Analysis
- max time kernel
141s - max time network
174s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
24/01/2022, 01:25
Static task
static1
Behavioral task
behavioral1
Sample
a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe
- Size 166KB
- Sample220124-bs36rahef3
- SHA256 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f
- MD5 8519e6b492bc77e39516032e83809622
- SHA1 53401b0da0bf5b345d615e767922be3a039c6dee
- SHA512 2f67019052dcbf8d41cc4b3233b4f4f720e5e9b48747161e312c84042855bb79d1258c065f7449735de57e300817ce3a242ccdb3016ea6e9d35cf2013addf88f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\rl13t7-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension rl13t7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8F053FC30D4B44A0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8F053FC30D4B44A0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Xs6V4ND+GzdT6NmqgUF40p94PDgh3fwVtcvYgRDp1jO0wX1825l6O5u69DTejP4c 2A7QbXpj1ydAz1INrApAwNVHv00BI14TTFyNcBtnY/iwXf3PoTxvpc1LJ2OTShBD WHpl/10nO+nxrJXxVBSvBBPcu7KF/BRVooqB9+LiFQfr7vA8x1x9t3h7VOfQ/jyR 3RtksDvi7lb0sc2tEeKqIwYHXVyBAH8PZmbiLvdt+iKhmQPIJ6tIOTLPckM/0ju2 UyA1ONKpFwtIeN3itOIdxzDyDZDCkWFYESG/cod8ezzPNufFmAe5pIVI3mx3zfut ebinm974NTlLsueGtFhZidA4Zp+tJPROOYNGUBaPaHYK2veMVEXH1g0iym1xH2e/ nTajoY/X36Ob7gkmamlHzuuClx1mfqEm5V6YD4ct1TwDGhwMDQ2EdqUlNOPldCe0 gNcRspRogPKnjwqWMiG7TZcKxTxVUZcNNWXmUgH1PXCSlH6pwTN6Fy/A+pMRIEWO KpFXCJWz/RUX0YqX/ahPUwlyhjq9BQs/jBfn5m6RPI5Nxy82/eiigKkt5SL5RJm0 eQroYhStfzQITLtbV/qYg3y5rsVcFTostjDiEHqmCRiSNRGjUv4AhKBA9K19n8RR Y9Dh35gN8f8HgC4lONbibDupmWJvnhazrbyr9oIGiwFBRPzWVCO0ds3bNOgNcM7D zmUkqWiyQs9XfkpO3rCFAais0WtRqtsuwVZCVnDJ497o816y6Do0ewyebGA46xNq SDtMYhMXqTWdaWf1klL16ZhCyFCznIoEgEIZGaeFCOWpbldxkGwGaEuNCKTN02xr FGWYQXgRb8cvXsNggrAth2MhXlPRdT7zdecewZdXBmkarANHMHtcvINEAEvC3bR5 j1gEoiZj3yTC5pWOqiC8ZiDw9EgkrpcwRn+Py5v87NS4ERAP9DspKnU7s0XOssCX vv3hk+DWy2QQGAbTE7T8RqiJw8PgB4Cx0MmmHYZEnnTEhNiI2NsnYvTUJEglMdtf An49ho+vw0zJ92ZgF0wNtMogWrqV44mAOdGR4Ec1PHlnPLti2dID9h1zo0Nid5JW 2zyhV0EU64J75GUooiTY1AL23GQfG6OvhdRb21JNeDt2Xn5xGzlqRnDawZ2vQep9 dkgBIDCzOzFd+DpyCr94pInRvs2Q/1lbZwrIfIqOtSkzLcF22MwnbR7APS1mLDIU DAHo7PAjvovWSHeSlTWCnNztkRANgMXOR7UoTwhIdb0/7kIPlPy/9bl4ORMdp09G Q3EdJ65EPK7umT0HjBOHJvtyETDMq6EI Extension name: rl13t7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8F053FC30D4B44A0
-
http://decryptor.cc/8F053FC30D4B44A0
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ExpandGet.png => \??\c:\users\admin\pictures\ExpandGet.png.rl13t7 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File renamed C:\Users\Admin\Pictures\MountGrant.raw => \??\c:\users\admin\pictures\MountGrant.raw.rl13t7 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File renamed C:\Users\Admin\Pictures\PushUnregister.raw => \??\c:\users\admin\pictures\PushUnregister.raw.rl13t7 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File renamed C:\Users\Admin\Pictures\StopSet.tiff => \??\c:\users\admin\pictures\StopSet.tiff.rl13t7 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File renamed C:\Users\Admin\Pictures\UpdateGet.tiff => \??\c:\users\admin\pictures\UpdateGet.tiff.rl13t7 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\users\admin\pictures\ShowGrant.tiff a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\users\admin\pictures\StopSet.tiff a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\users\admin\pictures\UpdateGet.tiff a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File renamed C:\Users\Admin\Pictures\ShowGrant.tiff => \??\c:\users\admin\pictures\ShowGrant.tiff.rl13t7 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File renamed C:\Users\Admin\Pictures\UnblockExit.tif => \??\c:\users\admin\pictures\UnblockExit.tif.rl13t7 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\Z: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\D: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\E: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\N: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\Q: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\R: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\U: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\Y: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\G: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\H: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\L: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\M: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\T: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\O: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\S: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\V: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\A: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\B: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\F: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\J: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\K: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\I: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\P: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened (read-only) \??\W: a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e4ts4p0ow6.bmp" a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe - Drops file in Program Files directory 38 IoCs
description ioc Process File created \??\c:\program files\rl13t7-readme.txt a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\InstallShow.htm a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\NewBlock.xml a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\PingPush.svgz a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\ConvertToNew.TS a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\ConvertToSync.pptm a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\RedoSplit.TTS a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\ResetUninstall.ttc a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\UnlockBlock.easmx a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\rl13t7-readme.txt a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\FormatExpand.xps a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\GroupResume.js a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\MountNew.mpg a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\RemoveInitialize.ppt a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\RequestPublish.gif a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\PopOut.vssm a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\ResetRevoke.asf a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\rl13t7-readme.txt a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\ClosePush.M2TS a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\ResetDebug.ex_ a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\StartDisconnect.7z a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\CompleteCheckpoint.pptm a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\CopyConfirm.mov a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\EditSwitch.ttf a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\GetEnable.mpp a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\InvokeUpdate.dotx a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\StepRestore.odt a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\SubmitTest.mpg a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\UnlockClear.wps a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File created \??\c:\program files (x86)\rl13t7-readme.txt a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\AddInitialize.mpeg3 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\CheckpointSubmit.docx a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\ConvertEdit.jfif a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\DisconnectRemove.xsl a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\UnprotectExit.reg a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\rl13t7-readme.txt a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\ResolveRequest.ods a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe File opened for modification \??\c:\program files\RevokeDebug.rtf a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1688 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe 268 powershell.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1688 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe Token: SeDebugPrivilege 268 powershell.exe Token: SeBackupPrivilege 1036 vssvc.exe Token: SeRestorePrivilege 1036 vssvc.exe Token: SeAuditPrivilege 1036 vssvc.exe Token: SeTakeOwnershipPrivilege 1688 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1688 wrote to memory of 268 1688 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe 27 PID 1688 wrote to memory of 268 1688 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe 27 PID 1688 wrote to memory of 268 1688 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe 27 PID 1688 wrote to memory of 268 1688 a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe"C:\Users\Admin\AppData\Local\Temp\a3e691b6417a17b9a954e2006414d374a412360df42a152bc8a256ebc49b236f.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:268
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1380
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1036