Malware Analysis Report

2025-01-18 18:45

Sample ID 220124-btjthaheg2
Target a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f
SHA256 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f
Tags
$2a$10$kuzfu0w2pcd7qo5mo0r7j.0hqv1r4ic.mdhndxr2g26ijgfjhnfcc 3678 sodinokibi persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f

Threat Level: Known bad

The file a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f was found to be: Known bad.

Malicious Activity Summary

$2a$10$kuzfu0w2pcd7qo5mo0r7j.0hqv1r4ic.mdhndxr2g26ijgfjhnfcc 3678 sodinokibi persistence ransomware spyware stealer

Sodinokibi family

Sodin,Sodinokibi,REvil

Modifies Installed Components in the registry

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

Adds Run key to start application

Enumerates connected drives

Drops desktop.ini file(s)

Drops file in Windows directory

Drops file in Program Files directory

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-24 01:26

Signatures

Sodinokibi family

sodinokibi

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-24 01:26

Reported

2022-01-24 06:59

Platform

win7-en-20211208

Max time kernel

144s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\RegisterUninstall.png => \??\c:\users\admin\pictures\RegisterUninstall.png.ko665 C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File renamed C:\Users\Admin\Pictures\RenameStep.png => \??\c:\users\admin\pictures\RenameStep.png.ko665 C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File renamed C:\Users\Admin\Pictures\RenameRestart.tiff => \??\c:\users\admin\pictures\RenameRestart.tiff.ko665 C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File renamed C:\Users\Admin\Pictures\StopInvoke.png => \??\c:\users\admin\pictures\StopInvoke.png.ko665 C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\pictures\RenameRestart.tiff C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File renamed C:\Users\Admin\Pictures\CompleteResolve.crw => \??\c:\users\admin\pictures\CompleteResolve.crw.ko665 C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File renamed C:\Users\Admin\Pictures\ProtectConfirm.png => \??\c:\users\admin\pictures\ProtectConfirm.png.ko665 C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\ko665-readme.txt C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Z5egGonjst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe" C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\nk9yd4ku\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\k819cmrp\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\qdazq7ur\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows mail\stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\saved games\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\history\history.ie5\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\pictures\sample pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\administrative tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\ringtones\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\ro7fjfde\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\favorites\links\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\recorded tv\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\music\sample music\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\windows powershell\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\t7as43m2\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\links\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\videos\sample videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\recorded tv\sample media\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\music\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\burn\burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\t0stxta8\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\games\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\favorites\links for united states\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\system tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\sendto\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\fnouqx38\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\s3iv548v\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\default\appdata\roaming\microsoft\windows\sendto\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\music\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\history\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\tablet pc\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\ExpandExport.jpeg C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\RestartMount.ps1xml C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\StopBackup.htm C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\UnprotectConvertTo.htm C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\ko665-readme.txt C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceme35.dll C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\FindLock.vdx C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\SwitchUnpublish.edrwx C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\ko665-readme.txt C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\InitializeSubmit.tif C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlcese35.dll C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceca35.dll C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceoledb35.dll C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceqp35.dll C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File created \??\c:\program files (x86)\ko665-readme.txt C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\ExpandResolve.au C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File created \??\c:\program files\ko665-readme.txt C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\ConfirmUnprotect.xltx C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\FindHide.rtf C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\ResumeEnable.html C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\ko665-readme.txt C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\MountBackup.vstx C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\SplitSkip.wav C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\StopOpen.dwfx C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceer35EN.dll C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\SyncWait.jfif C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\WatchRepair.mov C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlcecompact35.dll C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\system32\WerFault.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WerFault.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe

"C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1200 -s 3016

Network

N/A

Files

memory/1692-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

memory/896-55-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

memory/896-57-0x0000000002800000-0x0000000002802000-memory.dmp

memory/896-58-0x0000000002802000-0x0000000002804000-memory.dmp

memory/896-59-0x0000000002804000-0x0000000002807000-memory.dmp

memory/896-56-0x000007FEF2D90000-0x000007FEF38ED000-memory.dmp

memory/896-60-0x000000000280B000-0x000000000282A000-memory.dmp

memory/1000-64-0x0000000000460000-0x0000000000461000-memory.dmp

\??\c:\users\admin\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customDestinations-ms

MD5 55ff845f3bd13cf4f644bc22370d4674
SHA1 77983f747d89791cb23256cf2890de0b6b728054
SHA256 856ad94421d71a14ffdd793bb76663426812ed8aafa39ca82521bb2b21023068
SHA512 f35b9a9bc62e49f79e906879a89c8faf149d3e9b7773b483149620f124efc9a794978590918427e9eb03a5c9e5274f41c280d2dee52335328bdefbd9cc03df19

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-24 01:26

Reported

2022-01-24 06:59

Platform

win10-en-20211208

Max time kernel

169s

Max time network

168s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies Installed Components in the registry

persistence

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\ApproveConvertFrom.tiff => \??\c:\users\admin\pictures\ApproveConvertFrom.tiff.oeyq480 C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File renamed C:\Users\Admin\Pictures\DenyReset.tif => \??\c:\users\admin\pictures\DenyReset.tif.oeyq480 C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File renamed C:\Users\Admin\Pictures\ConvertGroup.tif => \??\c:\users\admin\pictures\ConvertGroup.tif.oeyq480 C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File renamed C:\Users\Admin\Pictures\WriteMeasure.raw => \??\c:\users\admin\pictures\WriteMeasure.raw.oeyq480 C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\pictures\ApproveConvertFrom.tiff C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Z5egGonjst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe" C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\c:\users\public\accountpictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\favorites\links\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\onedrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\saved games\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\pictures\saved pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\music\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\system tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\music\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\public\documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu places\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\administrative tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\links\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\users\admin\pictures\camera roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\ClearExpand.i64 C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\GroupConvertFrom.xml C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\UnblockRegister.docx C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File created \??\c:\program files (x86)\oeyq480-readme.txt C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\EnablePing.temp C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\HideResize.nfo C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\RepairWrite.jpg C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\MeasureSet.raw C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File created \??\c:\program files\oeyq480-readme.txt C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\ClearFind.dxf C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\InitializeEdit.TTS C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files\UnblockResume.rar C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
File opened for modification \??\c:\program files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\2717123927\1253081315.pri C:\Windows\explorer.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\system32\WerFault.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WerFault.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe

"C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe"

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3040 -s 6924

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
NL 52.109.88.44:443 tcp

Files

memory/1268-122-0x000001DFA9620000-0x000001DFA9642000-memory.dmp

memory/1268-125-0x000001DFC19A0000-0x000001DFC1A16000-memory.dmp

memory/1268-137-0x000001DFA9680000-0x000001DFC1820000-memory.dmp

C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.oeyq480

MD5 7e5ee4e6d6e1a9a317454dcb8366e202
SHA1 63f13e6313d162649077cf5eebc4a3183011724e
SHA256 ca1b136c9b6971c1579bc9876c9b4b144663856d7ecc98bf5affbf6d0cbbf4c2
SHA512 a4dc5b365f5794107ad52f4073c37e6c07653e91d7b40260f9a11864029ef3a98a71858621167677c55766cecc20b32a0c542845e548c2db11039e9152360019

C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.oeyq480

MD5 03e41e561f637351e0a9cdb71e55fcaa
SHA1 c567f108dd787b91c473217cf7ebb42b0b415078
SHA256 2f2acc75e217432d44e4c2ef910b43c9aed1e61db238ffe1c0e038ea67742498
SHA512 f8d27c2f3265338f837492f95adc59e237898277110e493e7bd53d5a10cef510975ef6dca7b75e1d3f5f34899f824f4593067cd25a1b13c16f8f5ebb9f617294