Analysis
-
max time kernel
144s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe
Resource
win10-en-20211208
General
-
Target
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe
-
Size
116KB
-
MD5
2894ecbd12a791cbf7404febb43b5f4e
-
SHA1
8ed5327cf869893d6099df145c49aec08c86faa6
-
SHA256
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f
-
SHA512
8b7a9ab31b4ff2f37d772308db28717947624d172b5b23e9979623e3cf03fa109480f83aa9243fa9ecf7d2fb7a7cc4deb5899b5f462d0c911bee3dab3e4b6115
Malware Config
Extracted
C:\ko665-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/59B1DB071E79C2A5
http://decryptor.cc/59B1DB071E79C2A5
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription ioc process File renamed C:\Users\Admin\Pictures\RegisterUninstall.png => \??\c:\users\admin\pictures\RegisterUninstall.png.ko665 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File renamed C:\Users\Admin\Pictures\RenameStep.png => \??\c:\users\admin\pictures\RenameStep.png.ko665 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File renamed C:\Users\Admin\Pictures\RenameRestart.tiff => \??\c:\users\admin\pictures\RenameRestart.tiff.ko665 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File renamed C:\Users\Admin\Pictures\StopInvoke.png => \??\c:\users\admin\pictures\StopInvoke.png.ko665 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\pictures\RenameRestart.tiff a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File renamed C:\Users\Admin\Pictures\CompleteResolve.crw => \??\c:\users\admin\pictures\CompleteResolve.crw.ko665 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File renamed C:\Users\Admin\Pictures\ProtectConfirm.png => \??\c:\users\admin\pictures\ProtectConfirm.png.ko665 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe -
Drops startup file 1 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\ko665-readme.txt a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Z5egGonjst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe" a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe -
Drops desktop.ini file(s) 63 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription ioc process File opened for modification \??\c:\program files (x86)\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\pictures\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\nk9yd4ku\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\libraries\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\k819cmrp\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\qdazq7ur\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows mail\stationery\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\saved games\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\videos\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\history\history.ie5\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\downloads\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\downloads\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\pictures\sample pictures\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\administrative tools\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\favorites\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\ringtones\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\accessibility\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\ro7fjfde\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\documents\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\pictures\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\favorites\links\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\searches\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\recorded tv\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\music\sample music\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\windows powershell\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\t7as43m2\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\links\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\videos\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\videos\sample videos\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\desktop\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\recorded tv\sample media\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\music\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\documents\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\maintenance\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\burn\burn\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\t0stxta8\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\games\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\contacts\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\favorites\links for united states\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\system tools\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\recent\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\sendto\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\fnouqx38\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\s3iv548v\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\windows\sendto\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\libraries\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\music\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\history\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\desktop\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\tablet pc\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription ioc process File opened (read-only) \??\G: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\H: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\N: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\O: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\P: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\S: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\U: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\Z: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\I: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\J: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\L: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\M: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\Q: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\R: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\T: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\B: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\F: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\K: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\X: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\A: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\E: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\V: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\W: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\Y: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe -
Drops file in Program Files directory 30 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription ioc process File opened for modification \??\c:\program files\ExpandExport.jpeg a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\RestartMount.ps1xml a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\StopBackup.htm a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\UnprotectConvertTo.htm a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files (x86)\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\ko665-readme.txt a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceme35.dll a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\FindLock.vdx a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\SwitchUnpublish.edrwx a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\ko665-readme.txt a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\InitializeSubmit.tif a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlcese35.dll a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceca35.dll a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceoledb35.dll a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceqp35.dll a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File created \??\c:\program files (x86)\ko665-readme.txt a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\ExpandResolve.au a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File created \??\c:\program files\ko665-readme.txt a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\ConfirmUnprotect.xltx a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\FindHide.rtf a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\ResumeEnable.html a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\ko665-readme.txt a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\MountBackup.vstx a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\SplitSkip.wav a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\StopOpen.dwfx a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceer35EN.dll a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\SyncWait.jfif a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\WatchRepair.mov a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlcecompact35.dll a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1000 1200 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exepowershell.exeWerFault.exepid process 1692 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe 896 powershell.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exepowershell.exevssvc.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1692 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe Token: SeDebugPrivilege 896 powershell.exe Token: SeBackupPrivilege 1256 vssvc.exe Token: SeRestorePrivilege 1256 vssvc.exe Token: SeAuditPrivilege 1256 vssvc.exe Token: SeTakeOwnershipPrivilege 1692 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe Token: SeDebugPrivilege 1000 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription pid process target process PID 1692 wrote to memory of 896 1692 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe powershell.exe PID 1692 wrote to memory of 896 1692 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe powershell.exe PID 1692 wrote to memory of 896 1692 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe powershell.exe PID 1692 wrote to memory of 896 1692 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe"C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1524
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1256
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1200 -s 30161⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\users\admin\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customDestinations-msMD5
55ff845f3bd13cf4f644bc22370d4674
SHA177983f747d89791cb23256cf2890de0b6b728054
SHA256856ad94421d71a14ffdd793bb76663426812ed8aafa39ca82521bb2b21023068
SHA512f35b9a9bc62e49f79e906879a89c8faf149d3e9b7773b483149620f124efc9a794978590918427e9eb03a5c9e5274f41c280d2dee52335328bdefbd9cc03df19
-
memory/896-55-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmpFilesize
8KB
-
memory/896-57-0x0000000002800000-0x0000000002802000-memory.dmpFilesize
8KB
-
memory/896-58-0x0000000002802000-0x0000000002804000-memory.dmpFilesize
8KB
-
memory/896-59-0x0000000002804000-0x0000000002807000-memory.dmpFilesize
12KB
-
memory/896-56-0x000007FEF2D90000-0x000007FEF38ED000-memory.dmpFilesize
11.4MB
-
memory/896-60-0x000000000280B000-0x000000000282A000-memory.dmpFilesize
124KB
-
memory/1000-64-0x0000000000460000-0x0000000000461000-memory.dmpFilesize
4KB
-
memory/1692-54-0x0000000075B51000-0x0000000075B53000-memory.dmpFilesize
8KB