2h lkT6GBbbNPyZxYuByETSbigrDdr7gx21VkkscA73Ui8bV/u6tQPaz13C9xrbMzH7 TwsfEIDUAvk2eTjXDaTD5uAMGydbitbgqhaKl6fovZ3ulmIa9/hMSpNPsMtRRTbS YGhrMeZqISAWBxIYsTmqXH7nw4czJGQ8+Dt7xZNPzjWi77U6VDu0QTfMVsM0r3B1 i2aw6WuEZGp+ddi29+QqWgbSh+QEFSzCgeiSGHYe//vkH6GSa80LETK3I5fCgVPu MOELdI2LoldPU0jIatgP4hLw5CXU8s1M86qos7xOIG9MPz9ntsyKBPsvOhqY8dIB MDb/LwRGlXR4u8RNHGRGZtAJQnnXrXB36orynQ/wNiKxaeCF0c139gCwq2FvU4qX gcoFmDs5Ytnp9ubnvK8sCDjTidUHHVVQ3EM= Extension name: k7vkxh6 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/22D51EFF4EF38748

http://decryptor.cc/22D51EFF4EF38748

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\UnregisterWait.raw => \??\c:\users\admin\pictures\UnregisterWait.raw.k7vkxh6	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File renamed	C:\Users\Admin\Pictures\UseExport.tif => \??\c:\users\admin\pictures\UseExport.tif.k7vkxh6	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\users\admin\pictures\SearchResume.tiff	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File renamed	C:\Users\Admin\Pictures\CompareApprove.crw => \??\c:\users\admin\pictures\CompareApprove.crw.k7vkxh6	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File renamed	C:\Users\Admin\Pictures\ImportDismount.crw => \??\c:\users\admin\pictures\ImportDismount.crw.k7vkxh6	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File renamed	C:\Users\Admin\Pictures\StopSync.png => \??\c:\users\admin\pictures\StopSync.png.k7vkxh6	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File renamed	C:\Users\Admin\Pictures\SearchResume.tiff => \??\c:\users\admin\pictures\SearchResume.tiff.k7vkxh6	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File renamed	C:\Users\Admin\Pictures\SuspendAdd.png => \??\c:\users\admin\pictures\SuspendAdd.png.k7vkxh6	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\users\admin\pictures\SuspendTrace.tiff	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File renamed	C:\Users\Admin\Pictures\SuspendTrace.tiff => \??\c:\users\admin\pictures\SuspendTrace.tiff.k7vkxh6	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe"	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

description	ioc	process
File opened (read-only)	\??\W:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\E:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\G:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\I:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\K:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\O:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\Q:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\V:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\A:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\H:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\J:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\M:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\D:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\B:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\F:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\P:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\R:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\S:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\T:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\X:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\L:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\N:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\U:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\Y:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened (read-only)	\??\Z:	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

Drops file in System32 directory 1 IoCs

Processes:

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3b310405v26.bmp"	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

Drops file in Program Files directory 29 IoCs

Processes:

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

description	ioc	process
File opened for modification	\??\c:\program files\CompleteSwitch.vssm	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\UnprotectDisconnect.wps	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\ExportRepair.3gp2	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\MeasureStart.inf	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\PopResume.doc	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\SubmitStep.xlsx	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\k7vkxh6-readme.txt	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\EditCheckpoint.aiff	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\SearchResolve.cr2	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\ConvertCompare.xlsb	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\ResetSelect.vsdm	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\RestoreConvertTo.3gp2	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\k7vkxh6-readme.txt	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\DebugRepair.ex_	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\GrantJoin.wmf	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\RequestNew.fon	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\k7vkxh6-readme.txt	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File created	\??\c:\program files (x86)\k7vkxh6-readme.txt	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\ConfirmStart.xps	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\ConnectExpand.m4a	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\RegisterUninstall.M2V	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File created	\??\c:\program files\k7vkxh6-readme.txt	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\AddShow.kix	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\CheckpointGet.M2T	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\ConvertToJoin.wax	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\GrantUnregister.css	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\RestoreUninstall.gif	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\DismountUnblock.asf	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
File opened for modification	\??\c:\program files\OpenRename.001	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exepowershell.exe

pid	process
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1156	powershell.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeBackupPrivilege	1808	vssvc.exe
Token: SeRestorePrivilege	1808	vssvc.exe
Token: SeAuditPrivilege	1808	vssvc.exe
Token: SeTakeOwnershipPrivilege	1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

description	pid	process	target process
PID 1520 wrote to memory of 1156	1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe	powershell.exe
PID 1520 wrote to memory of 1156	1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe	powershell.exe
PID 1520 wrote to memory of 1156	1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe	powershell.exe
PID 1520 wrote to memory of 1156	1520	c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
"C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-55-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/1156-57-0x0000000002830000-0x0000000002832000-memory.dmp

Filesize
8KB

Download
memory/1156-56-0x000007FEF3790000-0x000007FEF42ED000-memory.dmp

Filesize
11.4MB

Download
memory/1156-59-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1156-58-0x0000000002832000-0x0000000002834000-memory.dmp

Filesize
8KB

Download
memory/1156-60-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download
memory/1520-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads