Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 21:37
Static task
static1
Behavioral task
behavioral1
Sample
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe
Resource
win10v2004-20220414-en
General
-
Target
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe
-
Size
362KB
-
MD5
029495b7e61292c0b469631f78ebdd63
-
SHA1
51e4574acbb727100e7c20566495f12d7252cdc7
-
SHA256
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9
-
SHA512
ae770f0848457db601a0fc1cbc97cc7080dad039bebefad3a9e845a122790903ffc82233a0449c3cb3d0fa17b37c2a1dad707305f19ea079918b9ad7876c892d
Malware Config
Extracted
C:\zu4x41jwc-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/053C3B2A487F7FC2
http://decryptor.top/053C3B2A487F7FC2
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exedescription ioc process File renamed C:\Users\Admin\Pictures\ShowStop.raw => \??\c:\users\admin\pictures\ShowStop.raw.zu4x41jwc bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File renamed C:\Users\Admin\Pictures\SendPing.png => \??\c:\users\admin\pictures\SendPing.png.zu4x41jwc bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File renamed C:\Users\Admin\Pictures\CompareEdit.crw => \??\c:\users\admin\pictures\CompareEdit.crw.zu4x41jwc bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File renamed C:\Users\Admin\Pictures\ConvertRevoke.raw => \??\c:\users\admin\pictures\ConvertRevoke.raw.zu4x41jwc bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File renamed C:\Users\Admin\Pictures\PublishExport.png => \??\c:\users\admin\pictures\PublishExport.png.zu4x41jwc bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File renamed C:\Users\Admin\Pictures\ResetEnter.raw => \??\c:\users\admin\pictures\ResetEnter.raw.zu4x41jwc bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\users\admin\pictures\InvokeUnpublish.tiff bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File renamed C:\Users\Admin\Pictures\InvokeUnpublish.tiff => \??\c:\users\admin\pictures\InvokeUnpublish.tiff.zu4x41jwc bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File renamed C:\Users\Admin\Pictures\UndoDisable.crw => \??\c:\users\admin\pictures\UndoDisable.crw.zu4x41jwc bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File renamed C:\Users\Admin\Pictures\UnprotectUse.tif => \??\c:\users\admin\pictures\UnprotectUse.tif.zu4x41jwc bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe -
Loads dropped DLL 1 IoCs
Processes:
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exepid process 1792 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exedescription ioc process File opened (read-only) \??\B: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\F: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\G: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\R: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\S: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\T: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\W: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\Y: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\Z: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\A: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\I: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\K: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\P: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\Q: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\X: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\L: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\N: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\O: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\D: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\E: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\H: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\J: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\M: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\U: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened (read-only) \??\V: bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c9hhcl82s74.bmp" bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exedescription pid process target process PID 1792 set thread context of 1592 1792 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe -
Drops file in Program Files directory 34 IoCs
Processes:
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exedescription ioc process File opened for modification \??\c:\program files\GroupSync.dib bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\PopTest.mpeg2 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\UnblockResize.dwg bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\ConvertFromSend.svg bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\InitializeExit.xhtml bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\MoveSet.ADTS bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File created \??\c:\program files\zu4x41jwc-readme.txt bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\RemovePublish.mht bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\RevokeMount.html bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\PingAdd.emz bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\DisconnectMerge.edrwx bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\FormatLock.TS bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\InitializeWatch.mpg bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\LockMount.js bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\LockOpen.mht bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\SuspendUse.M2TS bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\CloseUpdate.html bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\SetRegister.vsdx bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\EnableReceive.DVR bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\CheckpointMeasure.emz bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\RemoveDeny.3gp bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\ResetBackup.TTS bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\UnblockDebug.pdf bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\UninstallUnregister.ex_ bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\CheckpointConnect.snd bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\ResetSkip.mpg bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\UseResume.mpeg3 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\ReceivePublish.php bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\BackupResolve.cfg bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\OutSync.contact bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\ResolvePublish.xps bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\SetUndo.ppsx bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File opened for modification \??\c:\program files\WatchConvertTo.wm bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe File created \??\c:\program files (x86)\zu4x41jwc-readme.txt bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exepowershell.exepid process 1592 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe 1592 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe 1756 powershell.exe 1756 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exepid process 1792 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1756 powershell.exe Token: SeBackupPrivilege 1568 vssvc.exe Token: SeRestorePrivilege 1568 vssvc.exe Token: SeAuditPrivilege 1568 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exebc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exedescription pid process target process PID 1792 wrote to memory of 1592 1792 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe PID 1792 wrote to memory of 1592 1792 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe PID 1792 wrote to memory of 1592 1792 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe PID 1792 wrote to memory of 1592 1792 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe PID 1592 wrote to memory of 1756 1592 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe powershell.exe PID 1592 wrote to memory of 1756 1592 bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe"C:\Users\Admin\AppData\Local\Temp\bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe"C:\Users\Admin\AppData\Local\Temp\bc265a21f56c914f882f28f74aae8424cd516084c680817bcb9875df592f07e9.exe"2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsdE95C.tmp\System.dllFilesize
11KB
MD5fbe295e5a1acfbd0a6271898f885fe6a
SHA1d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA5122cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
-
memory/1592-131-0x0000000000000000-mapping.dmp
-
memory/1756-132-0x0000000000000000-mapping.dmp
-
memory/1756-133-0x000001B84FFA0000-0x000001B84FFC2000-memory.dmpFilesize
136KB
-
memory/1756-134-0x00007FFE0EB20000-0x00007FFE0F5E1000-memory.dmpFilesize
10.8MB