Malware Analysis Report

2025-01-18 18:42

Sample ID 220130-jvxqrahbbr
Target 1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281
SHA256 1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281
Tags
$2a$10$h6z1eupzvzhcrxqsbyy1b./t7.sfyvvzz00yq7hchhkbq2okvjcsm 4447 sodinokibi ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281

Threat Level: Known bad

The file 1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281 was found to be: Known bad.

Malicious Activity Summary

$2a$10$h6z1eupzvzhcrxqsbyy1b./t7.sfyvvzz00yq7hchhkbq2okvjcsm 4447 sodinokibi ransomware

Sodinokibi family

Modifies extensions of user files

Enumerates connected drives

Drops file in System32 directory

Sets desktop wallpaper using registry

Drops file in Program Files directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-30 07:59

Signatures

Sodinokibi family

sodinokibi

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-30 07:59

Reported

2022-01-30 08:02

Platform

win7-en-20211208

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe"

Signatures

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\UninstallExit.tiff => \??\c:\users\admin\pictures\UninstallExit.tiff.fmf5s773 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\users\admin\pictures\ExpandExport.tiff C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\users\admin\pictures\UninstallExit.tiff C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File renamed C:\Users\Admin\Pictures\ExpandExport.tiff => \??\c:\users\admin\pictures\ExpandExport.tiff.fmf5s773 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File renamed C:\Users\Admin\Pictures\ShowConvertFrom.crw => \??\c:\users\admin\pictures\ShowConvertFrom.crw.fmf5s773 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File renamed C:\Users\Admin\Pictures\SendUndo.raw => \??\c:\users\admin\pictures\SendUndo.raw.fmf5s773 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File renamed C:\Users\Admin\Pictures\TestConfirm.raw => \??\c:\users\admin\pictures\TestConfirm.raw.fmf5s773 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynevslfautuy.bmp" C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\ConnectUninstall.doc C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\RegisterPublish.ppsm C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\StepOut.easmx C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\SyncPing.doc C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File created \??\c:\program files (x86)\fmf5s773-readme.txt C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\ConfirmBackup.crw C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\GrantUnblock.mp4 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\UndoDeny.AAC C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\fmf5s773-readme.txt C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\RegisterLimit.potx C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\RenameAssert.emf C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\ReadInvoke.tiff C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\RestoreSelect.mhtml C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\UndoExport.iso C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\UnlockPop.xsl C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\fmf5s773-readme.txt C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\ApproveRevoke.html C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\PublishRevoke.3gpp C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\SplitRestart.tif C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\GetConvert.snd C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\InitializeGroup.avi C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\RevokeUse.jfif C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\SyncRevoke.wmf C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\UnlockConvert.m4v C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\fmf5s773-readme.txt C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File created \??\c:\program files\fmf5s773-readme.txt C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\PopAssert.xht C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\InstallRemove.xlt C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\OpenRename.jpg C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\DismountSave.bmp C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\FindReset.dxf C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\ImportFormat.avi C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\MoveInvoke.mp3 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\MoveLock.mp4 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\StepTrace.vb C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\CloseRepair.jpg C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\CloseWrite.svg C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\UnlockMove.snd C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\UseReceive.ods C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe

"C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

N/A

Files

memory/1604-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

memory/952-56-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

memory/952-58-0x0000000002940000-0x0000000002942000-memory.dmp

memory/952-59-0x0000000002942000-0x0000000002944000-memory.dmp

memory/952-60-0x0000000002944000-0x0000000002947000-memory.dmp

memory/952-57-0x000007FEF2CE0000-0x000007FEF383D000-memory.dmp

memory/952-61-0x000000000294B000-0x000000000296A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-30 07:59

Reported

2022-01-30 08:03

Platform

win10-en-20211208

Max time kernel

154s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe"

Signatures

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\UnprotectLock.raw => \??\c:\users\admin\pictures\UnprotectLock.raw.3cqd8 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File renamed C:\Users\Admin\Pictures\UnblockConvertFrom.tif => \??\c:\users\admin\pictures\UnblockConvertFrom.tif.3cqd8 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\users\admin\pictures\DenyStep.tiff C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File renamed C:\Users\Admin\Pictures\AddDisconnect.png => \??\c:\users\admin\pictures\AddDisconnect.png.3cqd8 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File renamed C:\Users\Admin\Pictures\DenyStep.tiff => \??\c:\users\admin\pictures\DenyStep.tiff.3cqd8 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File renamed C:\Users\Admin\Pictures\DisconnectProtect.tif => \??\c:\users\admin\pictures\DisconnectProtect.tif.3cqd8 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File renamed C:\Users\Admin\Pictures\FindSplit.crw => \??\c:\users\admin\pictures\FindSplit.crw.3cqd8 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\CatRoot2\dberr.txt C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\283s.bmp" C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\GroupUndo.tiff C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\JoinDeny.css C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\NewDisconnect.ini C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\SelectRestore.asx C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\UnlockUpdate.dxf C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\DisableTrace.mpg C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\ConvertFromConnect.easmx C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\DenyUnblock.crw C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\RestartOpen.wax C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\SelectConfirm.shtml C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\ApproveMeasure.gif C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\WatchOut.mp4 C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\SplitCompare.xml C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\DebugCompress.WTV C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\ExitImport.jpeg C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\PopNew.tif C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\SuspendConvert.ADTS C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\BackupUnregister.kix C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\OutAssert.asp C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\SyncExpand.mp2v C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\WriteSkip.emf C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File created \??\c:\program files\3cqd8-readme.txt C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\MoveLimit.ppsm C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\AssertUpdate.xlsm C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\CheckpointCompare.dotm C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\GetConvert.ttc C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\HideProtect.raw C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\SetCompress.mp2v C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\UnpublishUnlock.rle C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File created \??\c:\program files (x86)\3cqd8-readme.txt C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\RenameUpdate.png C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
File opened for modification \??\c:\program files\EditSave.xla C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe

"C:\Users\Admin\AppData\Local\Temp\1638d7ce9e804cd3e017fe2d8effa0d0d48aa74baa93c8c50f1927bc25fcd281.exe"

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Files

memory/3176-120-0x000001E871850000-0x000001E871872000-memory.dmp

memory/3176-121-0x000001E871900000-0x000001E871902000-memory.dmp

memory/3176-122-0x000001E871903000-0x000001E871905000-memory.dmp

memory/3176-127-0x000001E873C30000-0x000001E873CA6000-memory.dmp

memory/3176-138-0x000001E871906000-0x000001E871908000-memory.dmp