Analysis
- max time kernel
146s - max time network
192s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
25/06/2022, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe
Resource
win10v2004-20220414-en
General
- Target d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe
- Size 293KB
- Sample220625-g2z4cabdf6
- SHA256 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af
- MD5 a50c2128e9a2c532e69a1af24b49305d
- SHA1 43ec40955adb0cc8e3a62a8c6202fb99d79ca3dd
- SHA512 2943cc959a76e87ba7d7d809712ea2c3c3f2535de2a262c1bfda2e15a22112030c9d4feff7d15c9a68c18aa69304935a861ed98af56b63c7d6ae0fb3d64727c2
- MD5 SHA1 SHA512
Malware Config
Extracted
-
C:\q4w0ial5-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension q4w0ial5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/67FFC7696EC4B437 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/67FFC7696EC4B437 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: phduy/h71TczJo0/G5yN5+XzwRhDvKCiK/4zVXDzsSdmyOiVgMPGHBx57FgJNux4 h31RiumUcGgr775xKGK+z1TSfVnfYJh0ePkfcJiwAnMWypM9M92KBquXkINF1q59 OGJ3ghuAI6FuNGZUg1NdTD0xqPlK3+4QqapNnGayT5+eI2UrM1NOXVbfb3pIVixL Mj9Xk6Nn59iRr2uhWbftgKjLNqljvOnC3RolIBH1L0k7nNyeSQFtUkkzyELCALcc 3pDz1kBDtXM8xg7HSXWLiQtutJ1NMv2sbwrmccgXgYj21Dx0V/gLaMgspiAKcurL zh2E698rIOHN0JZ3XlYAFxD8cRroIJiSlBygNQH4C0J8mWDGx6VNUaBckYeDCFDG vi5vhXWEB41Hv4mBDIen22s2mW9T3c9KFd6CouWLazpe9eDsBB8VTBvwCKTpOQVJ sZlAo9ACR3LwdlW1zaYeaz9N+dJH/CqvR1RaPNHUClXV7rrMkQfv/Ci28g2dW2Qb jHU3DnND/f1RRcS7Iil4NBSB8Qhz1KvCwRv+TLkIUJxzfmhsleltu/yYjkEPsWiv 7d3CL925aI5u/ZdIJvsFYQo8Bs/b6ajBCI6FPFM0lg9NOndJYA6YtH4GRW6f5nuX IeYxIgnNVq3yb5EojmJjr/tVacsuNy8SI078FCqDvxG5C2fcjNIYjk+Q7YTGb6oD shq2ueSNoyX/fhgk9MSrLabt3qHbTnF0k4iy1VdS1bDhjIBVefxH3kDIqdrzRUYt yCyQEopE+ZGUTX4X7EZAOPcl4UVaXlXTlixtmtOd22qqZghgtxpZdLni9kFNLi55 Z4OPVijh/wlkC6atYMGGrjPVNIRJ2MI4NFvAmGdRL36kc9X+EVPOoGjNVFrW3WNd BBwelRtLHQ1Y6Wa6x4T25bVE/jwLfgYYxZ7RQwtqQNyEVd9uENZHV13o+c5ZtzVS yOXbxR4d5wclBLFmJsS7FK0P/d+mQ6OabWet8DP5UBQZ0XH+VUtsGBxREwyWzzaU ilpPSNM/ZR8U02bMV8mMWSAYKaTiWt8SFr/0BdMxZ66KdbbnyVy1U5BAVY4XLcfe vbieaj+1gRY44b4qgpVlFUv4ivq7fZSX5BmcfANghFZVJfH8YNP2IDbotoWx7tMq 1CFx1A83F+50XvZXfSL4aGpszjhQOY4J9krFYsSMWjIe6MfrAE6mwFi6ig4d1Nyd ZGNFu7nvP1yMzl5I+/CxxDKVgoNZLqBpU+siK0XFH5aMaLtLzM9zv7JxebtMJfGp 42HufCVqk10/F3UlLVZgWtqFdt+3zNOi6hr3SBJoABGpyw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/67FFC7696EC4B437
-
http://decryptor.cc/67FFC7696EC4B437
Extracted
-
sodinokibi
-
$2a$10$Tphwr9LlSOB8K3/pTVWV7eKmKHrXDvdOolDJayLa5.SJ.jyMLYUL2
-
3144
-
trystana.com
-
jameskibbie.com
-
nandistribution.nl
-
blood-sports.net
-
personalenhancementcenter.com
-
ralister.co.uk
-
live-con-arte.de
-
rhinosfootballacademy.com
-
devok.info
-
maxadams.london
-
web.ion.ag
-
pierrehale.com
-
ihr-news.jp
-
xltyu.com
-
phantastyk.com
-
desert-trails.com
-
ncs-graphic-studio.com
-
ahouseforlease.com
-
pay4essays.net
-
sevenadvertising.com
-
solinegraphic.com
-
rerekatu.com
-
consultaractadenacimiento.com
-
purposeadvisorsolutions.com
-
sloverse.com
-
thedad.com
-
sobreholanda.com
-
adoptioperheet.fi
-
marcuswhitten.site
-
berlin-bamboo-bikes.org
-
wellplast.se
-
c2e-poitiers.com
-
financescorecard.com
-
thenewrejuveme.com
-
praxis-foerderdiagnostik.de
-
samnewbyjax.com
-
lapmangfpt.info.vn
-
seproc.hn
-
better.town
-
systemate.dk
-
architecturalfiberglass.org
-
modestmanagement.com
-
digi-talents.com
-
freie-gewerkschaften.de
-
madinblack.com
-
stoeferlehalle.de
-
hexcreatives.co
-
galserwis.pl
-
admos-gleitlager.de
-
zonamovie21.net
-
tophumanservicescourses.com
-
vancouver-print.ca
-
facettenreich27.de
-
ymca-cw.org.uk
-
jyzdesign.com
-
tanzprojekt.com
-
baylegacy.com
-
punchbaby.com
-
pcp-nc.com
-
chatizel-paysage.fr
-
pickanose.com
-
shiftinspiration.com
-
hoteledenpadova.it
-
nacktfalter.de
-
boldcitydowntown.com
-
bauertree.com
-
dublikator.com
-
tinyagency.com
-
lachofikschiet.nl
-
clos-galant.com
-
offroadbeasts.com
-
babcockchurch.org
-
easytrans.com.au
-
filmstreamingvfcomplet.be
-
igrealestate.com
-
vloeren-nu.nl
-
nvwoodwerks.com
-
autodemontagenijmegen.nl
-
drugdevice.org
-
verytycs.com
-
sauschneider.info
-
sachnendoc.com
-
work2live.de
-
croftprecision.co.uk
-
hardinggroup.com
-
cwsitservices.co.uk
-
toreria.es
-
cactusthebrand.com
-
abogadosadomicilio.es
-
southeasternacademyofprosthodontics.org
-
cheminpsy.fr
-
anthonystreetrimming.com
-
agence-chocolat-noir.com
-
cursoporcelanatoliquido.online
-
international-sound-awards.com
-
balticdermatology.lt
-
smejump.co.th
-
jeanlouissibomana.com
-
satyayoga.de
-
braffinjurylawfirm.com
-
bayoga.co.uk
-
webcodingstudio.com
-
bodyfulls.com
-
geoffreymeuli.com
-
analiticapublica.es
-
kenhnoithatgo.com
-
christ-michael.net
-
naturstein-hotte.de
-
ditog.fr
-
vitalyscenter.es
-
biortaggivaldelsa.com
-
quickyfunds.com
-
live-your-life.jp
-
camsadviser.com
-
baronloan.org
-
theclubms.com
-
all-turtles.com
-
mediaacademy-iraq.org
-
abitur-undwieweiter.de
-
kalkulator-oszczednosci.pl
-
eco-southafrica.com
-
12starhd.online
-
klusbeter.nl
-
xn--singlebrsen-vergleich-nec.com
-
4youbeautysalon.com
-
datacenters-in-europe.com
-
fitovitaforum.com
-
no-plans.com
-
mirkoreisser.de
-
troegs.com
-
solhaug.tk
-
worldhealthbasicinfo.com
-
vibehouse.rw
-
agence-referencement-naturel-geneve.net
-
jbbjw.com
-
raschlosser.de
-
employeesurveys.com
-
woodleyacademy.org
-
div-vertriebsforschung.de
-
ceid.info.tr
-
chavesdoareeiro.com
-
rksbusiness.com
-
vannesteconstruct.be
-
lebellevue.fr
-
bundabergeyeclinic.com.au
-
rafaut.com
-
edelman.jp
-
hmsdanmark.dk
-
friendsandbrgrs.com
-
wurmpower.at
-
odiclinic.org
-
deprobatehelp.com
-
collaborativeclassroom.org
-
alsace-first.com
-
mbfagency.com
-
quemargrasa.net
-
bsaship.com
-
farhaani.com
-
bigler-hrconsulting.ch
-
leda-ukraine.com.ua
-
bristolaeroclub.co.uk
-
edv-live.de
-
art2gointerieurprojecten.nl
-
servicegsm.net
-
danubecloud.com
-
destinationclients.fr
-
candyhouseusa.com
-
vesinhnha.com.vn
-
sportsmassoren.com
-
lubetkinmediacompanies.com
-
testzandbakmetmening.online
-
starsarecircular.org
-
marietteaernoudts.nl
-
moveonnews.com
-
triactis.com
-
faronics.com
-
kisplanning.com.au
-
modelmaking.nl
-
dushka.ua
-
aakritpatel.com
-
oceanastudios.com
-
simpkinsedwards.co.uk
-
wasmachtmeinfonds.at
-
linnankellari.fi
-
gymnasedumanagement.com
-
zflas.com
-
klimt2012.info
-
trackyourconstruction.com
-
crosspointefellowship.church
-
makeflowers.ru
-
socstrp.org
-
schraven.de
-
cite4me.org
-
prochain-voyage.net
-
newyou.at
-
harpershologram.wordpress.com
-
aco-media.nl
-
monark.com
-
rostoncastings.co.uk
-
coding-machine.com
-
danskretursystem.dk
-
cyntox.com
-
durganews.com
-
myzk.site
-
tomaso.gr
-
milltimber.aberdeen.sch.uk
-
2ekeus.nl
-
profectis.de
-
frontierweldingllc.com
-
myhostcloud.com
-
penco.ie
-
nsec.se
-
vetapharma.fr
-
promalaga.es
-
drinkseed.com
-
ftlc.es
-
creative-waves.co.uk
-
otsu-bon.com
-
allure-cosmetics.at
-
8449nohate.org
-
ohidesign.com
-
unim.su
-
mountsoul.de
-
beaconhealthsystem.org
-
corelifenutrition.com
-
labobit.it
-
commonground-stories.com
-
micro-automation.de
-
renergysolution.com
-
senson.fi
-
kevinjodea.com
-
bigbaguettes.eu
-
arteservicefabbro.com
-
toponlinecasinosuk.co.uk
-
schutting-info.nl
-
hellohope.com
-
tetinfo.in
-
austinlchurch.com
-
merzi.info
-
brawnmediany.com
-
huesges-gruppe.de
-
lbcframingelectrical.com
-
alten-mebel63.ru
-
ianaswanson.com
-
forestlakeuca.org.au
-
atozdistribution.co.uk
-
alvinschwartz.wordpress.com
-
mbxvii.com
-
waermetauscher-berechnen.de
-
myteamgenius.com
-
parkcf.nl
-
precisionbevel.com
-
broseller.com
-
henricekupper.com
-
gopackapp.com
-
calabasasdigest.com
-
mymoneyforex.com
-
nosuchthingasgovernment.com
-
upplandsspar.se
-
notmissingout.com
-
evergreen-fishing.com
-
goodgirlrecovery.com
-
you-bysia.com.au
-
ravensnesthomegoods.com
-
maineemploymentlawyerblog.com
-
uimaan.fi
-
hashkasolutindo.com
-
wsoil.com.sg
-
lascuola.nl
-
girlillamarketing.com
-
transportesycementoshidalgo.es
-
nataschawessels.com
-
spargel-kochen.de
-
miriamgrimm.de
-
dpo-as-a-service.com
-
kath-kirche-gera.de
-
rosavalamedahr.com
-
faroairporttransfers.net
-
plantag.de
-
triggi.de
-
opatrovanie-ako.sk
-
fensterbau-ziegler.de
-
wacochamber.com
-
chefdays.de
-
ostheimer.at
-
burkert-ideenreich.de
-
knowledgemuseumbd.com
-
architekturbuero-wagner.net
-
unetica.fr
-
vorotauu.ru
-
vickiegrayimages.com
-
bptdmaluku.com
-
podsosnami.ru
-
parking.netgateway.eu
-
c-a.co.in
-
the-domain-trader.com
-
saka.gr
-
xtptrack.com
-
aunexis.ch
-
botanicinnovations.com
-
tarotdeseidel.com
-
sotsioloogia.ee
-
anybookreader.de
-
krcove-zily.eu
-
lescomtesdemean.be
-
turkcaparbariatrics.com
-
maratonaclubedeportugal.com
-
www1.proresult.no
-
stefanpasch.me
-
the-virtualizer.com
-
havecamerawilltravel2017.wordpress.com
-
hannah-fink.de
-
atmos-show.com
-
tuuliautio.fi
-
nmiec.com
-
galleryartfair.com
-
otto-bollmann.de
-
blog.solutionsarchitect.guru
-
chaotrang.com
-
caffeinternet.it
-
jolly-events.com
-
fotoscondron.com
-
lukeshepley.wordpress.com
-
ladelirante.fr
-
artotelamsterdam.com
-
epwritescom.wordpress.com
-
amylendscrestview.com
-
ussmontanacommittee.us
-
stoeberstuuv.de
-
helikoptervluchtnewyork.nl
-
expandet.dk
-
em-gmbh.ch
-
iwelt.de
-
asteriag.com
-
autodujos.lt
-
brandl-blumen.de
-
esope-formation.fr
-
parks-nuernberg.de
-
qualitaetstag.de
-
daniel-akermann-architektur-und-planung.ch
-
bildungsunderlebnis.haus
-
sla-paris.com
-
lichencafe.com
-
i-trust.dk
-
whittier5k.com
-
streamerzradio1.site
-
whyinterestingly.ru
-
houseofplus.com
-
ontrailsandboulevards.com
-
retroearthstudio.com
-
chrissieperry.com
-
resortmtn.com
-
eadsmurraypugh.com
-
michaelsmeriglioracing.com
-
homecomingstudio.com
-
meusharklinithome.wordpress.com
-
sexandfessenjoon.wordpress.com
-
bargningavesta.se
-
embracinghiscall.com
-
brevitempore.net
-
tandartspraktijkhartjegroningen.nl
-
ccpbroadband.com
-
kindersitze-vergleich.de
-
sojamindbody.com
-
ouryoungminds.wordpress.com
-
foryourhealth.live
-
fiscalsort.com
-
deschl.net
-
cursosgratuitosnainternet.com
-
maureenbreezedancetheater.org
-
real-estate-experts.com
-
kadesignandbuild.co.uk
-
sportiomsportfondsen.nl
-
smessier.com
-
patrickfoundation.net
-
carlosja.com
-
apprendrelaudit.com
-
greenpark.ch
-
buroludo.nl
-
saarland-thermen-resort.com
-
dubnew.com
-
craigmccabe.fun
-
spectrmash.ru
-
mank.de
-
highlinesouthasc.com
-
mindpackstudios.com
-
stopilhan.com
-
licor43.de
-
luxurytv.jp
-
serce.info.pl
-
baptisttabernacle.com
-
torgbodenbollnas.se
-
mirjamholleman.nl
-
manijaipur.com
-
schmalhorst.de
-
stormwall.se
-
entopic.com
-
katketytaanet.fi
-
hebkft.hu
-
micahkoleoso.de
-
brigitte-erler.com
-
projetlyonturin.fr
-
schoellhammer.com
-
bierensgebakkramen.nl
-
enovos.de
-
polymedia.dk
-
assurancesalextrespaille.fr
-
zewatchers.com
-
izzi360.com
-
miraclediet.fun
-
dontpassthepepper.com
-
rozemondcoaching.nl
-
smithmediastrategies.com
-
tastewilliamsburg.com
-
comparatif-lave-linge.fr
-
drfoyle.com
-
huehnerauge-entfernen.de
-
zzyjtsgls.com
-
smhydro.com.pl
-
faizanullah.com
-
backstreetpub.com
-
wien-mitte.co.at
-
portoesdofarrobo.com
-
lange.host
-
intecwi.com
-
danholzmann.com
-
antonmack.de
-
imaginado.de
-
pmcimpact.com
-
tsklogistik.eu
-
mrsplans.net
-
romeguidedvisit.com
-
igorbarbosa.com
-
pridoxmaterieel.nl
-
todocaracoles.com
-
bockamp.com
-
victoriousfestival.co.uk
-
kmbshipping.co.uk
-
geisterradler.de
-
dareckleyministries.com
-
d2marketing.co.uk
-
videomarketing.pro
-
wolf-glas-und-kunst.de
-
mdk-mediadesign.de
-
heliomotion.com
-
loprus.pl
-
bouncingbonanza.com
-
sofavietxinh.com
-
denifl-consulting.at
-
delchacay.com.ar
-
simulatebrain.com
-
crowd-patch.co.uk
-
lillegrandpalais.com
-
dubscollective.com
-
theadventureedge.com
-
levdittliv.se
-
first-2-aid-u.com
-
coffreo.biz
-
softsproductkey.com
-
advizewealth.com
-
caribbeansunpoker.com
-
mytechnoway.com
-
bowengroup.com.au
-
thailandholic.com
-
neuschelectrical.co.za
-
gasbarre.com
-
ungsvenskarna.se
-
richard-felix.co.uk
-
carolinepenn.com
-
evangelische-pfarrgemeinde-tuniberg.de
-
dezatec.es
-
123vrachi.ru
-
lecantou-coworking.com
-
controldekk.com
-
garage-lecompte-rouen.fr
-
cityorchardhtx.com
-
liliesandbeauties.org
-
thefixhut.com
-
lapinlviasennus.fi
-
smalltownideamill.wordpress.com
-
jacquin-maquettes.com
-
cirugiauretra.es
-
associationanalytics.com
-
delawarecorporatelaw.com
-
crediacces.com
-
rimborsobancario.net
-
oldschoolfun.net
-
cerebralforce.net
-
pier40forall.org
-
centromarysalud.com
-
zervicethai.co.th
-
4net.guru
-
darnallwellbeing.org.uk
-
jasonbaileystudio.com
-
peterstrobos.com
-
tenacitytenfold.com
-
bodyforwife.com
-
launchhubl.com
-
xn--fn-kka.no
-
kedak.de
-
sanaia.com
-
interactcenter.org
-
naswrrg.org
-
gadgetedges.com
-
diversiapsicologia.es
-
petnest.ir
-
selfoutlet.com
-
slimani.net
-
greenko.pl
-
daklesa.de
-
fundaciongregal.org
-
allamatberedare.se
-
dutchcoder.nl
-
slashdb.com
-
pasivect.co.uk
-
boosthybrid.com.au
-
jenniferandersonwriter.com
-
justinvieira.com
-
mrtour.site
-
nokesvilledentistry.com
-
alysonhoward.com
-
marathonerpaolo.com
-
mediaplayertest.net
-
verifort-capital.de
-
urclan.net
-
boisehosting.net
-
bafuncs.org
-
filmvideoweb.com
-
webhostingsrbija.rs
-
bradynursery.com
-
fransespiegels.nl
-
besttechie.com
-
rieed.de
-
bouquet-de-roses.com
-
vihannesporssi.fi
-
waynela.com
-
kirkepartner.dk
-
supportsumba.nl
-
liikelataamo.fi
-
hotelzentral.at
-
extensionmaison.info
-
asgestion.com
-
promesapuertorico.com
-
onlyresultsmarketing.com
-
hhcourier.com
-
pocket-opera.de
-
shonacox.com
-
simpliza.com
-
gporf.fr
-
zenderthelender.com
-
hairnetty.wordpress.com
-
mezhdu-delom.ru
-
leeuwardenstudentcity.nl
-
verbisonline.com
-
bee4win.com
-
irishmachineryauctions.com
-
y-archive.com
-
flexicloud.hk
-
nijaplay.com
-
mercantedifiori.com
-
gamesboard.info
-
withahmed.com
-
smale-opticiens.nl
-
johnsonfamilyfarmblog.wordpress.com
-
cnoia.org
-
exenberger.at
-
trapiantofue.it
-
grelot-home.com
-
dramagickcom.wordpress.com
-
physiofischer.de
-
insidegarage.pl
-
yassir.pro
-
digivod.de
-
porno-gringo.com
-
abogadosaccidentetraficosevilla.es
-
suncrestcabinets.ca
-
homng.net
-
castillobalduz.es
-
centrospgolega.com
-
ausair.com.au
-
logopaedie-blomberg.de
-
helenekowalsky.com
-
plv.media
-
bunburyfreightservices.com.au
-
maryloutaylor.com
-
milsing.hr
-
blossombeyond50.com
-
bouldercafe-wuppertal.de
-
ampisolabergeggi.it
-
bridgeloanslenders.com
-
insigniapmg.com
-
shadebarandgrillorlando.com
-
beautychance.se
-
x-ray.ca
-
jorgobe.at
-
parkstreetauto.net
-
cimanchesterescorts.co.uk
-
finediningweek.pl
-
marchand-sloboda.com
-
tanzschule-kieber.de
-
ilcdover.com
-
fitnessbazaar.com
-
hrabritelefon.hr
-
spinheal.ru
-
minipara.com
-
joyeriaorindia.com
-
hkr-reise.de
-
skiltogprint.no
-
onlybacklink.com
-
teresianmedia.org
-
despedidascostablanca.es
-
elpa.se
-
drnice.de
-
jakekozmor.com
-
jadwalbolanet.info
-
ilive.lt
-
gmto.fr
-
fitnessingbyjessica.com
-
zweerscreatives.nl
-
n1-headache.com
-
transliminaltribe.wordpress.com
-
kao.at
-
webmaster-peloton.com
-
dsl-ip.de
-
scenepublique.net
-
milestoneshows.com
-
danielblum.info
-
freie-baugutachterpraxis.de
-
deltacleta.cat
-
cranleighscoutgroup.org
-
accountancywijchen.nl
-
acomprarseguidores.com
-
sinal.org
-
seitzdruck.com
-
mepavex.nl
-
binder-buerotechnik.at
-
coastalbridgeadvisors.com
-
extraordinaryoutdoors.com
-
oneplusresource.org
-
ecopro-kanto.com
-
denovofoodsgroup.com
-
truenyc.co
-
pv-design.de
-
iwr.nl
-
theshungiteexperience.com.au
-
nestor-swiss.ch
-
strandcampingdoonbeg.com
-
fatfreezingmachines.com
-
hypozentrum.com
-
wmiadmin.com
-
slwgs.org
-
vietlawconsultancy.com
-
polzine.net
-
tomoiyuma.com
-
makeitcount.at
-
kaminscy.com
-
navyfederalautooverseas.com
-
commercialboatbuilding.com
-
instatron.net
-
karacaoglu.nl
-
lloydconstruction.com
-
aminaboutique247.com
-
craigvalentineacademy.com
-
testcoreprohealthuk.com
-
fotoideaymedia.es
-
evologic-technologies.com
-
bxdf.info
-
leather-factory.co.jp
-
carriagehousesalonvt.com
-
littlebird.salon
-
saxtec.com
-
kamahouse.net
-
beyondmarcomdotcom.wordpress.com
-
imadarchid.com
-
finde-deine-marke.de
-
dr-pipi.de
-
wraithco.com
-
aglend.com.au
-
gastsicht.de
-
i-arslan.de
-
pawsuppetlovers.com
-
tigsltd.com
-
zimmerei-fl.de
-
familypark40.com
-
smart-light.co.uk
-
revezlimage.com
-
bogdanpeptine.ro
-
oneheartwarriors.at
-
kosterra.com
-
slimidealherbal.com
-
adultgamezone.com
-
baustb.de
-
ra-staudte.de
-
roadwarrior.app
-
panelsandwichmadrid.es
-
kostenlose-webcams.com
-
lenreactiv-shop.ru
-
apolomarcas.com
-
vyhino-zhulebino-24.ru
-
pointos.com
-
ventti.com.ar
-
idemblogs.com
-
operaslovakia.sk
-
bastutunnan.se
-
pubweb.carnet.hr
-
macabaneaupaysflechois.com
-
kojima-shihou.com
-
harveybp.com
-
fizzl.ru
-
midmohandyman.com
-
xn--rumung-bua.online
-
teknoz.net
-
boulderwelt-muenchen-west.de
-
waywithwords.net
-
mastertechengineering.com
-
mapawood.com
-
nakupunafoundation.org
-
americafirstcommittee.org
-
nachhilfe-unterricht.com
-
sanyue119.com
-
herbayupro.com
-
effortlesspromo.com
-
smogathon.com
-
katiekerr.co.uk
-
directwindowco.com
-
huissier-creteil.com
-
ai-spt.jp
-
greenfieldoptimaldentalcare.com
-
liveottelut.com
-
highimpactoutdoors.net
-
theduke.de
-
sportverein-tambach.de
-
kafu.ch
-
deoudedorpskernnoordwijk.nl
-
stacyloeb.com
-
presseclub-magdeburg.de
-
olejack.ru
-
twohourswithlena.wordpress.com
-
figura.team
-
tradiematepro.com.au
-
leoben.at
-
xn--fnsterputssollentuna-39b.se
-
coding-marking.com
-
sterlingessay.com
-
kojinsaisei.info
-
biapi-coaching.fr
-
charlottepoudroux-photographie.fr
-
poultrypartners.nl
-
echtveilig.nl
-
global-kids.info
-
stampagrafica.es
-
sarbatkhalsafoundation.org
-
pmc-services.de
-
pomodori-pizzeria.de
-
ivfminiua.com
-
pasvenska.se
-
degroenetunnel.com
-
securityfmm.com
-
winrace.no
-
importardechina.info
-
edgewoodestates.org
-
new.devon.gov.uk
-
nancy-informatique.fr
-
proudground.org
-
siliconbeach-realestate.com
-
philippedebroca.com
-
corola.es
-
walter-lemm.de
-
blogdecachorros.com
-
devlaur.com
-
ulyssemarketing.com
-
luckypatcher-apkz.com
-
hairstylesnow.site
-
zimmerei-deboer.de
-
mrxermon.de
-
ivivo.es
-
abuelos.com
-
fannmedias.com
-
ctrler.cn
-
alfa-stroy72.com
-
gemeentehetkompas.nl
-
quizzingbee.com
-
spacecitysisters.org
-
officehymy.com
-
kuntokeskusrok.fi
-
summitmarketingstrategies.com
-
corona-handles.com
-
maasreusel.nl
-
bbsmobler.se
-
hugoversichert.de
-
balticdentists.com
-
simoneblum.de
-
gw2guilds.org
-
humanityplus.org
-
plotlinecreative.com
-
tennisclubetten.nl
-
ncid.bc.ca
-
partnertaxi.sk
-
asiluxury.com
-
strategicstatements.com
-
judithjansen.com
-
woodworkersolution.com
-
classycurtainsltd.co.uk
-
simplyblessedbykeepingitreal.com
-
actecfoundation.org
-
jandaonline.com
-
lusak.at
-
advokathuset.dk
-
noixdecocom.fr
-
fairfriends18.de
-
koko-nora.dk
-
love30-chanko.com
-
layrshift.eu
-
kunze-immobilien.de
-
happyeasterimages.org
-
ruralarcoiris.com
-
jusibe.com
-
kaotikkustomz.com
-
innote.fi
-
symphonyenvironmental.com
-
craftleathermnl.com
-
vdberg-autoimport.nl
-
kikedeoliveira.com
-
365questions.org
-
connectedace.com
-
thomas-hospital.de
-
educar.org
-
vox-surveys.com
-
jsfg.com
-
abogadoengijon.es
-
bestbet.com
-
shiresresidential.com
-
space.ua
-
abl1.net
-
gasolspecialisten.se
-
coursio.com
-
sporthamper.com
-
nhadatcanho247.com
-
lightair.com
-
dirittosanitario.biz
-
mmgdouai.fr
-
xn--vrftet-pua.biz
-
eglectonk.online
-
themadbotter.com
-
antiaginghealthbenefits.com
-
bloggyboulga.net
-
jobcenterkenya.com
-
paradicepacks.com
-
yourobgyn.net
-
bigasgrup.com
-
qualitus.com
-
synlab.lt
-
latribuessentielle.com
-
icpcnj.org
-
heidelbergartstudio.gallery
-
notsilentmd.org
-
urist-bogatyr.ru
-
executiveairllc.com
-
sweering.fr
-
montrium.com
-
edrcreditservices.nl
-
campusoutreach.org
-
cleliaekiko.online
-
vitavia.lt
-
malychanieruchomoscipremium.com
-
humancondition.com
-
cortec-neuro.com
-
tecnojobsnet.com
-
stoneys.ch
-
eraorastudio.com
-
bhwlawfirm.com
-
irinaverwer.com
-
remcakram.com
-
manutouchmassage.com
-
spsshomeworkhelp.com
-
psa-sec.de
-
ausbeverage.com.au
-
euro-trend.pl
-
thomasvicino.com
-
gratispresent.se
-
oslomf.no
-
healthyyworkout.com
-
abogados-en-alicante.es
-
celularity.com
-
rebeccarisher.com
-
werkkring.nl
-
forskolorna.org
-
calxplus.eu
-
outcomeisincome.com
-
ilso.net
-
almosthomedogrescue.dog
-
globedivers.wordpress.com
-
tandartspraktijkheesch.nl
-
blumenhof-wegleitner.at
-
plastidip.com.ar
-
rocketccw.com
-
kamienny-dywan24.pl
-
tampaallen.com
-
vermoote.de
-
oncarrot.com
-
villa-marrakesch.de
-
psc.de
-
dr-seleznev.com
-
modamilyon.com
-
35-40konkatsu.net
-
id-et-d.fr
-
talentwunder.com
-
mooshine.com
-
nurturingwisdom.com
-
basisschooldezonnewijzer.nl
-
norpol-yachting.com
-
koken-voor-baby.nl
-
roygolden.com
-
people-biz.com
-
sipstroysochi.ru
-
ceres.org.au
-
rollingrockcolumbia.com
-
elimchan.com
-
sabel-bf.com
-
ki-lowroermond.nl
-
readberserk.com
-
trulynolen.co.uk
-
ligiercenter-sachsen.de
-
noesis.tech
-
stallbyggen.se
-
handi-jack-llc.com
-
microcirc.net
-
femxarxa.cat
-
jerling.de
-
radaradvies.nl
-
hokagestore.com
-
mylolis.com
-
skanah.com
-
autopfand24.de
-
markelbroch.com
-
planchaavapor.net
-
aurum-juweliere.de
-
atalent.fi
-
dinslips.se
-
ogdenvision.com
-
antenanavi.com
-
andersongilmour.co.uk
-
conexa4papers.trade
-
visiativ-industry.fr
-
levihotelspa.fi
-
paymybill.guru
-
restaurantesszimmer.de
-
stupbratt.no
-
thaysa.com
-
ikads.org
-
mdacares.com
-
pelorus.group
-
mousepad-direkt.de
-
wari.com.pe
-
smokeysstoves.com
-
nicoleaeschbachorg.wordpress.com
-
xoabigail.com
-
praxis-management-plus.de
-
xn--logopdie-leverkusen-kwb.de
-
haremnick.com
-
carrybrands.nl
-
sagadc.com
-
101gowrie.com
-
centuryrs.com
-
ino-professional.ru
-
krlosdavid.com
-
rehabilitationcentersinhouston.net
-
associacioesportivapolitg.cat
-
autofolierung-lu.de
-
bingonearme.org
-
tinkoff-mobayl.ru
-
mir-na-iznanku.com
-
sw1m.ru
-
platformier.com
-
mylovelybluesky.com
-
conasmanagement.de
-
caribdoctor.org
-
shhealthlaw.com
-
kampotpepper.gives
-
bimnapratica.com
-
schlafsack-test.net
-
dekkinngay.com
-
lefumetdesdombes.com
-
mooglee.com
-
ateliergamila.com
-
smartypractice.com
-
paulisdogshop.de
-
citymax-cr.com
-
milanonotai.it
-
songunceliptv.com
-
surespark.org.uk
-
mrsfieldskc.com
-
htchorst.nl
-
piajeppesen.dk
-
naturalrapids.com
-
fayrecreations.com
-
lynsayshepherd.co.uk
-
sahalstore.com
-
gonzalezfornes.es
-
pogypneu.sk
-
pivoineetc.fr
-
puertamatic.es
-
completeweddingkansas.com
-
bordercollie-nim.nl
-
gaiam.nl
-
fibrofolliculoma.info
-
hushavefritid.dk
-
hotelsolbh.com.br
-
qlog.de
-
thewellnessmimi.com
-
hvccfloorcare.com
-
rota-installations.co.uk
-
mooreslawngarden.com
-
lucidinvestbank.com
-
groupe-frayssinet.fr
-
iyengaryogacharlotte.com
-
ftf.or.at
-
solerluethi-allart.ch
-
amerikansktgodis.se
-
limassoldriving.com
-
myhealth.net.au
-
memaag.com
-
iyahayki.nl
-
cuppacap.com
-
oemands.dk
-
lapinvihreat.fi
-
kidbucketlist.com.au
-
heurigen-bauer.at
-
1team.es
-
behavioralmedicinespecialists.com
-
creamery201.com
-
hiddencitysecrets.com.au
-
syndikat-asphaltfieber.de
-
appsformacpc.com
-
itelagen.com
-
joseconstela.com
-
veybachcenter.de
-
noskierrenteria.com
-
lykkeliv.net
-
makeurvoiceheard.com
-
csgospeltips.se
-
theapifactory.com
-
rumahminangberdaya.com
-
newstap.com.ng
-
lorenacarnero.com
-
musictreehouse.net
-
DupontSellsHomes.com
-
upmrkt.co
-
dw-css.de
-
aodaichandung.com
-
nativeformulas.com
-
dnepr-beskid.com.ua
-
steampluscarpetandfloors.com
-
1kbk.com.ua
-
ecpmedia.vn
-
lmtprovisions.com
-
homesdollar.com
-
argos.wityu.fund
-
naturavetal.hr
-
celeclub.org
-
ziegler-praezisionsteile.de
-
insp.bi
-
geekwork.pl
-
marketingsulweb.com
-
tulsawaterheaterinstallation.com
-
waveneyrivercentre.co.uk
-
norovirus-ratgeber.de
-
travelffeine.com
-
takeflat.com
-
funjose.org.gt
-
anteniti.com
-
colorofhorses.com
-
higadograsoweb.com
-
jiloc.com
-
hatech.io
-
pinkexcel.com
-
vibethink.net
-
catholicmusicfest.com
-
answerstest.ru
-
iphoneszervizbudapest.hu
-
bargningharnosand.se
-
julis-lsa.de
-
morawe-krueger.de
-
cuspdental.com
-
igfap.com
-
jvanvlietdichter.nl
-
spd-ehningen.de
-
longislandelderlaw.com
-
aselbermachen.com
-
sairaku.net
-
firstpaymentservices.com
-
lionware.de
-
vanswigchemdesign.com
-
dlc.berlin
-
baumkuchenexpo.jp
-
gantungankunciakrilikbandung.com
-
compliancesolutionsstrategies.com
-
slupetzky.at
-
refluxreducer.com
-
yousay.site
-
tux-espacios.com
-
latestmodsapks.com
-
perbudget.com
-
eaglemeetstiger.de
-
iviaggisonciliegie.it
-
cafemattmeera.com
-
darrenkeslerministries.com
-
seminoc.com
-
urmasiimariiuniri.ro
-
team-montage.dk
-
bookspeopleplaces.com
-
pixelarttees.com
-
run4study.com
-
blgr.be
-
augenta.com
-
kissit.ca
-
body-armour.online
-
shsthepapercut.com
-
pt-arnold.de
-
journeybacktolife.com
-
mardenherefordshire-pc.gov.uk
-
boompinoy.com
-
westdeptfordbuyrite.com
-
alhashem.net
-
ncuccr.org
-
buymedical.biz
-
rushhourappliances.com
-
xn--thucmctc-13a1357egba.com
-
hihaho.com
-
chandlerpd.com
-
groupe-cets.com
-
tanciu.com
-
siluet-decor.ru
-
thee.network
-
charlesreger.com
-
body-guards.it
-
psnacademy.in
-
kaliber.co.jp
-
campus2day.de
-
osterberg.fi
-
teczowadolina.bytom.pl
-
yamalevents.com
-
deko4you.at
-
socialonemedia.com
-
spylista.com
-
ledmes.ru
-
blacksirius.de
-
stingraybeach.com
-
mikeramirezcpa.com
-
id-vet.com
-
jobmap.at
-
comarenterprises.com
-
d1franchise.com
-
bricotienda.com
-
tips.technology
-
xlarge.at
-
courteney-cox.net
-
mountaintoptinyhomes.com
-
devstyle.org
-
thedresserie.com
-
aprepol.com
-
imperfectstore.com
-
birnam-wood.com
-
aniblinova.wordpress.com
-
ecoledansemulhouse.fr
-
corendonhotels.com
-
copystar.co.uk
-
walkingdeadnj.com
-
fax-payday-loans.com
-
allfortheloveofyou.com
-
mediaclan.info
-
haar-spange.com
-
grupocarvalhoerodrigues.com.br
-
blewback.com
-
reddysbakery.com
-
zso-mannheim.de
-
argenblogs.com.ar
-
stemenstilte.nl
-
herbstfeststaefa.ch
-
foretprivee.ca
-
artige.com
-
sandd.nl
-
allentownpapershow.com
-
muamuadolls.com
-
parebrise-tla.fr
-
ora-it.de
-
artallnightdc.com
-
uranus.nl
-
kariokids.com
-
tongdaifpthaiphong.net
-
airconditioning-waalwijk.nl
-
erstatningsadvokaterne.dk
-
crowcanyon.com
-
dutchbrewingcoffee.com
-
kingfamily.construction
-
stemplusacademy.com
-
mariposapropaneaz.com
-
321play.com.hk
-
manifestinglab.com
-
aarvorg.com
-
narcert.com
-
wychowanieprzedszkolne.pl
-
nuzech.com
-
pcprofessor.com
-
polychromelabs.com
-
iqbalscientific.com
-
tstaffing.nl
-
juneauopioidworkgroup.org
-
seagatesthreecharters.com
-
deepsouthclothingcompany.com
-
glennroberts.co.nz
-
theletter.company
-
seevilla-dr-sturm.at
-
zieglerbrothers.de
-
christinarebuffetcourses.com
-
dr-tremel-rednitzhembach.de
-
tonelektro.nl
-
schoolofpassivewealth.com
-
berliner-versicherungsvergleich.de
-
pferdebiester.de
-
falcou.fr
-
net
false
-
pid
$2a$10$Tphwr9LlSOB8K3/pTVWV7eKmKHrXDvdOolDJayLa5.SJ.jyMLYUL2
-
prc
steam
sqbcoreservice
ocssd
tbirdconfig
thebat
ocomm
excel
ocautoupds
wordpad
firefox
powerpnt
mydesktopservice
msaccess
dbeng50
agntsvc
dbsnmp
outlook
oracle
synctime
winword
encsvc
onenote
infopath
mydesktopqos
xfssvccon
isqlplussvc
sql
thunderbird
visio
mspub
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3144
-
svc
mepocs
veeam
memtas
backup
vss
sql
sophos
svc$
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\LimitGrant.tiff => \??\c:\users\admin\pictures\LimitGrant.tiff.q4w0ial5 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File renamed C:\Users\Admin\Pictures\RevokeSwitch.png => \??\c:\users\admin\pictures\RevokeSwitch.png.q4w0ial5 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File renamed C:\Users\Admin\Pictures\SuspendSubmit.png => \??\c:\users\admin\pictures\SuspendSubmit.png.q4w0ial5 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File renamed C:\Users\Admin\Pictures\ConvertInitialize.crw => \??\c:\users\admin\pictures\ConvertInitialize.crw.q4w0ial5 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\users\admin\pictures\InitializeProtect.tiff d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\users\admin\pictures\LimitGrant.tiff d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File renamed C:\Users\Admin\Pictures\InitializeProtect.tiff => \??\c:\users\admin\pictures\InitializeProtect.tiff.q4w0ial5 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\k51299BQXH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe" d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\W: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\E: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\P: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\L: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\N: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\O: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\S: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\V: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\Y: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\B: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\G: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\I: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\J: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\M: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\X: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\Z: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\D: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\A: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\F: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\Q: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\T: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\U: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\H: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened (read-only) \??\K: d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe - Drops file in Program Files directory 28 IoCs
description ioc Process File opened for modification \??\c:\program files\ConvertToRestart.svg d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\UndoFormat.mpg d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\EnterSkip.TTS d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\GetUpdate.pps d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\PushFormat.3g2 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\UseRestore.otf d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File created \??\c:\program files\q4w0ial5-readme.txt d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\CheckpointConvertFrom.vsdm d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\NewRepair.rm d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\RedoSync.DVR d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File created \??\c:\program files (x86)\q4w0ial5-readme.txt d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\BackupPush.m1v d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\GetRequest.wax d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\OutResume.xps d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\CompleteSelect.ini d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\ProtectOut.MTS d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\ResolveDisconnect.asf d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\SubmitBlock.clr d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\UnlockBlock.jpe d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\CheckpointConfirm.easmx d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\OutSubmit.htm d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\RegisterUndo.emf d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\BackupCopy.xls d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\PingDebug.mpp d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\PushRevoke.mp3 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\CheckpointResume.mht d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\ConvertRevoke.xml d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe File opened for modification \??\c:\program files\RestartWatch.wav d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1516 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe 1516 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe 1360 powershell.exe 1360 powershell.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1516 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe Token: SeDebugPrivilege 1360 powershell.exe Token: SeBackupPrivilege 1428 vssvc.exe Token: SeRestorePrivilege 1428 vssvc.exe Token: SeAuditPrivilege 1428 vssvc.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1516 wrote to memory of 1360 1516 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe 82 PID 1516 wrote to memory of 1360 1516 d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe"C:\Users\Admin\AppData\Local\Temp\d143a3dcb1dff1b89dca9f49bd4848d7e6e4a5e08080c46e33f87e458958c7af.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:536
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428