Analysis
- max time kernel
167s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
15/04/2022, 09:39
Static task
static1
Behavioral task
behavioral1
Sample
686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe
Resource
win10v2004-20220414-en
General
- Target 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe
- Size 146KB
- Sample220415-lms4psahd4
- SHA256 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7
- MD5 00361d8aa092628e2339239537bdbe2c
- SHA1 aaf3890dce9eb8c75c09cfc60eb5f796b408d026
- SHA512 64db40b3fa7d1552166ef665d0d5f6f2a13f0c8c50ef8cd7fa6ce7656b049f8e077a2ec54b02b36c2331e3b8768a1a7b05cc7f51ce5f19aaa4ae3edd80f64dfb
- MD5 SHA1 SHA512
Malware Config
Extracted
-
C:\8611oyc8m-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8611oyc8m. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EB293A08D0353D6F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/EB293A08D0353D6F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: U5hhSiqzCsqgLgD8T2hzlUPs3/Wld9uS1b9hrBkwyXxG0wj172q+52Fy5LlXuY8t RgorY+eei0gnnb8ZYvzQ5F5hw5Rhfe87HvmVDbhye7SSZMlw29DxQV153hOwqVdh t7m9hCFIHoxbM2pBZqtMGBkMy3Vu4n1AW0nKD0W9rYtWQKyD82UpIgMdUh2XWfzo +kiQL1X8VrqZBaHF2ai+YIulLiHOyiUcAUiQC69HEpO4vrY4E87vmh9C1IXdUexw L/T5UCfpLOja/LWb8ENGzqtskt9sat35Pfszx+Qlh+Wvy/dyfjLFWsvrQnVEIs6x erEF7dCQIgjB0Ndh1hjM4jLoZq72F4PiKNMp8giM8nJwm0f8zVmt4sXSofQbY91H yPFh97fXUR9tqyy1QiGggCtX8GqFKi+z/4TJTKheNX9zTeewUvAS7Dn6/Z/E+zx3 l4QIBHeuAFNa+Q8uMpe5Umr7f5ty2HPVUNttAr4AGyAbhf/EU+L8Lqg3J2ynb3e2 +zZD0Gup1Dz2fkNSPudcRjLni1x0SyXRWWDMm+sUP1bH5dlC1vB0zxoVvCQ92UGx BrO34rmiwrI13DK1sWGwNU9qNBMPU9mX5DslzmeByWWjPf36DdNPRKtkWqnoiiPl 7qhdPDSKlaDaj2M/Z+vX+cAQUOwoBFX2Z4ngFFLwm6r+QyJ7XEydyHqkFGK6oYLm hig7pHK9lQ5KgoxP8m7j0wLr1XNnUqI4VFXK09zvwOkMJQJaYh4lgdRVt79JUhap NvTyanymd5ON8YHt5K+S2B/W4f08pnM3kgyICDDqGxMHQ5H0VY9w+Nfda8rVy1V9 hOMlMxKI44TVR3O0XkPHO2Lj/SxFLOcjS6C2wQh1JEjBiY571w47RMZ9NBBiw/PB mhMVSqPGX6uTtK8xSPNgozSAGe5SLM9LuHuWtfPgaVa8zXBND3Y/3CjsOMfMdago mAbvjw6u+X6RQRyxhMM/2fVyYtUZOmi7d84vX8TB+7gWYRx6UIlM+Rub+5qJt8uA QGyW62d5PYeOG7sjWc32o3HqkOAP/MirAlQ/ehsOKYafjCg+Q9j6bcfWnFyIH6nW d8D8O/d+NBlBV8ZFCQRfxJM3PYWXg4PDDwhWOjOYZH5iQZ4k779QuQOpR/oAxSPy Jt8uOba2B4AXQXJstbksjml66FYtcaPOwVPkFoE9f8J0pzZ5OdJVpmWB3ThhPv93 batwR3SEzzBFvIIS8wtP4kVzgsX1H6gKBpmpEdceEZS/LRq2Wvzo8UGtG0+InWbZ VBIEaTbM7uaDWuBq4C4MbNSjXRgqtyYVJxpQG6ItQ/KFpTtN ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EB293A08D0353D6F
-
http://decryptor.cc/EB293A08D0353D6F
Extracted
-
sodinokibi
-
$2a$10$Wlb.6omIqlVeirP4q3KysOlMVQGNS7LVUvZJsVFcPGaAiZ15vw/4.
-
5856
-
1team.es
-
theclubms.com
-
kaotikkustomz.com
-
havecamerawilltravel2017.wordpress.com
-
rerekatu.com
-
triactis.com
-
mbxvii.com
-
aselbermachen.com
-
solhaug.tk
-
ikads.org
-
lebellevue.fr
-
blewback.com
-
joyeriaorindia.com
-
bastutunnan.se
-
xoabigail.com
-
lescomtesdemean.be
-
conexa4papers.trade
-
basisschooldezonnewijzer.nl
-
destinationclients.fr
-
connectedace.com
-
resortmtn.com
-
syndikat-asphaltfieber.de
-
fizzl.ru
-
heurigen-bauer.at
-
aunexis.ch
-
first-2-aid-u.com
-
newstap.com.ng
-
qualitaetstag.de
-
refluxreducer.com
-
jobmap.at
-
portoesdofarrobo.com
-
cnoia.org
-
verifort-capital.de
-
coffreo.biz
-
globedivers.wordpress.com
-
kunze-immobilien.de
-
igorbarbosa.com
-
merzi.info
-
answerstest.ru
-
baustb.de
-
kampotpepper.gives
-
love30-chanko.com
-
starsarecircular.org
-
highlinesouthasc.com
-
analiticapublica.es
-
mrsfieldskc.com
-
assurancesalextrespaille.fr
-
liveottelut.com
-
copystar.co.uk
-
wsoil.com.sg
-
vermoote.de
-
sw1m.ru
-
beyondmarcomdotcom.wordpress.com
-
pt-arnold.de
-
extensionmaison.info
-
bhwlawfirm.com
-
groupe-frayssinet.fr
-
cuppacap.com
-
jakekozmor.com
-
craigmccabe.fun
-
evangelische-pfarrgemeinde-tuniberg.de
-
naswrrg.org
-
zimmerei-deboer.de
-
adoptioperheet.fi
-
behavioralmedicinespecialists.com
-
harveybp.com
-
polzine.net
-
kojima-shihou.com
-
samnewbyjax.com
-
accountancywijchen.nl
-
tecnojobsnet.com
-
coding-marking.com
-
biortaggivaldelsa.com
-
fatfreezingmachines.com
-
cirugiauretra.es
-
bargningavesta.se
-
hmsdanmark.dk
-
craftleathermnl.com
-
lillegrandpalais.com
-
webcodingstudio.com
-
securityfmm.com
-
geoffreymeuli.com
-
platformier.com
-
expandet.dk
-
supportsumba.nl
-
maratonaclubedeportugal.com
-
edrcreditservices.nl
-
rocketccw.com
-
botanicinnovations.com
-
onlyresultsmarketing.com
-
videomarketing.pro
-
dezatec.es
-
dubscollective.com
-
socstrp.org
-
people-biz.com
-
sagadc.com
-
abogados-en-alicante.es
-
dsl-ip.de
-
dareckleyministries.com
-
marketingsulweb.com
-
tinkoff-mobayl.ru
-
creamery201.com
-
jacquin-maquettes.com
-
mercantedifiori.com
-
foryourhealth.live
-
theletter.company
-
pelorus.group
-
homecomingstudio.com
-
maasreusel.nl
-
ontrailsandboulevards.com
-
vibethink.net
-
argenblogs.com.ar
-
projetlyonturin.fr
-
cuspdental.com
-
binder-buerotechnik.at
-
perbudget.com
-
tennisclubetten.nl
-
roygolden.com
-
teczowadolina.bytom.pl
-
sobreholanda.com
-
haremnick.com
-
birnam-wood.com
-
advokathuset.dk
-
deoudedorpskernnoordwijk.nl
-
noskierrenteria.com
-
mariposapropaneaz.com
-
naturavetal.hr
-
piajeppesen.dk
-
strandcampingdoonbeg.com
-
grupocarvalhoerodrigues.com.br
-
greenko.pl
-
modamilyon.com
-
tux-espacios.com
-
alfa-stroy72.com
-
tsklogistik.eu
-
abogadoengijon.es
-
actecfoundation.org
-
gymnasedumanagement.com
-
manijaipur.com
-
marathonerpaolo.com
-
zewatchers.com
-
kingfamily.construction
-
nataschawessels.com
-
paulisdogshop.de
-
happyeasterimages.org
-
parkcf.nl
-
gastsicht.de
-
oceanastudios.com
-
321play.com.hk
-
teknoz.net
-
sportsmassoren.com
-
wolf-glas-und-kunst.de
-
mylolis.com
-
miraclediet.fun
-
real-estate-experts.com
-
blossombeyond50.com
-
adultgamezone.com
-
oldschoolfun.net
-
trackyourconstruction.com
-
lachofikschiet.nl
-
bodyfulls.com
-
freie-gewerkschaften.de
-
myteamgenius.com
-
finde-deine-marke.de
-
onlybacklink.com
-
ausair.com.au
-
lloydconstruction.com
-
caribdoctor.org
-
ecopro-kanto.com
-
songunceliptv.com
-
waynela.com
-
bordercollie-nim.nl
-
wasmachtmeinfonds.at
-
deepsouthclothingcompany.com
-
fayrecreations.com
-
henricekupper.com
-
podsosnami.ru
-
y-archive.com
-
craigvalentineacademy.com
-
pasivect.co.uk
-
slimidealherbal.com
-
falcou.fr
-
kojinsaisei.info
-
xn--rumung-bua.online
-
pubweb.carnet.hr
-
symphonyenvironmental.com
-
bigbaguettes.eu
-
upmrkt.co
-
slashdb.com
-
mousepad-direkt.de
-
ruralarcoiris.com
-
retroearthstudio.com
-
coding-machine.com
-
rebeccarisher.com
-
sofavietxinh.com
-
darrenkeslerministries.com
-
mardenherefordshire-pc.gov.uk
-
yassir.pro
-
presseclub-magdeburg.de
-
saarland-thermen-resort.com
-
ceid.info.tr
-
kenhnoithatgo.com
-
architekturbuero-wagner.net
-
dinslips.se
-
corelifenutrition.com
-
kevinjodea.com
-
saka.gr
-
qlog.de
-
twohourswithlena.wordpress.com
-
autofolierung-lu.de
-
villa-marrakesch.de
-
employeesurveys.com
-
live-con-arte.de
-
servicegsm.net
-
klimt2012.info
-
marietteaernoudts.nl
-
dr-tremel-rednitzhembach.de
-
artotelamsterdam.com
-
eraorastudio.com
-
vitavia.lt
-
bafuncs.org
-
i-trust.dk
-
despedidascostablanca.es
-
flexicloud.hk
-
siluet-decor.ru
-
hotelsolbh.com.br
-
hairstylesnow.site
-
ilso.net
-
tonelektro.nl
-
asiluxury.com
-
troegs.com
-
shhealthlaw.com
-
devok.info
-
jameskibbie.com
-
leather-factory.co.jp
-
fairfriends18.de
-
8449nohate.org
-
cafemattmeera.com
-
waermetauscher-berechnen.de
-
filmvideoweb.com
-
bodyforwife.com
-
body-armour.online
-
truenyc.co
-
bierensgebakkramen.nl
-
vesinhnha.com.vn
-
leda-ukraine.com.ua
-
tetinfo.in
-
paradicepacks.com
-
vetapharma.fr
-
urmasiimariiuniri.ro
-
drinkseed.com
-
ftf.or.at
-
d2marketing.co.uk
-
wari.com.pe
-
christ-michael.net
-
tuuliautio.fi
-
clos-galant.com
-
ora-it.de
-
micahkoleoso.de
-
hokagestore.com
-
ligiercenter-sachsen.de
-
allentownpapershow.com
-
sla-paris.com
-
kirkepartner.dk
-
vickiegrayimages.com
-
victoriousfestival.co.uk
-
upplandsspar.se
-
modestmanagement.com
-
launchhubl.com
-
katketytaanet.fi
-
tandartspraktijkhartjegroningen.nl
-
romeguidedvisit.com
-
urist-bogatyr.ru
-
nancy-informatique.fr
-
katiekerr.co.uk
-
mezhdu-delom.ru
-
centuryrs.com
-
yourobgyn.net
-
hugoversichert.de
-
muamuadolls.com
-
meusharklinithome.wordpress.com
-
101gowrie.com
-
sporthamper.com
-
work2live.de
-
executiveairllc.com
-
abogadosaccidentetraficosevilla.es
-
effortlesspromo.com
-
polymedia.dk
-
aco-media.nl
-
vloeren-nu.nl
-
ditog.fr
-
classycurtainsltd.co.uk
-
smejump.co.th
-
besttechie.com
-
glennroberts.co.nz
-
c2e-poitiers.com
-
stemenstilte.nl
-
psc.de
-
vihannesporssi.fi
-
olejack.ru
-
helenekowalsky.com
-
hushavefritid.dk
-
rehabilitationcentersinhouston.net
-
noesis.tech
-
i-arslan.de
-
myhostcloud.com
-
d1franchise.com
-
baumkuchenexpo.jp
-
mdk-mediadesign.de
-
nijaplay.com
-
calxplus.eu
-
saxtec.com
-
pv-design.de
-
edv-live.de
-
directwindowco.com
-
mrsplans.net
-
hexcreatives.co
-
mrtour.site
-
suncrestcabinets.ca
-
fundaciongregal.org
-
mediaclan.info
-
thefixhut.com
-
autodemontagenijmegen.nl
-
celeclub.org
-
ravensnesthomegoods.com
-
simpkinsedwards.co.uk
-
campusoutreach.org
-
todocaracoles.com
-
bxdf.info
-
galserwis.pl
-
puertamatic.es
-
notsilentmd.org
-
stoeferlehalle.de
-
fransespiegels.nl
-
physiofischer.de
-
senson.fi
-
stupbratt.no
-
balticdermatology.lt
-
augenta.com
-
edgewoodestates.org
-
camsadviser.com
-
vietlawconsultancy.com
-
marchand-sloboda.com
-
lorenacarnero.com
-
deprobatehelp.com
-
chavesdoareeiro.com
-
argos.wityu.fund
-
baylegacy.com
-
promesapuertorico.com
-
xltyu.com
-
ki-lowroermond.nl
-
tips.technology
-
x-ray.ca
-
dublikator.com
-
solerluethi-allart.ch
-
outcomeisincome.com
-
lapmangfpt.info.vn
-
devlaur.com
-
micro-automation.de
-
marcuswhitten.site
-
talentwunder.com
-
slimani.net
-
web.ion.ag
-
levdittliv.se
-
kamahouse.net
-
modelmaking.nl
-
limassoldriving.com
-
plantag.de
-
cranleighscoutgroup.org
-
bbsmobler.se
-
mooglee.com
-
longislandelderlaw.com
-
cite4me.org
-
35-40konkatsu.net
-
digivod.de
-
123vrachi.ru
-
calabasasdigest.com
-
joseconstela.com
-
fitovitaforum.com
-
quemargrasa.net
-
montrium.com
-
julis-lsa.de
-
revezlimage.com
-
agence-referencement-naturel-geneve.net
-
logopaedie-blomberg.de
-
tstaffing.nl
-
plastidip.com.ar
-
walkingdeadnj.com
-
sojamindbody.com
-
mirkoreisser.de
-
jobcenterkenya.com
-
danubecloud.com
-
thomasvicino.com
-
associacioesportivapolitg.cat
-
nokesvilledentistry.com
-
boulderwelt-muenchen-west.de
-
funjose.org.gt
-
kamienny-dywan24.pl
-
figura.team
-
yousay.site
-
woodworkersolution.com
-
cimanchesterescorts.co.uk
-
alvinschwartz.wordpress.com
-
naturstein-hotte.de
-
freie-baugutachterpraxis.de
-
wychowanieprzedszkolne.pl
-
chrissieperry.com
-
dr-seleznev.com
-
itelagen.com
-
ampisolabergeggi.it
-
ai-spt.jp
-
richard-felix.co.uk
-
kuntokeskusrok.fi
-
latestmodsapks.com
-
schutting-info.nl
-
zzyjtsgls.com
-
reddysbakery.com
-
travelffeine.com
-
southeasternacademyofprosthodontics.org
-
insidegarage.pl
-
vanswigchemdesign.com
-
tenacitytenfold.com
-
madinblack.com
-
hihaho.com
-
beautychance.se
-
ctrler.cn
-
insigniapmg.com
-
bouquet-de-roses.com
-
microcirc.net
-
brandl-blumen.de
-
tigsltd.com
-
controldekk.com
-
nicoleaeschbachorg.wordpress.com
-
iphoneszervizbudapest.hu
-
webmaster-peloton.com
-
nacktfalter.de
-
ecpmedia.vn
-
xn--logopdie-leverkusen-kwb.de
-
cyntox.com
-
readberserk.com
-
dnepr-beskid.com.ua
-
klusbeter.nl
-
koko-nora.dk
-
all-turtles.com
-
sandd.nl
-
corona-handles.com
-
dekkinngay.com
-
lbcframingelectrical.com
-
roadwarrior.app
-
tomoiyuma.com
-
paymybill.guru
-
pomodori-pizzeria.de
-
biapi-coaching.fr
-
smithmediastrategies.com
-
groupe-cets.com
-
fitnessingbyjessica.com
-
dushka.ua
-
4net.guru
-
airconditioning-waalwijk.nl
-
shadebarandgrillorlando.com
-
seitzdruck.com
-
appsformacpc.com
-
ahouseforlease.com
-
familypark40.com
-
amerikansktgodis.se
-
seproc.hn
-
dutchcoder.nl
-
polychromelabs.com
-
trapiantofue.it
-
backstreetpub.com
-
stemplusacademy.com
-
pawsuppetlovers.com
-
seminoc.com
-
shonacox.com
-
theapifactory.com
-
spsshomeworkhelp.com
-
mdacares.com
-
lynsayshepherd.co.uk
-
bristolaeroclub.co.uk
-
fotoideaymedia.es
-
rostoncastings.co.uk
-
sinal.org
-
jsfg.com
-
jvanvlietdichter.nl
-
no-plans.com
-
spylista.com
-
werkkring.nl
-
1kbk.com.ua
-
faroairporttransfers.net
-
autopfand24.de
-
labobit.it
-
coastalbridgeadvisors.com
-
deschl.net
-
em-gmbh.ch
-
gopackapp.com
-
bundabergeyeclinic.com.au
-
yamalevents.com
-
licor43.de
-
visiativ-industry.fr
-
mymoneyforex.com
-
dlc.berlin
-
parking.netgateway.eu
-
heliomotion.com
-
bayoga.co.uk
-
stormwall.se
-
themadbotter.com
-
kisplanning.com.au
-
xn--thucmctc-13a1357egba.com
-
oneheartwarriors.at
-
team-montage.dk
-
xlarge.at
-
testzandbakmetmening.online
-
thewellnessmimi.com
-
bigasgrup.com
-
ftlc.es
-
rafaut.com
-
spargel-kochen.de
-
fiscalsort.com
-
promalaga.es
-
jolly-events.com
-
mediaplayertest.net
-
leoben.at
-
herbayupro.com
-
urclan.net
-
tanzprojekt.com
-
seevilla-dr-sturm.at
-
charlesreger.com
-
parkstreetauto.net
-
babcockchurch.org
-
celularity.com
-
tinyagency.com
-
caribbeansunpoker.com
-
summitmarketingstrategies.com
-
kalkulator-oszczednosci.pl
-
bockamp.com
-
ausbeverage.com.au
-
leeuwardenstudentcity.nl
-
cheminpsy.fr
-
peterstrobos.com
-
homng.net
-
penco.ie
-
gmto.fr
-
bildungsunderlebnis.haus
-
instatron.net
-
tongdaifpthaiphong.net
-
blumenhof-wegleitner.at
-
handi-jack-llc.com
-
icpcnj.org
-
memaag.com
-
DupontSellsHomes.com
-
makeflowers.ru
-
daklesa.de
-
liikelataamo.fi
-
mank.de
-
xtptrack.com
-
miriamgrimm.de
-
kedak.de
-
charlottepoudroux-photographie.fr
-
pocket-opera.de
-
autodujos.lt
-
serce.info.pl
-
raschlosser.de
-
danielblum.info
-
parks-nuernberg.de
-
sevenadvertising.com
-
boompinoy.com
-
mylovelybluesky.com
-
gonzalezfornes.es
-
the-virtualizer.com
-
hvccfloorcare.com
-
dutchbrewingcoffee.com
-
midmohandyman.com
-
ino-professional.ru
-
ledmes.ru
-
musictreehouse.net
-
spinheal.ru
-
dirittosanitario.biz
-
zso-mannheim.de
-
alysonhoward.com
-
entopic.com
-
humancondition.com
-
delchacay.com.ar
-
navyfederalautooverseas.com
-
kidbucketlist.com.au
-
asteriag.com
-
baptisttabernacle.com
-
softsproductkey.com
-
heidelbergartstudio.gallery
-
gratispresent.se
-
philippedebroca.com
-
mountsoul.de
-
lykkeliv.net
-
dr-pipi.de
-
norpol-yachting.com
-
theduke.de
-
mapawood.com
-
otsu-bon.com
-
hashkasolutindo.com
-
zervicethai.co.th
-
ulyssemarketing.com
-
torgbodenbollnas.se
-
pmc-services.de
-
csgospeltips.se
-
femxarxa.cat
-
hrabritelefon.hr
-
edelman.jp
-
commercialboatbuilding.com
-
innote.fi
-
stallbyggen.se
-
porno-gringo.com
-
caffeinternet.it
-
thaysa.com
-
exenberger.at
-
personalenhancementcenter.com
-
quizzingbee.com
-
lukeshepley.wordpress.com
-
aglend.com.au
-
pmcimpact.com
-
advizewealth.com
-
andersongilmour.co.uk
-
tastewilliamsburg.com
-
homesdollar.com
-
smokeysstoves.com
-
erstatningsadvokaterne.dk
-
drfoyle.com
-
castillobalduz.es
-
mastertechengineering.com
-
faizanullah.com
-
layrshift.eu
-
pogypneu.sk
-
bradynursery.com
-
ncuccr.org
-
ouryoungminds.wordpress.com
-
nosuchthingasgovernment.com
-
sairaku.net
-
echtveilig.nl
-
plv.media
-
consultaractadenacimiento.com
-
woodleyacademy.org
-
eaglemeetstiger.de
-
carolinepenn.com
-
dontpassthepepper.com
-
id-et-d.fr
-
maineemploymentlawyerblog.com
-
gantungankunciakrilikbandung.com
-
forskolorna.org
-
selfoutlet.com
-
bee4win.com
-
stopilhan.com
-
christinarebuffetcourses.com
-
hairnetty.wordpress.com
-
365questions.org
-
lucidinvestbank.com
-
huesges-gruppe.de
-
fitnessbazaar.com
-
milestoneshows.com
-
maxadams.london
-
deltacleta.cat
-
kikedeoliveira.com
-
anteniti.com
-
vannesteconstruct.be
-
tradiematepro.com.au
-
agence-chocolat-noir.com
-
eglectonk.online
-
mmgdouai.fr
-
farhaani.com
-
milanonotai.it
-
bridgeloanslenders.com
-
arteservicefabbro.com
-
centromarysalud.com
-
imadarchid.com
-
interactcenter.org
-
wmiadmin.com
-
schoolofpassivewealth.com
-
hatech.io
-
body-guards.it
-
pridoxmaterieel.nl
-
ra-staudte.de
-
slupetzky.at
-
wien-mitte.co.at
-
sipstroysochi.ru
-
nhadatcanho247.com
-
mbfagency.com
-
humanityplus.org
-
jusibe.com
-
rushhourappliances.com
-
geekwork.pl
-
sachnendoc.com
-
coursio.com
-
houseofplus.com
-
zweerscreatives.nl
-
broseller.com
-
almosthomedogrescue.dog
-
dubnew.com
-
imperfectstore.com
-
garage-lecompte-rouen.fr
-
naturalrapids.com
-
smart-light.co.uk
-
officehymy.com
-
solinegraphic.com
-
simpliza.com
-
pier40forall.org
-
bptdmaluku.com
-
ivivo.es
-
commonground-stories.com
-
stampagrafica.es
-
morawe-krueger.de
-
jadwalbolanet.info
-
ziegler-praezisionsteile.de
-
faronics.com
-
mepavex.nl
-
uimaan.fi
-
run4study.com
-
abogadosadomicilio.es
-
space.ua
-
zieglerbrothers.de
-
ceres.org.au
-
shiresresidential.com
-
shsthepapercut.com
-
better.town
-
stacyloeb.com
-
operaslovakia.sk
-
comarenterprises.com
-
ecoledansemulhouse.fr
-
stoeberstuuv.de
-
mirjamholleman.nl
-
rota-installations.co.uk
-
linnankellari.fi
-
gaiam.nl
-
maureenbreezedancetheater.org
-
huissier-creteil.com
-
berliner-versicherungsvergleich.de
-
ihr-news.jp
-
phantastyk.com
-
campus2day.de
-
associationanalytics.com
-
catholicmusicfest.com
-
ilive.lt
-
completeweddingkansas.com
-
nandistribution.nl
-
wellplast.se
-
eco-southafrica.com
-
aarvorg.com
-
takeflat.com
-
toponlinecasinosuk.co.uk
-
tulsawaterheaterinstallation.com
-
girlillamarketing.com
-
allfortheloveofyou.com
-
carrybrands.nl
-
filmstreamingvfcomplet.be
-
bloggyboulga.net
-
abitur-undwieweiter.de
-
unetica.fr
-
johnsonfamilyfarmblog.wordpress.com
-
greenfieldoptimaldentalcare.com
-
frontierweldingllc.com
-
daniel-akermann-architektur-und-planung.ch
-
schmalhorst.de
-
eadsmurraypugh.com
-
creative-waves.co.uk
-
sloverse.com
-
skiltogprint.no
-
whyinterestingly.ru
-
slwgs.org
-
synlab.lt
-
datacenters-in-europe.com
-
devstyle.org
-
admos-gleitlager.de
-
imaginado.de
-
smalltownideamill.wordpress.com
-
tomaso.gr
-
irinaverwer.com
-
c-a.co.in
-
plotlinecreative.com
-
simoneblum.de
-
gamesboard.info
-
acomprarseguidores.com
-
cwsitservices.co.uk
-
lenreactiv-shop.ru
-
brigitte-erler.com
-
berlin-bamboo-bikes.org
-
steampluscarpetandfloors.com
-
baronloan.org
-
kaliber.co.jp
-
veybachcenter.de
-
nestor-swiss.ch
-
pcp-nc.com
-
chaotrang.com
-
notmissingout.com
-
blogdecachorros.com
-
makeitcount.at
-
2ekeus.nl
-
theshungiteexperience.com.au
-
zonamovie21.net
-
ostheimer.at
-
juneauopioidworkgroup.org
-
proudground.org
-
hellohope.com
-
evergreen-fishing.com
-
lightair.com
-
iwelt.de
-
bogdanpeptine.ro
-
denovofoodsgroup.com
-
tophumanservicescourses.com
-
irishmachineryauctions.com
-
ungsvenskarna.se
-
surespark.org.uk
-
blood-sports.net
-
ianaswanson.com
-
nuzech.com
-
live-your-life.jp
-
hkr-reise.de
-
qualitus.com
-
mooshine.com
-
rksbusiness.com
-
dpo-as-a-service.com
-
pinkexcel.com
-
gasbarre.com
-
degroenetunnel.com
-
gemeentehetkompas.nl
-
gadgetedges.com
-
danskretursystem.dk
-
myzk.site
-
pointos.com
-
id-vet.com
-
michaelsmeriglioracing.com
-
quickyfunds.com
-
manutouchmassage.com
-
scenepublique.net
-
wurmpower.at
-
renergysolution.com
-
delawarecorporatelaw.com
-
cursoporcelanatoliquido.online
-
praxis-management-plus.de
-
luxurytv.jp
-
verbisonline.com
-
nachhilfe-unterricht.com
-
precisionbevel.com
-
mooreslawngarden.com
-
jasonbaileystudio.com
-
hardinggroup.com
-
ncid.bc.ca
-
chatizel-paysage.fr
-
boosthybrid.com.au
-
rosavalamedahr.com
-
alhashem.net
-
crowcanyon.com
-
thee.network
-
chandlerpd.com
-
offroadbeasts.com
-
neuschelectrical.co.za
-
smhydro.com.pl
-
trulynolen.co.uk
-
gasolspecialisten.se
-
sanaia.com
-
kadesignandbuild.co.uk
-
thomas-hospital.de
-
minipara.com
-
justinvieira.com
-
prochain-voyage.net
-
firstpaymentservices.com
-
crowd-patch.co.uk
-
koken-voor-baby.nl
-
worldhealthbasicinfo.com
-
narcert.com
-
partnertaxi.sk
-
verytycs.com
-
sportiomsportfondsen.nl
-
schraven.de
-
4youbeautysalon.com
-
sahalstore.com
-
kath-kirche-gera.de
-
withahmed.com
-
thedresserie.com
-
karacaoglu.nl
-
testcoreprohealthuk.com
-
walter-lemm.de
-
crediacces.com
-
bargningharnosand.se
-
hypozentrum.com
-
comparatif-lave-linge.fr
-
sanyue119.com
-
teresianmedia.org
-
easytrans.com.au
-
schoellhammer.com
-
ateliergamila.com
-
fensterbau-ziegler.de
-
herbstfeststaefa.ch
-
shiftinspiration.com
-
atalent.fi
-
mir-na-iznanku.com
-
kosterra.com
-
drnice.de
-
igfap.com
-
brawnmediany.com
-
cleliaekiko.online
-
pierrehale.com
-
oemands.dk
-
streamerzradio1.site
-
the-domain-trader.com
-
denifl-consulting.at
-
lange.host
-
zimmerei-fl.de
-
uranus.nl
-
hiddencitysecrets.com.au
-
smale-opticiens.nl
-
apolomarcas.com
-
kaminscy.com
-
westdeptfordbuyrite.com
-
mediaacademy-iraq.org
-
corola.es
-
galleryartfair.com
-
antonmack.de
-
petnest.ir
-
tampaallen.com
-
nakupunafoundation.org
-
myhealth.net.au
-
waywithwords.net
-
nsec.se
-
fax-payday-loans.com
-
healthyyworkout.com
-
pasvenska.se
-
apprendrelaudit.com
-
xn--fnsterputssollentuna-39b.se
-
bricotienda.com
-
milsing.hr
-
jiloc.com
-
planchaavapor.net
-
kariokids.com
-
darnallwellbeing.org.uk
-
durganews.com
-
winrace.no
-
www1.proresult.no
-
transliminaltribe.wordpress.com
-
unim.su
-
epwritescom.wordpress.com
-
mountaintoptinyhomes.com
-
kafu.ch
-
pay4essays.net
-
psnacademy.in
-
pcprofessor.com
-
ymca-cw.org.uk
-
citymax-cr.com
-
opatrovanie-ako.sk
-
esope-formation.fr
-
malychanieruchomoscipremium.com
-
croftprecision.co.uk
-
jerling.de
-
sotsioloogia.ee
-
digi-talents.com
-
geisterradler.de
-
rhinosfootballacademy.com
-
spectrmash.ru
-
allamatberedare.se
-
cerebralforce.net
-
bsaship.com
-
burkert-ideenreich.de
-
skanah.com
-
psa-sec.de
-
ncs-graphic-studio.com
-
thenewrejuveme.com
-
sportverein-tambach.de
-
blgr.be
-
ohidesign.com
-
intecwi.com
-
ogdenvision.com
-
bunburyfreightservices.com.au
-
bingonearme.org
-
radaradvies.nl
-
lecantou-coworking.com
-
markelbroch.com
-
parebrise-tla.fr
-
abuelos.com
-
kao.at
-
strategicstatements.com
-
jenniferandersonwriter.com
-
abl1.net
-
harpershologram.wordpress.com
-
vox-surveys.com
-
art2gointerieurprojecten.nl
-
alsace-first.com
-
sterlingessay.com
-
sweering.fr
-
sauschneider.info
-
cactusthebrand.com
-
bimnapratica.com
-
you-bysia.com.au
-
kindersitze-vergleich.de
-
bookspeopleplaces.com
-
xn--singlebrsen-vergleich-nec.com
-
insp.bi
-
webhostingsrbija.rs
-
amylendscrestview.com
-
new.devon.gov.uk
-
carlosja.com
-
vdberg-autoimport.nl
-
thedad.com
-
aminaboutique247.com
-
pickanose.com
-
cursosgratuitosnainternet.com
-
antiaginghealthbenefits.com
-
praxis-foerderdiagnostik.de
-
antenanavi.com
-
simulatebrain.com
-
lusak.at
-
maryloutaylor.com
-
cortec-neuro.com
-
artallnightdc.com
-
hotelzentral.at
-
mytechnoway.com
-
gporf.fr
-
lefumetdesdombes.com
-
braffinjurylawfirm.com
-
patrickfoundation.net
-
gw2guilds.org
-
jyzdesign.com
-
elpa.se
-
thailandholic.com
-
bouldercafe-wuppertal.de
-
satyayoga.de
-
courteney-cox.net
-
nativeformulas.com
-
mrxermon.de
-
rimborsobancario.net
-
lapinvihreat.fi
-
iyahayki.nl
-
anybookreader.de
-
kmbshipping.co.uk
-
kissit.ca
-
bowengroup.com.au
-
jbbjw.com
-
sarbatkhalsafoundation.org
-
littlebird.salon
-
colorofhorses.com
-
hebkft.hu
-
ussmontanacommittee.us
-
elimchan.com
-
collaborativeclassroom.org
-
oslomf.no
-
financescorecard.com
-
ilcdover.com
-
danholzmann.com
-
nurturingwisdom.com
-
iqbalscientific.com
-
evologic-technologies.com
-
moveonnews.com
-
vitalyscenter.es
-
bigler-hrconsulting.ch
-
facettenreich27.de
-
poultrypartners.nl
-
lmtprovisions.com
-
systemate.dk
-
bauertree.com
-
pferdebiester.de
-
latribuessentielle.com
-
transportesycementoshidalgo.es
-
lionware.de
-
euro-trend.pl
-
educar.org
-
global-kids.info
-
desert-trails.com
-
smartypractice.com
-
purposeadvisorsolutions.com
-
aakritpatel.com
-
norovirus-ratgeber.de
-
enovos.de
-
deko4you.at
-
stefanpasch.me
-
krlosdavid.com
-
helikoptervluchtnewyork.nl
-
hhcourier.com
-
spacecitysisters.org
-
diversiapsicologia.es
-
zflas.com
-
theadventureedge.com
-
pivoineetc.fr
-
trystana.com
-
boldcitydowntown.com
-
idemblogs.com
-
turkcaparbariatrics.com
-
brevitempore.net
-
oneplusresource.org
-
odiclinic.org
-
levihotelspa.fi
-
hannah-fink.de
-
div-vertriebsforschung.de
-
ralister.co.uk
-
12starhd.online
-
izzi360.com
-
vyhino-zhulebino-24.ru
-
cityorchardhtx.com
-
aniblinova.wordpress.com
-
socialonemedia.com
-
artige.com
-
lichencafe.com
-
extraordinaryoutdoors.com
-
blog.solutionsarchitect.guru
-
makeurvoiceheard.com
-
aprepol.com
-
manifestinglab.com
-
sexandfessenjoon.wordpress.com
-
austinlchurch.com
-
spd-ehningen.de
-
mikeramirezcpa.com
-
restaurantesszimmer.de
-
lascuola.nl
-
balticdentists.com
-
tarotdeseidel.com
-
jorgobe.at
-
blacksirius.de
-
iviaggisonciliegie.it
-
stoneys.ch
-
conasmanagement.de
-
carriagehousesalonvt.com
-
iwr.nl
-
nvwoodwerks.com
-
hoteledenpadova.it
-
oncarrot.com
-
wacochamber.com
-
profectis.de
-
punchbaby.com
-
iyengaryogacharlotte.com
-
corendonhotels.com
-
centrospgolega.com
-
tanciu.com
-
drugdevice.org
-
rumahminangberdaya.com
-
otto-bollmann.de
-
higadograsoweb.com
-
tandartspraktijkheesch.nl
-
zenderthelender.com
-
monark.com
-
xn--vrftet-pua.biz
-
international-sound-awards.com
-
goodgirlrecovery.com
-
panelsandwichmadrid.es
-
n1-headache.com
-
whittier5k.com
-
asgestion.com
-
pixelarttees.com
-
simplyblessedbykeepingitreal.com
-
ladelirante.fr
-
schlafsack-test.net
-
finediningweek.pl
-
bestbet.com
-
greenpark.ch
-
mindpackstudios.com
-
vancouver-print.ca
-
vibehouse.rw
-
dramagickcom.wordpress.com
-
buroludo.nl
-
buymedical.biz
-
kostenlose-webcams.com
-
forestlakeuca.org.au
-
fannmedias.com
-
lubetkinmediacompanies.com
-
rollingrockcolumbia.com
-
smogathon.com
-
dw-css.de
-
noixdecocom.fr
-
importardechina.info
-
fotoscondron.com
-
knowledgemuseumbd.com
-
vorotauu.ru
-
atmos-show.com
-
friendsandbrgrs.com
-
luckypatcher-apkz.com
-
igrealestate.com
-
milltimber.aberdeen.sch.uk
-
boisehosting.net
-
remcakram.com
-
loprus.pl
-
krcove-zily.eu
-
crosspointefellowship.church
-
newyou.at
-
anthonystreetrimming.com
-
ccpbroadband.com
-
americafirstcommittee.org
-
beaconhealthsystem.org
-
nmiec.com
-
grelot-home.com
-
sabel-bf.com
-
htchorst.nl
-
liliesandbeauties.org
-
siliconbeach-realestate.com
-
aodaichandung.com
-
ventti.com.ar
-
atozdistribution.co.uk
-
ivfminiua.com
-
seagatesthreecharters.com
-
highimpactoutdoors.net
-
foretprivee.ca
-
allure-cosmetics.at
-
triggi.de
-
candyhouseusa.com
-
toreria.es
-
rozemondcoaching.nl
-
compliancesolutionsstrategies.com
-
tanzschule-kieber.de
-
wraithco.com
-
embracinghiscall.com
-
rieed.de
-
smessier.com
-
xn--fn-kka.no
-
haar-spange.com
-
jandaonline.com
-
chefdays.de
-
stingraybeach.com
-
fibrofolliculoma.info
-
journeybacktolife.com
-
aurum-juweliere.de
-
jeanlouissibomana.com
-
judithjansen.com
-
alten-mebel63.ru
-
osterberg.fi
-
macabaneaupaysflechois.com
-
lapinlviasennus.fi
-
waveneyrivercentre.co.uk
-
huehnerauge-entfernen.de
-
bouncingbonanza.com
-
architecturalfiberglass.org
-
net
true
-
pid
$2a$10$Wlb.6omIqlVeirP4q3KysOlMVQGNS7LVUvZJsVFcPGaAiZ15vw/4.
-
prc
thebat
excel
visio
dbsnmp
encsvc
oracle
agntsvc
mspub
thunderbird
tbirdconfig
dbeng50
ocautoupds
mydesktopservice
isqlplussvc
wordpad
synctime
steam
mydesktopqos
ocomm
outlook
firefox
winword
powerpnt
sqbcoreservice
ocssd
sql
msaccess
xfssvccon
onenote
infopath
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
5856
-
svc
sql
mepocs
veeam
memtas
vss
backup
svc$
sophos
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ReceiveSend.png => \??\c:\users\admin\pictures\ReceiveSend.png.8611oyc8m 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File renamed C:\Users\Admin\Pictures\LockInstall.tif => \??\c:\users\admin\pictures\LockInstall.tif.8611oyc8m 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File renamed C:\Users\Admin\Pictures\DebugFormat.crw => \??\c:\users\admin\pictures\DebugFormat.crw.8611oyc8m 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\T: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\U: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\W: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\X: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\K: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\F: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\B: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\I: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\J: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\N: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\O: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\P: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\R: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\S: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\H: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\E: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\G: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\M: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\Q: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\V: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\Y: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\Z: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\A: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened (read-only) \??\D: 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\97293i.bmp" 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\program files (x86)\8611oyc8m-readme.txt 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\FindEdit.3gp2 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\RestartStep.html 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\ResolveConvertFrom.avi 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\SetPublish.DVR 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\WatchInstall.ps1xml 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\BlockCopy.TS 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\ConvertSubmit.pcx 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\EnableGrant.vst 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\ConvertSplit.m4v 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\StartExpand.WTV 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\ResolveTrace.3gp 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File created \??\c:\program files\8611oyc8m-readme.txt 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\AssertUnblock.wma 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe File opened for modification \??\c:\program files\DismountInitialize.avi 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3784 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe 3784 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe 3784 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe 3784 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3784 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe Token: SeTakeOwnershipPrivilege 3784 686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe Token: SeBackupPrivilege 2872 vssvc.exe Token: SeRestorePrivilege 2872 vssvc.exe Token: SeAuditPrivilege 2872 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe"C:\Users\Admin\AppData\Local\Temp\686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2736
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872