Malware Analysis Report

2025-01-18 20:26

Sample ID 220130-jym1qahgh5
Target 0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e
SHA256 0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e
Tags
$2a$10$1t/az7ns5hxjskgeu0ujee5f3p0x6zsi0spg11uvr8pnt6izdb9ge 5223 sodinokibi persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e

Threat Level: Known bad

The file 0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e was found to be: Known bad.

Malicious Activity Summary

$2a$10$1t/az7ns5hxjskgeu0ujee5f3p0x6zsi0spg11uvr8pnt6izdb9ge 5223 sodinokibi persistence ransomware spyware stealer

Sodin,Sodinokibi,REvil

Sodinokibi family

Modifies extensions of user files

Reads user/profile data of web browsers

Adds Run key to start application

Enumerates connected drives

Sets desktop wallpaper using registry

Drops file in System32 directory

Drops file in Program Files directory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-30 08:04

Signatures

Sodinokibi family

sodinokibi

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-30 08:04

Reported

2022-01-30 13:33

Platform

win7-en-20211208

Max time kernel

145s

Max time network

182s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\FormatProtect.tif => \??\c:\users\admin\pictures\FormatProtect.tif.agl7i0g C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File renamed C:\Users\Admin\Pictures\FormatSplit.crw => \??\c:\users\admin\pictures\FormatSplit.crw.agl7i0g C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File renamed C:\Users\Admin\Pictures\SwitchConvert.raw => \??\c:\users\admin\pictures\SwitchConvert.raw.agl7i0g C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File renamed C:\Users\Admin\Pictures\UnpublishReset.raw => \??\c:\users\admin\pictures\UnpublishReset.raw.agl7i0g C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1E8NAmhfRO = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe" C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\CatRoot2\dberr.txt C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ur7.bmp" C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\BackupSubmit.html C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\DisconnectRename.jtx C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\ProtectLimit.sql C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\SplitUndo.MTS C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\WaitReceive.pps C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\TraceDisconnect.dib C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\ExitUse.vsdx C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\ExitWait.wm C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\LockCompress.html C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\ResumeDisconnect.ttc C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\EditNew.tif C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\FormatSync.mpv2 C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\MountRepair.wmf C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\RevokeExport.vdw C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\SplitRename.m4v C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\SubmitWatch.mpeg3 C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\UpdateRevoke.png C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\ExportCopy.asf C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\PublishInvoke.edrwx C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\SetSwitch.clr C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\WriteRequest.cfg C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\agl7i0g-readme.txt C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\AssertApprove.pps C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\MoveLimit.php C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\PingConnect.3gpp C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\WaitNew.mpp C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\agl7i0g-readme.txt C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\agl7i0g-readme.txt C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\DismountConnect.dib C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\MergeGroup.3gp C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\UnlockSync.jpeg C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\SendMount.vssx C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe

"C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe"

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 parks-nuernberg.de udp
DE 109.237.138.40:443 parks-nuernberg.de tcp
DE 109.237.138.40:443 parks-nuernberg.de tcp
US 8.8.8.8:53 werkkring.nl udp
BE 83.217.86.218:443 werkkring.nl tcp
US 8.8.8.8:53 memaag.com udp
US 8.8.8.8:53 strategicstatements.com udp
US 15.197.142.173:443 strategicstatements.com tcp

Files

memory/760-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-30 08:04

Reported

2022-01-30 13:33

Platform

win10-en-20211208

Max time kernel

185s

Max time network

200s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\SuspendSend.tiff => \??\c:\users\admin\pictures\SuspendSend.tiff.16xy5z3x C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File renamed C:\Users\Admin\Pictures\UnlockStep.crw => \??\c:\users\admin\pictures\UnlockStep.crw.16xy5z3x C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File renamed C:\Users\Admin\Pictures\CloseOpen.png => \??\c:\users\admin\pictures\CloseOpen.png.16xy5z3x C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File renamed C:\Users\Admin\Pictures\EditDismount.png => \??\c:\users\admin\pictures\EditDismount.png.16xy5z3x C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File renamed C:\Users\Admin\Pictures\RepairResolve.raw => \??\c:\users\admin\pictures\RepairResolve.raw.16xy5z3x C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File renamed C:\Users\Admin\Pictures\RestartGrant.crw => \??\c:\users\admin\pictures\RestartGrant.crw.16xy5z3x C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File renamed C:\Users\Admin\Pictures\SelectCompare.tif => \??\c:\users\admin\pictures\SelectCompare.tif.16xy5z3x C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\users\admin\pictures\SuspendSend.tiff C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1E8NAmhfRO = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe" C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\ExpandUndo.docm C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\ReadOpen.midi C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\RenameBlock.ps1xml C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\SetStart.m4a C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\CheckpointWatch.clr C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\CompareSend.sql C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\OptimizeConvertFrom.M2V C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\RedoGet.pptx C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\ResumeRepair.vsx C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\StepUse.iso C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\TraceCopy.wma C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
File opened for modification \??\c:\program files\UnprotectCopy.eprtx C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe

"C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe"

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
NL 52.109.88.44:443 tcp
GB 23.43.75.27:80 tcp

Files

N/A