Malware Analysis Report

2025-01-18 20:26

Sample ID 220130-jybmpahgg8
Target 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19
SHA256 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19
Tags
37 1140 sodinokibi ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19

Threat Level: Known bad

The file 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19 was found to be: Known bad.

Malicious Activity Summary

37 1140 sodinokibi ransomware

Sodin,Sodinokibi,REvil

Sodinokibi family

Sodinokibi/Revil sample

Modifies extensions of user files

Enumerates connected drives

Sets desktop wallpaper using registry

Drops file in Program Files directory

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-30 08:04

Signatures

Sodinokibi family

sodinokibi

Sodinokibi/Revil sample

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-30 08:04

Reported

2022-01-30 13:32

Platform

win7-en-20211208

Max time kernel

117s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\SuspendSkip.tif => \??\c:\users\admin\pictures\SuspendSkip.tif.895nv3v C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File renamed C:\Users\Admin\Pictures\UnlockSubmit.png => \??\c:\users\admin\pictures\UnlockSubmit.png.895nv3v C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\users\admin\pictures\SubmitLimit.tiff C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File renamed C:\Users\Admin\Pictures\HideConvert.tif => \??\c:\users\admin\pictures\HideConvert.tif.895nv3v C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File renamed C:\Users\Admin\Pictures\InstallRequest.png => \??\c:\users\admin\pictures\InstallRequest.png.895nv3v C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File renamed C:\Users\Admin\Pictures\MountDisable.crw => \??\c:\users\admin\pictures\MountDisable.crw.895nv3v C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File renamed C:\Users\Admin\Pictures\RepairTest.crw => \??\c:\users\admin\pictures\RepairTest.crw.895nv3v C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File renamed C:\Users\Admin\Pictures\SubmitLimit.tiff => \??\c:\users\admin\pictures\SubmitLimit.tiff.895nv3v C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6q2.bmp" C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\RevokeSearch.xps C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\SendStart.wax C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\UnprotectStart.aiff C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\895nv3v-readme.txt C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\FindSuspend.wmf C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\CompressEdit.sql C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\DisconnectGet.wmf C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\EditOpen.mp4v C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\895nv3v-readme.txt C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\ClearTest.wax C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\SubmitBackup.3gp2 C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\SubmitShow.wax C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\WaitInvoke.pcx C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\895nv3v-readme.txt C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\ShowExit.pps C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File created \??\c:\program files (x86)\895nv3v-readme.txt C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\GrantConfirm.WTV C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\InvokeUninstall.zip C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\StartDismount.ini C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File created \??\c:\program files\895nv3v-readme.txt C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe

"C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

N/A

Files

memory/1744-54-0x0000000075761000-0x0000000075763000-memory.dmp

memory/1916-55-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

memory/1916-57-0x0000000002950000-0x0000000002952000-memory.dmp

memory/1916-58-0x0000000002952000-0x0000000002954000-memory.dmp

memory/1916-59-0x0000000002954000-0x0000000002957000-memory.dmp

memory/1916-56-0x000007FEF2CD0000-0x000007FEF382D000-memory.dmp

memory/1916-60-0x000000001B760000-0x000000001BA5F000-memory.dmp

memory/1916-61-0x000000000295B000-0x000000000297A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-30 08:04

Reported

2022-01-30 13:33

Platform

win10-en-20211208

Max time kernel

102s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\ResetOut.tiff => \??\c:\users\admin\pictures\ResetOut.tiff.z005me5 C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File renamed C:\Users\Admin\Pictures\ShowOpen.raw => \??\c:\users\admin\pictures\ShowOpen.raw.z005me5 C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File renamed C:\Users\Admin\Pictures\WriteTest.raw => \??\c:\users\admin\pictures\WriteTest.raw.z005me5 C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\users\admin\pictures\ConvertFromImport.tiff C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\users\admin\pictures\ResetOut.tiff C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File renamed C:\Users\Admin\Pictures\ConvertFromImport.tiff => \??\c:\users\admin\pictures\ConvertFromImport.tiff.z005me5 C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File renamed C:\Users\Admin\Pictures\ExitSelect.raw => \??\c:\users\admin\pictures\ExitSelect.raw.z005me5 C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File renamed C:\Users\Admin\Pictures\RepairRequest.crw => \??\c:\users\admin\pictures\RepairRequest.crw.z005me5 C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xsa3kum7.bmp" C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\ExpandEnter.jpg C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\MergeUnregister.mpv2 C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\OptimizeSave.eprtx C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\ResolvePush.ppt C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\StartResolve.3gp2 C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File created \??\c:\program files (x86)\z005me5-readme.txt C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\GetCompress.doc C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\MountGrant.vbe C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\UseRename.wmf C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\CompleteRequest.3gp2 C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\GetWait.pub C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\SkipRequest.dotm C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\CloseTest.mp3 C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\CompleteUnregister.svg C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\LockConfirm.xlsx C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\SearchSync.mp2v C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\SetReset.png C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\OpenDismount.m4v C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\ProtectFormat.dxf C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\RenameDisable.avi C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\RequestBackup.ttf C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\ResolveSet.contact C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\SplitExpand.pub C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\HideRestart.mpp C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\InitializeAssert.vssm C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File created \??\c:\program files\z005me5-readme.txt C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\FormatSend.vbe C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\LimitMove.jtx C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A
File opened for modification \??\c:\program files\ReadRename.pub C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe

"C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe"

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Files

memory/2500-123-0x000001CBEBAC0000-0x000001CBEBAE2000-memory.dmp

memory/2500-124-0x000001CBEB8A3000-0x000001CBEB8A5000-memory.dmp

memory/2500-122-0x000001CBEB8A0000-0x000001CBEB8A2000-memory.dmp

memory/2500-128-0x000001CBEC5B0000-0x000001CBEC626000-memory.dmp