Analysis
-
max time kernel
200s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2023 09:08
Behavioral task
behavioral1
Sample
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe
Resource
win10v2004-20230220-en
General
-
Target
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe
-
Size
164KB
-
MD5
890a58f200dfff23165df9e1b088e58f
-
SHA1
74e3d82f7ee81109e150dc41112cf95b3a4b5307
-
SHA256
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93
-
SHA512
2ee3636833cd9b02f5e311401817b15514845d4c12c1416d7e345845f8084775bf8c5f8f32822066b75a6b627a93138a0b27deb99c8bbb1f8d640132a2d8de0d
-
SSDEEP
3072:Hp5SexkWi1Lbi4eTMlwDCnu/q2GB96W/y:JvGWwbnWJ/yB9
Malware Config
Extracted
C:\Recovery\uz4j17yd-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/00463900FAD1460C
http://decryptor.top/00463900FAD1460C
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process File renamed C:\Users\Admin\Pictures\SkipSelect.raw => \??\c:\users\admin\pictures\SkipSelect.raw.uz4j17yd 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File renamed C:\Users\Admin\Pictures\UnblockNew.png => \??\c:\users\admin\pictures\UnblockNew.png.uz4j17yd 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File renamed C:\Users\Admin\Pictures\UninstallRemove.crw => \??\c:\users\admin\pictures\UninstallRemove.crw.uz4j17yd 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process File opened (read-only) \??\F: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\G: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\I: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\K: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\R: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\T: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\X: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\B: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\E: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\N: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\O: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\P: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\V: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\Y: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\Z: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\D: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\A: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\H: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\L: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\Q: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\S: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\U: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\J: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\M: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened (read-only) \??\W: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1lx.bmp" 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Drops file in Program Files directory 15 IoCs
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process File created \??\c:\program files\uz4j17yd-readme.txt 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\EditLimit.rle 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\ProtectSelect.odt 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\ShowMeasure.potx 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File created \??\c:\program files\d60dff40.lock 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\ClearLock.xlt 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\ConvertFromSwitch.xps 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File created \??\c:\program files (x86)\uz4j17yd-readme.txt 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\GroupOptimize.png 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\OpenPublish.3gp2 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\TraceMount.jpeg 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File created \??\c:\program files (x86)\d60dff40.lock 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\CompleteDebug.mpe 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\CopySelect.mpg 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification \??\c:\program files\OpenDebug.ini 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Drops file in Windows directory 64 IoCs
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_10.0.19041.1_en-us_2f8d7570bd2b0d5a_wmpdui.dll.mui_92411657 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-userenv_31bf3856ad364e35_10.0.19041.572_none_7869ead9de8ed48b_userenv.dll_1a3a70b6 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_hr-hr_fbcd913e5fc2ae9a_comctl32.dll.mui_0da4e682 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_6c2a09eceb1bb17b.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.19041.1_none_619a46db072a678a.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_22bf4d8487c0bfe8.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.19041.1_en-us_8f48a1e2598394c7_wiaservc.dll.mui_54051b53 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5ccaaad67089b77a_wuaueng.dll.mui_297f975d 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.1_es-es_fcde5a75fe44e11c.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-imm32_31bf3856ad364e35_10.0.19041.546_none_3a4f6516d93a4779.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.19041.1_de-de_d8897d7855c66c63_gpsvc.dll.mui_0c160ac2 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_da-dk_d337d0871c3caf7b_bootmgr.exe.mui_c434701f 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua-onecore_31bf3856ad364e35_10.0.19041.1266_none_7c78c66cb767e03b_appinfo.dll_6162d887 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.19041.1_en-us_5801e9f68bdc3d85_vdsutil.dll.mui_0caf9b0e 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c3dd8e4758ad0702_wmiutils.dll.mui_42583eaf 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..configurationengine_31bf3856ad364e35_10.0.19041.1_none_796a9b895c58f2c7.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_uk-ua_4f4fad6deb8a668a.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_da-dk_2544c1cd8276af7a_comctl32.dll.mui_0da4e682 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.19041.1_de-de_4d7f6ae091bb017a.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_ko-kr_496934220e812541_memtest.exe.mui_77b8cbcc 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6cf41ed5d1ce056f_samsrv.dll.mui_32250491 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3_dciman32.dll_a41dd515 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.19041.1_en-us_169f2b7caf71b955_listsvc.dll.mui_27f0fc85 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_it-it_21b80f3a6591f527.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c3dd8e4758ad0702_mofd.dll.mui_793ef98d 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_10.0.19041.1_es-es_c81525929a05b49e_clfs.sys.mui_1310ba12 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9_iumcrypt.dll_29ac136d 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1023_uk-ua_a0ca5953ccba1693.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..-configuration-data_31bf3856ad364e35_10.0.19041.546_none_eaba62c4b31f4bbe.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_abf2f270a2e2fdd5_rasautou.exe.mui_55686a97 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_es-es_76fa6c1a5ef15070.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-sechost_31bf3856ad364e35_10.0.19041.1_none_480894b3a0b47f35.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-dui70_31bf3856ad364e35_10.0.19041.746_none_35adfa9d5cea0bbc.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1023_ar-sa_fa97b07c8be89613.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rpc-local_31bf3856ad364e35_10.0.19041.1_none_744056ed18d297d5.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.19041.1_es-es_2c55246d83884e93.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-partitionmanager_31bf3856ad364e35_10.0.19041.1110_none_56683e3b6f9cb252.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.19041.1_none_81a41345d0e50bd5.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-msvcrt_31bf3856ad364e35_10.0.19041.546_none_b9a3277332162a1f.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..erservice.resources_31bf3856ad364e35_10.0.19041.1_de-de_fdc7ae3c4253f807.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.19041.1_en-us_fb569e49a9e4cc22.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.19041.1_none_ca60666860ba12d7_ega80866.fon_608491c0 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_ru-ru_c27553705df60b81.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..geservice.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_54a73aad2cc2f922_storsvc.dll.mui_2fc7b1d3 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_10.0.19041.1_en-us_1fee549ac552b43c_services.exe.mui_86ea5e71 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_4c39b2a1b0c21c01_scdeviceenum.dll.mui_815e7662 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_10.0.19041.1266_none_727d8ac8ed2b3e80.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_de-de_8bd82c67996c6925.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-cng_31bf3856ad364e35_10.0.19041.1202_none_1dab520e105346c7.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_46feaa68fea5a157_consent.exe.mui_2eb3b9db 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.1288_none_91a663c8cc864906.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33_kerbclientshared.dll_1fa7b356 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-netbios_31bf3856ad364e35_10.0.19041.1_none_0fd2c5ae0a7cd53b_netbios.sys_6f23c4df 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_sr-..-rs_06d2e219c8bbb7bf.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore.resources_31bf3856ad364e35_10.0.19041.1081_en-us_ce36a852fdc49a6a_applockercsp.dll.mui_d2a0df70 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.19041.1_en-us_cd341401a09aa4a7_dnsapi.dll.mui_97465f8a 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_nb-no_e0132477454b2a7d.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-oleacc_31bf3856ad364e35_10.0.19041.746_none_487e089a81330048.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..geservice.resources_31bf3856ad364e35_10.0.19041.1_es-es_25a24f5a6fa3eb67_storagesense.adml_0fc60f43 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.19041.1_en-us_8f48a1e2598394c7.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b641f2883587d6aa.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_sv-se_51f6670d7297a2d2_memtest.efi.mui_71e15c22 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.1_fr-ca_980c1abef5ef5da4.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_a35d6ad33b0c3e19.manifest 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exepid process 3592 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe 3592 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exedescription pid process target process PID 3592 wrote to memory of 2904 3592 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe cmd.exe PID 3592 wrote to memory of 2904 3592 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe cmd.exe PID 3592 wrote to memory of 2904 3592 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe"C:\Users\Admin\AppData\Local\Temp\5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Recovery\uz4j17yd-readme.txtFilesize
6KB
MD53f7c7d5d08a2c6622a70ee518dcbf437
SHA159f4412eba61aa9380ee3a797381c4f2cff0030e
SHA2567dbb70ef12f1093d63bdf43575679b96183016b269c8e3189f4f3150be60e8ab
SHA512e93910b82459ded9a98e3ff8ed4398528c731f37d55929a4da460b2aaad52a559c49ce848b5e78c416c942d20065a5a19df886327abd61cdc8a8ffda295c507b