Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-01-2022 08:00
Static task
static1
Behavioral task
behavioral1
Sample
151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe
Resource
win10-en-20211208
General
-
Target
151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe
-
Size
161KB
-
MD5
39e312e75a9ba302dc0617f958458522
-
SHA1
eab1865868367c11e0d0c5e8732295089bb277d6
-
SHA256
151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6
-
SHA512
275544339fbad34e4ad44b3223f2268adf4c0e46d9bdfd3a64704de5821b58944cc44bf83797090c93c8e484378f7bea199bbb50cb2eab16ad7899952cda56e8
Malware Config
Extracted
C:\7592o7-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7093E7A3584ADB3F
http://decryptor.top/7093E7A3584ADB3F
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ConvertFromPing.crw => \??\c:\users\admin\pictures\ConvertFromPing.crw.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File renamed C:\Users\Admin\Pictures\ConvertFromSet.raw => \??\c:\users\admin\pictures\ConvertFromSet.raw.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File renamed C:\Users\Admin\Pictures\CopyUndo.crw => \??\c:\users\admin\pictures\CopyUndo.crw.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File renamed C:\Users\Admin\Pictures\ReadWatch.raw => \??\c:\users\admin\pictures\ReadWatch.raw.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File renamed C:\Users\Admin\Pictures\SearchMove.png => \??\c:\users\admin\pictures\SearchMove.png.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File renamed C:\Users\Admin\Pictures\UndoNew.tif => \??\c:\users\admin\pictures\UndoNew.tif.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File renamed C:\Users\Admin\Pictures\CheckpointOpen.png => \??\c:\users\admin\pictures\CheckpointOpen.png.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File renamed C:\Users\Admin\Pictures\CompareImport.raw => \??\c:\users\admin\pictures\CompareImport.raw.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File renamed C:\Users\Admin\Pictures\DisableSplit.crw => \??\c:\users\admin\pictures\DisableSplit.crw.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File renamed C:\Users\Admin\Pictures\JoinAdd.raw => \??\c:\users\admin\pictures\JoinAdd.raw.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File renamed C:\Users\Admin\Pictures\RevokeFind.crw => \??\c:\users\admin\pictures\RevokeFind.crw.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File renamed C:\Users\Admin\Pictures\CheckpointResume.crw => \??\c:\users\admin\pictures\CheckpointResume.crw.7592o7 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\Q: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\X: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\Z: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\F: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\K: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\M: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\N: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\D: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\Y: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\E: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\L: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\T: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\W: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\R: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\S: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\U: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\A: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\G: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\H: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\P: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\B: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\I: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\J: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened (read-only) \??\V: 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ot414g7b3.bmp" 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe -
Drops file in Program Files directory 41 IoCs
description ioc Process File created \??\c:\program files (x86)\microsoft sql server compact edition\7592o7-readme.txt 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\BlockRevoke.wma 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\DebugPublish.tiff 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\MeasureJoin.dotx 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\ResumeTest.mp3 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\StepUnprotect.wmf 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\AssertCheckpoint.ogg 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\GroupMount.TTS 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\TracePublish.ps1xml 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\a19a44f4.lock 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\ReceiveProtect.mp2 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\RevokeSkip.snd 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\7592o7-readme.txt 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\ApproveTrace.WTV 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\BlockGrant.dwfx 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\DenyCompress.M2T 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\EditUse.wpl 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\OutCompress.mpg 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\CompareClear.bmp 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\ConvertInstall.mpeg3 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\ExpandUninstall.vssx 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\SendMeasure.search-ms 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\a19a44f4.lock 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\a19a44f4.lock 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File created \??\c:\program files\7592o7-readme.txt 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\ConvertBlock.xml 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\EditInitialize.mov 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\RequestDisable.potx 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\TestWrite.7z 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\7592o7-readme.txt 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File created \??\c:\program files\a19a44f4.lock 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File created \??\c:\program files (x86)\a19a44f4.lock 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\ConnectSend.asp 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\FormatEnable.csv 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\ImportPublish.ogg 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\UpdateDebug.dotx 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File created \??\c:\program files (x86)\7592o7-readme.txt 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\ConfirmSearch.rtf 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\LockSet.cfg 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\RestoreHide.iso 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe File opened for modification \??\c:\program files\SuspendStop.avi 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 580 vssadmin.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee404000000010000001000000091de0625abdafd32170cbb25172a846720000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 848 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 640 vssvc.exe Token: SeRestorePrivilege 640 vssvc.exe Token: SeAuditPrivilege 640 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 848 wrote to memory of 808 848 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe 27 PID 848 wrote to memory of 808 848 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe 27 PID 848 wrote to memory of 808 848 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe 27 PID 848 wrote to memory of 808 848 151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe 27 PID 808 wrote to memory of 580 808 cmd.exe 29 PID 808 wrote to memory of 580 808 cmd.exe 29 PID 808 wrote to memory of 580 808 cmd.exe 29 PID 808 wrote to memory of 580 808 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe"C:\Users\Admin\AppData\Local\Temp\151271bf05310f94cd33cba3eb90be264edc4828c04e4e82f492b8e2576ee7a6.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:580
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:640