sodinokibi | dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c

General

Target

dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
Size

116KB
MD5

6cd56946aa6245d1eac3a88d4470a40c
SHA1

b4635b3f442e3541a92f026fbb108abeb5d67df7
SHA256

dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c
SHA512

4dffd58030258616b5123246d88abc4f2444aa0cc2809cb3cdcc81e01beaaa1ea784c5e7b969c1982ecd938041e658300c24a67049fe868f4b172a55311dbd8c

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\nnc2g0o-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion nnc2g0o. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C1E842B4BAA81A9B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C1E842B4BAA81A9B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: CQC2SiXrTxYYiZPYpmnLE9uCA4k4ApIjG4AvzCc1mxiQAi6JggCpuOt0aSeMxFym 78WGtMTv/d86zF138KDveF9ji0+p41jtbtpVd34obIUyoOt8M5uJZc/hxW5tBBZ8 HkN5oil3ajtugcLYd1C3/8X5MZmdgyerlfMZUoOHKpPG8PiS0++apqrkSEx6YUFg 0NUvQscqfJTfzODosFhSPm6j+ViQVazi4iq27yVVx50k/fIaczqj8T5d8t9X979g CAcrBfwmi4ioLpITHLeToXsF9zBgTGt+me8KrlmAvJx6e2VQV/k6W/LCFT1ElPzr D/6jtmUI4SY3nCa6q20ODIXyaCftONAE2pSS95NICHG5rT7jbvjfm0jI27qIEx+4 G1k955KHKUZGZbLApJky//10M1/bX1mzDii8gRHnUhCuiEJ+BKpcMYW34Z6ekOQm t2LPy2COll9v6/N9am6VaWIPKVHJtFoXMgq8NctkVZQ0QkxiIDWbRaSda7d8pqsa beYKc/h7NDTCildq91oymXnqZ1NOhJCU7lxcyhGZ1QdAHJDMbs7cFokxb/4Z428X 1ENAlAL4ado1JCb9tvWAJ1Jw4TvfXgHyOeR/ijCznEz7yYbqcBUisEZr7z4xVfBu 6KJ0pw9ACfFlXnaP5oXwIRVNQtHvr13Jo826uQEtqjCp8hTqivmyCB8MNzkHEV6u /LTf58x9r1dL33OYlf9chomQToMTICbJC4OQ5LI7vDpEGZ9y8qJXLvRbGj5ODoT4 MV36n8/RzouM0UcVBkITy3CNkMdqdSZUkdIObkirBsc8+i71+F4KV+SPVFxwBAp+ 4TW8ebecbUukCx0x4f6NjMnSecBK1+DRelxN219B9mfASwJnzF94l7Visgh5EtSQ JoUhLqmxDN1NpuhvH+dDaPluhgNB3e3mCj/FGkDkcCx1VWqMXKtSHL1EovxbAeaA QRaNs2elUYtaNex1HDzf3enPQd/bBWj95vwZ9Frr/Gd4MK/fbAVRZmolYYKslXAI TNZmJDBhN7KRMDCjzGYnlV4uqSRInd5WrwWYYOjApUw/KPDgVnXhLtJK5537jXDY bR93dSqUrO4sg/IzV7ESvXrBE/CWMw8fdFknmaBj4UsOat8ICdTdz62UdP+fZLvu AUl91Kzvxn0cccqYHusE6EeUsqWDDpSBJ6NJNxow7DoFfvOt6PD9tdRHslOmbOw7 nqsq03FXvvDBueWz8fm1294dt7LQ5BHa54mRSOilVGtN2D2vryHBWmn3CeDobO43 2s8X7stX/sS+R4bTOd/gOcT0kpH8GMalYLzHs6kd Extension name: nnc2g0o ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C1E842B4BAA81A9B

http://decryptor.cc/C1E842B4BAA81A9B

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ClearRemove.crw => \??\c:\users\admin\pictures\ClearRemove.crw.nnc2g0o	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File renamed	C:\Users\Admin\Pictures\EditDisconnect.tiff => \??\c:\users\admin\pictures\EditDisconnect.tiff.nnc2g0o	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File renamed	C:\Users\Admin\Pictures\CopySwitch.crw => \??\c:\users\admin\pictures\CopySwitch.crw.nnc2g0o	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File renamed	C:\Users\Admin\Pictures\ResolveDeny.png => \??\c:\users\admin\pictures\ResolveDeny.png.nnc2g0o	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\pictures\EditDisconnect.tiff	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File renamed	C:\Users\Admin\Pictures\FindUnpublish.raw => \??\c:\users\admin\pictures\FindUnpublish.raw.nnc2g0o	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File renamed	C:\Users\Admin\Pictures\ExportTrace.raw => \??\c:\users\admin\pictures\ExportTrace.raw.nnc2g0o	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File renamed	C:\Users\Admin\Pictures\LimitJoin.crw => \??\c:\users\admin\pictures\LimitJoin.crw.nnc2g0o	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File renamed	C:\Users\Admin\Pictures\OptimizeBlock.png => \??\c:\users\admin\pictures\OptimizeBlock.png.nnc2g0o	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\i1neMACrFU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe"	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

Drops desktop.ini file(s) 26 IoCs

Processes:

dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\music\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\saved games\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\public\pictures\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\favorites\links\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files (x86)\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\desktop\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\downloads\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\favorites\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\pictures\saved pictures\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\public\music\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\pictures\camera roll\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\public\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\3d objects\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\searches\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\contacts\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\links\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\public\accountpictures\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\public\desktop\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\public\downloads\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\public\libraries\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\public\videos\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\documents\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\pictures\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\admin\videos\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\users\public\documents\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

description	ioc	process
File opened (read-only)	\??\E:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\G:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\H:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\J:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\L:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\V:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\W:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\B:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\N:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\T:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\U:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\K:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\F:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\I:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\O:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\Q:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\R:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\X:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\Z:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\A:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\P:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\S:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\Y:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\D:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened (read-only)	\??\M:	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53se9t3a62d1.bmp"	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

Drops file in Program Files directory 25 IoCs

Processes:

dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

description	ioc	process
File opened for modification	\??\c:\program files\RemoveGrant.jfif	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\ResizePop.html	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files (x86)\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\ApproveReset.potm	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\DenySet.avi	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\HideConfirm.xps	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\NewUnlock.vsx	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\ReceiveResize.mpeg	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\CompleteGrant.clr	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\ConvertComplete.7z	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\FindExit.gif	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\RestartRedo.ttf	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File created	\??\c:\program files\nnc2g0o-readme.txt	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\PublishInitialize.3gpp	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\RedoMeasure.7z	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\StartDismount.vssx	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\GroupConfirm.au3	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\InstallDisconnect.snd	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\InvokeSwitch.rtf	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File created	\??\c:\program files (x86)\nnc2g0o-readme.txt	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\DebugUpdate.odt	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\desktop.ini	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\DisableInstall.mov	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\FindEnable.search-ms	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
File opened for modification	\??\c:\program files\JoinConnect.css	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53\Blob = 030000000100000014000000151682f5218c0a511c28f4060a73b9ca78ce9a531400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba972379504000000010000001000000029f1c1b26d92e893b6e6852ab708cce10f00000001000000200000005aef843ffcf2ec7055f504a162f229f8391c370ff3a6163d2db3f3d604d622be19000000010000001000000070d4f0bec2078234214bd651643b02405c0000000100000004000000800100001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000640400003082046030820248a0030201020210079e492886376fd40848c23fc631e463300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa381e53081e2300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b050003820201001b7f252b907a0876007718e1c32e8a364c417ebf174be330d75b0c7e9c96986f7bb068c02444cce2f2fcd1eadbd29f01f9174d0c9d55fda5ad6dd22f3f4b72c02eae73c7251657c23e15ade031d10a84846c6278423122461aed7a40bf9716814477ca6c7b5d215c07f2119121bfe12fc2ef6efd0520e4b4f779f32dbb372af0c6b1acac51f51fb35a1e66ce580718387f71a93c83bad7bc829e9a760f9eb029fdcbf38907481bfeab932e14210d5faf8eb754ab5d0ed45b4c71d092ea3da3369b7c1fe03b55b9d85353cc8366bb4adc810600188bf4b3d748b11341b9c4b69ecf2c778e42200b807e9fc5ab48dbbc6f048d6c4629020d708a1df11273b64624429e2a1718e3acc798c272cc6d2d766ddd2c2b2696a5cf21081be5da2fcbef9f7393aef8365f478f9728ceabe29826988bfdee28322229ed4c9509c420fa07e1862c44f68147c0e46232ed1dd83c488896c35e91b6af7b59a4eee3869cc78858ca282a66559b8580b91dd8402bc91c133ca9ebde99c21640f6f5a4ae2a256c52bac7044cb432bbfc385ca00c617b57ec774e50cfaf06a20f378ce10ed2d32f1abd9c713ecce1f8d1a8a3bd04f619c0f986aff50e1aaa956befca47714b631c4d96db55230a9d0f8175a0e640f56446036ecefa6a7d06eca4340674da53d8b9b8c6237da9f82a2da482a62e2d11cae6cd31587985e6721ca79fd34cd066d0a7bb	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

pid	process
3972	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
3972	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
3972	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
3972	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3972	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
Token: SeTakeOwnershipPrivilege	3972	dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
Token: SeBackupPrivilege	1628	vssvc.exe
Token: SeRestorePrivilege	1628	vssvc.exe
Token: SeAuditPrivilege	1628	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
"C:\Users\Admin\AppData\Local\Temp\dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972