sodinokibi | 337900815fcd44fdafedea82ebebec9454e3eb789d63072add59f812a5983604

General

Target

123.exe
Size

218KB
MD5

06122ab780f95516e52eeadcc5384f64
SHA1

c54c8d31b77deefb6a4e03ecec613b75f75c20ab
SHA256

337900815fcd44fdafedea82ebebec9454e3eb789d63072add59f812a5983604
SHA512

ba9b24857875c751ba05a1139b689ab294ab4f41d03ca871be5648d03da577170be22e6383c42662da4ded515c063418ed82aa955b0c20cba257639143b70dc6
SSDEEP

3072:gUwEMgkp2ikbL7fUhRiq9GrhvQWZoa+XGOT4w8Y08i3a5kbKS3CmJo:gUnMgVbs25rVwDAaibKqCe

Score

10^/10

sodinokibi $2a$12$zrbgt.tkbfixshety/dgxeugjwalzahrccvkrvs0/ewpw1qfy0whi 8249 evasion ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$ZRbGt.TkbFIxsHETy/DgxeuGjWaLzaHrccVKRVs0/EwpW1qFY0WHi

Campaign

8249

Decoy

izzi360.com

devstyle.org

ziegler-praezisionsteile.de

rumahminangberdaya.com

justinvieira.com

edv-live.de

smithmediastrategies.com

innote.fi

waynela.com

precisionbevel.com

sanyue119.com

hexcreatives.co

xltyu.com

slimidealherbal.com

naturalrapids.com

edelman.jp

bildungsunderlebnis.haus

verbisonline.com

asteriag.com

2ekeus.nl

Attributes

net
true
pid
$2a$12$ZRbGt.TkbFIxsHETy/DgxeuGjWaLzaHrccVKRVs0/EwpW1qFY0WHi
prc
dbsnmp
mydesktopservice
thunderbird
ocautoupds
excel
encsvc
ocssd
steam
winword
sql
visio
outlook
agntsvc
oracle
ocomm
msaccess
onenote
wordpad
powerpnt
tbirdconfig
infopath
dbeng50
thebat
sqbcoreservice
firefox
xfssvccon
isqlplussvc
mspub
mydesktopqos
synctime
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also we downloaded whole file server and make Sage backup, that means leak includes: -Detailed engineering diagrams; -Finance reports (Payrolls, incomes, budget and so on); -NDA with customers and subcontractors; -Employee information; -Other things; In case of your silence we will publish it in our "Happy blog" [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
8249
svc
sql
memtas
backup
svc$
veeam
sophos
vss
mepocs

Extracted

Path

C:\Users\2kf1dk1-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2kf1dk1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also we downloaded whole file server and make Sage backup, that means leak includes: -Detailed engineering diagrams; -Finance reports (Payrolls, incomes, budget and so on); -NDA with customers and subcontractors; -Employee information; -Other things; In case of your silence we will publish it in our "Happy blog" [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7E7B8EB63478F193 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/7E7B8EB63478F193 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: T71TjuTzL+KtZ0aQXqfwhHGrlCDVums1392wX3+YksoEPX416aKHNEi3rUztg/7d mU5ipNUZOWUB/M9n5kO1FXCORTg6PhZll9PM8JJm6tY3u5z4hWMUse3p5i+Lb8KP 3+mfykwfwItywzQbvhRb34ok49KSnVv8kKWU/YZSY83FLUV3aqi57gd3hKL68mnt +Q3ugRCcP1WWIOy7G7xYjLC4XCIAreQiVm9iKzuz7h9kxuh+yUJIeHfniVTH9ntH gfMWrM3l2eGZTebT6kykgEAZyK55X6LEIq5N5zKHJKlQUCTt5YIkXZIYtIXescHY Usf0cEH9VJM0YetU4pbqlcoMc4dJE5JO9wttzpSpNal/+Dci6YiATN71OOO3/fDZ fsN8GW64nVzQJ5Np8vSQnLXRCexN5qwZF0s53B1cCLAqO5rTb5vh5KbaGQu/7UNs V1AWFh2kBDcs/FC00R35+w5yiP4hj1jQ+2jEjighcvPIWPzYUvPQdEALdWVlDMfk mnvH8Q7eYqZbF2V91/mUaDUgHOmtCR/jj7o7NxjKP1t+N8+ziRlxZUJfe0qeLzOK AzYcefg17IKZLtYHlOasNLXydOk5hM1bTmlhf7ki2pa5MOgqJbx467sbc026F15p QE8e4U2VXsSbD6rmk09pX1i97AkhiKWfxZtnkKU/QquI55fObdc4x+aqkPO+qDoP f3lks7ce7CYM9yp3UBUiKIq2cJcHiiqnap6Kgrc/iZZuvXaS4CMlWno0mi6Zbdkm 6OOkXqBVvFCZr6I/lNb/T3izb2t64/1edgeOrYNGwrsgRElt/2j2jObRajV/4ieg hfVP5g4GOX24TMb7y7IaC6izFV/cIsQ44VuAmWJ2KtPZ3yY55aNmVeaMmxvQWiaY 9zr1gwt7nF0Ie61MhNSa2v+BpG0HZwY+H8YqCZaQLLgZxDg3ua3V26Hk24sKi874 Pm0l+L0ivQDvI+eCySAaLPGZ9posSwqVtUjNSbJtLSXCVohB6pCMGvM/P6OTzGeB yLZuxnrc0Yy2xtN3Z3SO7fzRGtgxtDX1ZYC0WKf1qMDw2TXrzfJbksBzZE7iHN6m ZQfLom/Cl7PoZMJo+xofeDUtsx5tFNko+mo91vvxyhFh/LXBenTkOZbehwrpuSYV haJ8198txIYBcouQxLFbSlkv2leFw1fJ09VS0fZxiHVTYyS1ZTCzIMQ4WIkWL9Ax ofAfODRxjoR7dEScjMbdsuFi866MKVz3nw7AKlUDptF5wx5Oy4xdKT76i2GQ/ubp G+wouzwhPqtdPIo3SWv/LL9wZ0WywpykUTEMRlsECx1mr7tGJS1Es9YOh7SBt2VB PJKrC9Gwv4XzEVJ5v+/ret19CjC6Rf71 ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7E7B8EB63478F193

http://decoder.re/7E7B8EB63478F193

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

1888 netsh.exe

pid	process
1888	netsh.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

123.exe

description	ioc	process
File opened (read-only)	\??\S:	123.exe
File opened (read-only)	\??\A:	123.exe
File opened (read-only)	\??\E:	123.exe
File opened (read-only)	\??\K:	123.exe
File opened (read-only)	\??\N:	123.exe
File opened (read-only)	\??\P:	123.exe
File opened (read-only)	\??\Q:	123.exe
File opened (read-only)	\??\T:	123.exe
File opened (read-only)	\??\X:	123.exe
File opened (read-only)	\??\G:	123.exe
File opened (read-only)	\??\H:	123.exe
File opened (read-only)	\??\M:	123.exe
File opened (read-only)	\??\F:	123.exe
File opened (read-only)	\??\D:	123.exe
File opened (read-only)	\??\L:	123.exe
File opened (read-only)	\??\O:	123.exe
File opened (read-only)	\??\U:	123.exe
File opened (read-only)	\??\V:	123.exe
File opened (read-only)	\??\W:	123.exe
File opened (read-only)	\??\B:	123.exe
File opened (read-only)	\??\I:	123.exe
File opened (read-only)	\??\J:	123.exe
File opened (read-only)	\??\Y:	123.exe
File opened (read-only)	\??\R:	123.exe
File opened (read-only)	\??\Z:	123.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

123.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\25rcvcrc22ti9.bmp"	123.exe

Drops file in Program Files directory 42 IoCs

Processes:

123.exe

description	ioc	process
File opened for modification	\??\c:\program files\PublishRedo.au	123.exe
File opened for modification	\??\c:\program files\PushRestore.rle	123.exe
File opened for modification	\??\c:\program files\RegisterRedo.vdw	123.exe
File opened for modification	\??\c:\program files\RequestConfirm.jpeg	123.exe
File opened for modification	\??\c:\program files\SwitchRedo.emf	123.exe
File opened for modification	\??\c:\program files\UseSelect.mhtml	123.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\2kf1dk1-readme.txt	123.exe
File opened for modification	\??\c:\program files\BackupRequest.xhtml	123.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\2kf1dk1-readme.txt	123.exe
File created	\??\c:\program files (x86)\tmp	123.exe
File opened for modification	\??\c:\program files\RegisterUninstall.ttf	123.exe
File opened for modification	\??\c:\program files\ResolveCompress.odp	123.exe
File opened for modification	\??\c:\program files\SkipEnter.php	123.exe
File created	\??\c:\program files\tmp	123.exe
File opened for modification	\??\c:\program files\MoveBlock.xht	123.exe
File opened for modification	\??\c:\program files\PopSearch.wmx	123.exe
File opened for modification	\??\c:\program files\StartSubmit.emz	123.exe
File opened for modification	\??\c:\program files\GrantLimit.xla	123.exe
File opened for modification	\??\c:\program files\BlockReset.txt	123.exe
File opened for modification	\??\c:\program files\JoinEdit.asf	123.exe
File opened for modification	\??\c:\program files\SearchRemove.txt	123.exe
File opened for modification	\??\c:\program files\UnregisterPop.aifc	123.exe
File opened for modification	\??\c:\program files\UpdateStop.mov	123.exe
File created	\??\c:\program files\2kf1dk1-readme.txt	123.exe
File opened for modification	\??\c:\program files\RedoOut.pot	123.exe
File opened for modification	\??\c:\program files\RemovePing.shtml	123.exe
File opened for modification	\??\c:\program files\GrantPing.tif	123.exe
File opened for modification	\??\c:\program files\JoinGrant.aifc	123.exe
File opened for modification	\??\c:\program files\JoinMerge.midi	123.exe
File opened for modification	\??\c:\program files\NewShow.potm	123.exe
File opened for modification	\??\c:\program files\OpenSplit.tiff	123.exe
File opened for modification	\??\c:\program files\ResumeMount.rar	123.exe
File opened for modification	\??\c:\program files\StopRegister.eps	123.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\2kf1dk1-readme.txt	123.exe
File created	\??\c:\program files (x86)\2kf1dk1-readme.txt	123.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\tmp	123.exe
File opened for modification	\??\c:\program files\EditOut.otf	123.exe
File opened for modification	\??\c:\program files\PopStart.asp	123.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\tmp	123.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\tmp	123.exe
File opened for modification	\??\c:\program files\ConfirmComplete.M2TS	123.exe
File opened for modification	\??\c:\program files\LockNew.wdp	123.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

123.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	123.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	123.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	123.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D3416262727FE182E0996C793B0FA44676C6541A	123.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D3416262727FE182E0996C793B0FA44676C6541A\Blob = 030000000100000014000000d3416262727fe182e0996c793b0fa44676c6541a1400000001000000140000004fcbaca8c2efabdd836f6bbfce983d5c582576150400000001000000100000007ffb7eb7935fa68bd3c0d6936a99ab260f0000000100000020000000405852a5c1163836815f1a23e9a0e582c8c3c59c93bccbc754520c23b76f9be319000000010000001000000055c9deabacab40a5dbc20a3aa62b9802180000000100000010000000a823b4a20180beb460cab955c24d7e2120000000010000008e0400003082048a30820372a00302010202107d4d42a92b431d7e6453e7c19a8d5877300d06092a864886f70d01010b05003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3232313031323033343934335a170d3237313031323030303030305a304c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613122302006035504031319416c70686153534c204341202d20534841323536202d20473430820122300d06092a864886f70d01010105000382010f003082010a0282010100ad2429956615883f33870378cfd50c24b83153f3ff83226c99952b7ce54a59c2aec6d12a9dfa7f202e51c8672a5091a7795644fb38b53e308efc942ecb570c69535f44c656962faec0372586f171f1dc0245428661b836ef51e373450c90b3a5d2e7037ab83945d017f502d094416ac618b198c320b5c53af382b14aa444ac21732a9255064ec87c8bb0ca66145455f82b3cb25491b6cb52b2d8e36f8a4428b07d2bc19680b93e00d89e3de8319d5a4dedd67e4de5d48e03dd129a2783d4d6a1d784724e81ed9b8c620697a32c68137e041dacafa127c57d319cc21b7b0da821f385a0baace3bbe1fc61f824dd2aaa5d960477c33d50e6ddbf8643163a37f2d70203010001a382015b30820157300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b0601050507030230120603551d130101ff040830060101ff020100301d0603551d0e041604144fcbaca8c2efabdd836f6bbfce983d5c58257615301f0603551d23041830168014607b661a450d97ca89502f7d04cd34a8fffcfd4b307a06082b06010505070101046e306c302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747231303b06082b06010505073002862f687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f726f6f742d72312e63727430330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f726f6f742e63726c30210603551d20041a30183008060667810c010201300c060a2b06010401a0320a0103300d06092a864886f70d01010b050003820101001a25f673648840a95907a743ba153f5161bd15ff2d64ddcd7a5d326a7f4842e710986839efb7eba13476df2d58683e7b301c0cf78660f9a9f379c054b783a638bb36abbc95d07cf86fc1e94f4607c8b60c3200a92b0512f70c6d66f9819dbf0e644d7227c68bd14a02e16edb0c9fb78b380c7c332f6089db38cc95438cdd1684d5cc6e3acf8e9ba3020fd1bbbe7900b52882fce39f1cef74d9fe322366b8f0afa029a01fde52121578dddf6a70436d4ba4cdee7881b275a27ed7fcfc9eff82ed2513e5b1e8cfb718536ecb52f8759f65923670bafd0c054a83fa80d29ae0f38efe83b5df18e1acb44727fd3870a31b4402ed2564243da709f12255841d91ec12	123.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	123.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

123.exe

pid process

2000 123.exe
2000 123.exe
2000 123.exe
2000 123.exe
2000 123.exe

pid	process
2000	123.exe
2000	123.exe
2000	123.exe
2000	123.exe
2000	123.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

123.exevssvc.exevssvc.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2000	123.exe
Token: SeTakeOwnershipPrivilege	2000	123.exe
Token: SeBackupPrivilege	3020	vssvc.exe
Token: SeRestorePrivilege	3020	vssvc.exe
Token: SeAuditPrivilege	3020	vssvc.exe
Token: SeBackupPrivilege	2344	vssvc.exe
Token: SeRestorePrivilege	2344	vssvc.exe
Token: SeAuditPrivilege	2344	vssvc.exe
Token: SeBackupPrivilege	1124	vssvc.exe
Token: SeRestorePrivilege	1124	vssvc.exe
Token: SeAuditPrivilege	1124	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

123.exe

description	pid	process	target process
PID 2000 wrote to memory of 1888	2000	123.exe	netsh.exe
PID 2000 wrote to memory of 1888	2000	123.exe	netsh.exe
PID 2000 wrote to memory of 1888	2000	123.exe	netsh.exe
PID 2000 wrote to memory of 1888	2000	123.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\123.exe
"C:\Users\Admin\AppData\Local\Temp\123.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
2⤵
- Modifies Windows Firewall
PID:1888

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:344

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\2kf1dk1-readme.txt
1⤵
PID:1992

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1124

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\2kf1dk1-readme.txt
Filesize
7KB

MD5
4b0a445f7f1159b7049b847b98d6ca77

SHA1
bcb6f7bd75de25e2e135651a4ee8a5c200b4c96e

SHA256
4ea1a4ecf68a4ebc56700da0f65896493f34d4fb816de0b6dc3b9ab68c7bf178

SHA512
bcfa7cb470ee090e20b6df6c63b72ca88f83c59234687e3e82b9faa0bcc8fc8f23824d7b12f3d516ef54c1f5ec5b82121665e6e4e3688c82340567361befba36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e56ec378251cd65923ad88c1e14d0b6e

SHA1
7f5d986e0a34dd81487f6439fb0446ffa52a712e

SHA256
32ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0

SHA512
2737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab762.tmp
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar882.tmp
Filesize
163KB

MD5
19399ab248018076e27957e772bcfbab

SHA1
faef897e02d9501146beb49f75da1caf12967b88

SHA256
326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9

SHA512
6d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103

Download Submit
C:\Users\Public\Desktop\2kf1dk1-readme.txt
Filesize
7KB

MD5
4b0a445f7f1159b7049b847b98d6ca77

SHA1
bcb6f7bd75de25e2e135651a4ee8a5c200b4c96e

SHA256
4ea1a4ecf68a4ebc56700da0f65896493f34d4fb816de0b6dc3b9ab68c7bf178

SHA512
bcfa7cb470ee090e20b6df6c63b72ca88f83c59234687e3e82b9faa0bcc8fc8f23824d7b12f3d516ef54c1f5ec5b82121665e6e4e3688c82340567361befba36

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2000-478-0x0000000000230000-0x0000000000268000-memory.dmp

Filesize
224KB

Download
memory/2000-544-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-490-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-477-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-542-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-1-0x0000000000230000-0x0000000000268000-memory.dmp

Filesize
224KB

Download
memory/2000-493-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-2-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-609-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-693-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-714-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-717-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2000-719-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads