Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2023 20:33
Behavioral task
behavioral1
Sample
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe
Resource
win10v2004-20230220-en
General
-
Target
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe
-
Size
391KB
-
MD5
6c68d36f1992d3fdf656df111c93790a
-
SHA1
c2a0733beaf1e38cf38a0a832f917587be271e1b
-
SHA256
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85
-
SHA512
0361803bae998eac72191cff678e68f0746013e80dd94198fceb774037df5961b3409bb08cd41bdffb9884a87697127a8a15caab0dcf24523119546f8273cf8f
-
SSDEEP
12288:9Y0NvuU8qt3H12h1VSju2U1jEpnL6dmouQ7pKnPzOHh2hF0:9fNvGqt3VA1VSju2U1jEVL6dmouQ7pKU
Malware Config
Extracted
C:\Recovery\ffbg047b-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AC4DC1B8D54430DC
http://decryptor.top/AC4DC1B8D54430DC
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exedescription ioc process File renamed C:\Users\Admin\Pictures\RegisterAdd.raw => \??\c:\users\admin\pictures\RegisterAdd.raw.ffbg047b 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File renamed C:\Users\Admin\Pictures\StartTest.tif => \??\c:\users\admin\pictures\StartTest.tif.ffbg047b 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File renamed C:\Users\Admin\Pictures\UnprotectAssert.raw => \??\c:\users\admin\pictures\UnprotectAssert.raw.ffbg047b 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File renamed C:\Users\Admin\Pictures\SuspendDisconnect.tiff => \??\c:\users\admin\pictures\SuspendDisconnect.tiff.ffbg047b 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\users\admin\pictures\SuspendDisconnect.tiff 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File renamed C:\Users\Admin\Pictures\ExportRepair.tif => \??\c:\users\admin\pictures\ExportRepair.tif.ffbg047b 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File renamed C:\Users\Admin\Pictures\ProtectMove.tif => \??\c:\users\admin\pictures\ProtectMove.tif.ffbg047b 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exedescription ioc process File opened (read-only) \??\K: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\O: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\W: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\Y: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\Z: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\A: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\F: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\X: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\D: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\S: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\T: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\R: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\V: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\J: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\N: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\G: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\H: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\I: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\L: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\M: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\P: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\B: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\E: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\Q: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened (read-only) \??\U: 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0c9y.bmp" 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe -
Drops file in Program Files directory 32 IoCs
Processes:
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exedescription ioc process File opened for modification \??\c:\program files\MountDisconnect.odt 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\CompleteRegister.asf 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\EnterClose.mpeg 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\GrantOpen.wmf 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\ReadExpand.rtf 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\TraceAssert.kix 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\CopyBackup.xlt 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\EnterComplete.xlt 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\OpenProtect.tif 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\ResumePing.M2T 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\RevokeSuspend.mp2 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\ConvertToRedo.mpeg 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\SaveMerge.temp 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\GetExport.gif 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\RenamePublish.wpl 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\SaveInitialize.sql 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\StepUpdate.wmv 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\GetReceive.mpeg2 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\OptimizeExit.zip 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\RedoRegister.dxf 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\ResumeResize.mpeg 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\WatchComplete.mpe 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File created \??\c:\program files\ffbg047b-readme.txt 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File created \??\c:\program files (x86)\ffbg047b-readme.txt 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\FindResolve.wax 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\RepairOptimize.vsx 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\RestoreResume.docx 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\StartSync.scf 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\UnregisterLock.pdf 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\WaitRedo.m4a 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\ResizeCheckpoint.wmf 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification \??\c:\program files\SendInvoke.DVR-MS 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe -
Drops file in Windows directory 64 IoCs
Processes:
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca714bf2ded4fd68.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-f..e-microsoftjhenghei_31bf3856ad364e35_10.0.19041.1_none_1b31c6067f7278ae.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-themeservice.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b9dc2e5385069c21.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-pshed_31bf3856ad364e35_10.0.19041.1_none_1c389b2600d2d78a_pshed.dll_f6ac239e 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wintrust-dll_31bf3856ad364e35_10.0.19041.1266_none_6ec8b79d83a2fd27.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.19041.1_it-it_09805d42c133e875.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..wmanager-compositor_31bf3856ad364e35_10.0.19041.1288_none_7a49f980f48daa96_dwmcore.dll.mun_ebf60d69 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.19041.1_none_b3552a6f4dc424b4_vga950.fon_09ed4d3d 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_10.0.19041.1_it-it_54f491d86409b07e_clfs.sys.mui_1310ba12 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.19041.1_none_b3552a6f4dc424b4_85775.fon_f144fe91 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase-raspppoe_31bf3856ad364e35_10.0.19041.1_none_0c2491a439f55f8f_raspppoe.sys_5bc9d88d 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.1_zh-tw_6095a555e2b0a5f9.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directory-services-sam_31bf3856ad364e35_10.0.19041.1202_none_26ae8647562ae5ff_samlib.dll_caeebf04 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-eventlog.resources_31bf3856ad364e35_10.0.19041.1_it-it_e0a2a6402a577815.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.19041.1_en-us_7725a91f1043b62d_gpapi.dll.mui_ef0a9748 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b68b71ac47f7eb2c_rasdiag.dll.mui_15cb4ec4 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_412ceba6e304397c_fidocredprov.dll.mui_4ca89266 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_nl-nl_25e65642b37198d7.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-efs-service.resources_31bf3856ad364e35_10.0.19041.1_de-de_59e3467cfd510b4b.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.19041.1202_none_087e122b0b81e049_kernel32.dll_ef9eca7e 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-kernelstreaming_31bf3856ad364e35_10.0.19041.630_none_357ed96df4b0aef0_ks.sys_f36cc2f7 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ui-xaml-maps_31bf3856ad364e35_10.0.19041.1023_none_0c25639b7f425481_windows.ui.xaml.maps.dll_b092594a 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.19041.1_es-es_6871eca24b40d9a0_iscsidsc.dll.mui_6acb64a6 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_et-ee_c4ec55767757de0d.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1023_zh-cn_366af5414c89230b_comctl32.dll.mui_0da4e682 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_pt-pt_6f586ad4968d0a4b.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.19041.1_es-es_6e3c2686dd2d1656_wintypes.dll.mui_36d5f25a 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.1_da-dk_56f6925d0d698f18.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-r..intmapper.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_cf5a1f9c5633f046_rpcepmap.dll.mui_349798e1 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_sr-..-rs_06d2e219c8bbb7bf.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-usermodepowerservice_31bf3856ad364e35_10.0.19041.1023_none_d2e23d980197bef4.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4fc41e05a1187ab0.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directui-resourcesrs3_31bf3856ad364e35_10.0.19041.1_none_11f4e387011f6d3e.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fa84bcd97ed5458c_vdsutil.dll.mui_0caf9b0e 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-atlthunk_31bf3856ad364e35_10.0.19041.546_none_6bdfd34f2fed1b54_atlthunk.dll_61ada5ff 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_10.0.19041.1_es-es_5a4ff6b3276fd74f_volmgrx.sys.mui_b0c205d7 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-oleacc_31bf3856ad364e35_10.0.19041.746_none_487e089a81330048_oleacc.dll_2f3fa5bf 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.19041.1_it-it_0e251c9b0ecf65ad_gpapi.dll.mui_ef0a9748 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-userpowermanagement_31bf3856ad364e35_10.0.19041.546_none_8b678fb390086be3.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c68aa74741937c24_dsregtask.dll.mui_5e1b9353 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_sk-sk_b39d4963b949fdaa_comctl32.dll.mui_0da4e682 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.19041.1_none_3500efd1cdfd0fad_vgafixr.fon_de339586 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.19041.1_it-it_09cd7363afc7ebfa_rasauto.dll.mui_12fa2c50 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.1_none_3451e3c68828f3da.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.19041.746_none_e5e33ba764e4ddec_bridgeres.dll_55e40455 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.19041.1_it-it_09cd7363afc7ebfa.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.19041.610_none_5aca84205a90fe5e_nsi.dll_e72df756 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_de-de_ec1c7017ac88fbdd_mofcomp.exe.mui_35badf56 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.19041.1_none_b3552a6f4dc424b4_vga850.fon_09ec4cfe 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.19041.746_none_ebd9b2add93e89de_rasctrnm.h_17610c72 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.19041.1_it-it_bddceaf325c3cfd0_iprtrmgr.dll.mui_eb023b92 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.19041.1_it-it_0ede500636ac729d_netiougc.exe.mui_ad7a9e4d 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..onal-keyboard-kbdus_31bf3856ad364e35_10.0.19041.1_none_34a329b3b3f01d7b.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_pl-pl_1256afb9f5d1a29a_comctl32.dll.mui_0da4e682 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da_rasadhlp.dll_7438be63 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..geservice.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c859c559627601c9_storagehealth.adml_00c6b7b3 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-spp.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_81894ccc937e212a_sppsvc.exe.mui_40875a72 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_de-de_e1c7c5c5782839e2_mofd.dll.mui_793ef98d 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1023_fr-fr_31ba26df43e427fa_comctl32.dll.mui_0da4e682 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_ja-jp_41deac1044ed383f.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_da-dk_8eac972b9796148b.manifest 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_nl-nl_edd4f3bf115270f1_bootmgr.efi.mui_be5d0075 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exepid process 2848 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe 2848 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exedescription pid process target process PID 2848 wrote to memory of 3032 2848 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe cmd.exe PID 2848 wrote to memory of 3032 2848 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe cmd.exe PID 2848 wrote to memory of 3032 2848 5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe"C:\Users\Admin\AppData\Local\Temp\5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Recovery\ffbg047b-readme.txtFilesize
6KB
MD5ee6ecc72180a8022ca5a01177bbcd315
SHA18adec4be6fbe2a6b3eec327001fcb62517dc07aa
SHA256753f957a5195ec4048cb86314308d7a0e3b6cb41a4b3b4b99a8dbdf432db5ac2
SHA512ea5d6b7d62c743fad3773013b5bc05c719a7a805d3074e6247da589c9c2ccd08ccb3e4cb1a233efdc494151511cd4fbc802f39e6aa9016a8b2ab5f80f4333a09