Analysis
- max time kernel
149s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system - submitted
13/10/2023, 02:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win7-20230831-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target svchost.exe
- Size 166KB
- Sample231013-dapazsbd3s
- SHA256 1dc818f51827d89a545493921f8648299f3eb367c1e0354969ccaa9df7ce77b5
- MD5 5bab7e6528a56bd5d3a76d01ec3ab45f
- SHA1 4b9495fc06c67e4419a0cf3d70b6285e9808afc4
- SHA512 7c59fca6ffa7d1fd55f7c2268c22193d48c4082277f95c882b1e7df93f011a86c036f569c5bb8dc0a83aebe9bf44df9e7f11aac99ea0c33f917e63e80c2b07c4
- SSDEEP 3072:EJMawtnGqtWoKeZC62aoNUSncs0whq2aWc54aF:+w9vteQJYUocfWLK
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\Recovery\68yy5-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 68yy5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/934C656C3C09B918 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/934C656C3C09B918 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: FUE4iiYePeKWVWkR/gSnOfENnfgUoPOTh2+63llCzVqXRM/USPko+bxYMxRtYhCl 0ehUKPETubyoFOuchpoerb8yrbl/JfdbpvEsH9FWapJ0deWT101Q8UFdmtrxLWzc +zUZOAhm/9hU2OznXpJgALncstkL/jEEuDuJD1k0NGg8yoZs1mlzeSOlbeW834Xb FGgotKUJsmyghfo1S/Km2YrnfS+KewWOqomlHzj2GnMfzy9U61p4oa+VmMICXi15 KC1WRFLuLy3gsrtMunIGr4WAVxYmaFFnzShI+Pj8Lhe3IoBzYfz9uPLp8b48gQxT Zzt1RVHCfChVqXddh/5jgXIN3upXPvW+G1bEsbQu2NdCsj34KZosFvAYZ7pU5bvD hyXxH2HcWaj9jcxPTU8h0g0bqLJZqWdAwXCZt9IKKsFZKj5520X23RuuGsdWYUNE UxIqxR270kmVCl+P3sIV7S0z91++yJ/BmwkrLvf4KIeajQPkJpvg03ZAxkYI1P93 vdds+kcuKHTE/gBiIgaBkYnN3LA2t7t3YbkTQU9DjJ9WJrLs4FuggRtPaKwQ3wKY w8/u0gSbDPGO+htCb364sfnl0jXSGy7SvY+c84Oa5+cTPEQ0lf9DokHLRQoV63V/ OBW1rr9Fo7V8GhRecVTjCiTAhfP55fBpyyEPmwVjQoDcrivNSsu3Yyo+5TUxkE20 EMPTXQ0wTH5NP9VgKVrd3AB3RsEHZFdn7aCg3IrzL2hMmt6n0Tk2lFndvIZIwQ1W b+jfqiCQX7ELxyfOLVxkXhUPrizW2b0x/6kgIUtm5KDBrwn6ajAULpAP+mn9geeJ 7gINokctvE0owNmcfr3SFM+ejMXXcLQjFesb7XJr/lSm8m45QZgA8q1PAV/Eou6P B6gnTpkQyaaf5gEAJKPrFWvYmgKktjOPdMo4Zwkt2EQtCoTNI1HKkVwfeq1wZi6u kEeTxchXvX+qfov/4aeF10eVDY64OqVw/+8J5gfBfnICBmbUvyreHHzf5qel5i52 ylTa9UXV95tr4g0+68Xk2ajnPM0FxbC1mif4LklcFpmQdU/1s1AQw+0SInA9OuaF O9HErmua0B/AVKX+QUCCHaLqYRlKGcRgnXnBcQfH5pth2qgU28sdTQjdr1bxm7y+ zNbocwIudP8mwTTG2kGEWrhpWgHN50FqbW5XlxakPqO2uX78wLh8VN+6VX6eb1Lf krjRsogd8inA2U8/pkTM8F0HeT3Xto4Cn0su+aAV1FP/x5L0SnyzwUygpluVAmDf Y0Frw6gapuKzWpjKNYWdtualFl9Ri3XJfdlZBvWNgBn9ZkZutgJgEIZ0Lh0thQ/I TvGAfSsa604BIEg9JBwbfPgT+GRgbAapKQrKEKHKxgJzdr/e Extension name: 68yy5 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/934C656C3C09B918
-
http://decryptor.cc/934C656C3C09B918
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oXnEn2JlQT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe" svchost.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\D: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\K: svchost.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\555269facn2z.bmp" svchost.exe - Drops file in Program Files directory 37 IoCs
description ioc Process File opened for modification \??\c:\program files\OptimizeDismount.bmp svchost.exe File opened for modification \??\c:\program files\RequestDeny.vsx svchost.exe File opened for modification \??\c:\program files\UnregisterExit.xlsx svchost.exe File opened for modification \??\c:\program files\SetRestore.xml svchost.exe File opened for modification \??\c:\program files\UpdateSwitch.wmv svchost.exe File opened for modification \??\c:\program files\RequestUninstall.ogg svchost.exe File opened for modification \??\c:\program files\ResetWatch.ex_ svchost.exe File opened for modification \??\c:\program files\SearchReset.xlt svchost.exe File opened for modification \??\c:\program files\ConvertEdit.3gp svchost.exe File opened for modification \??\c:\program files\CopyClear.M2V svchost.exe File opened for modification \??\c:\program files\ExpandRevoke.wma svchost.exe File opened for modification \??\c:\program files\GroupClear.xls svchost.exe File opened for modification \??\c:\program files\SelectWrite.pptm svchost.exe File opened for modification \??\c:\program files\AddRestore.xps svchost.exe File opened for modification \??\c:\program files\CheckpointUnpublish.potx svchost.exe File opened for modification \??\c:\program files\ConfirmHide.xla svchost.exe File opened for modification \??\c:\program files\StopSearch.xhtml svchost.exe File opened for modification \??\c:\program files\UseDeny.crw svchost.exe File opened for modification \??\c:\program files\WriteSelect.mpv2 svchost.exe File opened for modification \??\c:\program files\ReadRevoke.xhtml svchost.exe File opened for modification \??\c:\program files\ResumeHide.js svchost.exe File created \??\c:\program files (x86)\68yy5-readme.txt svchost.exe File opened for modification \??\c:\program files\DisconnectConvert.wps svchost.exe File opened for modification \??\c:\program files\MergePop.vdx svchost.exe File opened for modification \??\c:\program files\LockComplete.gif svchost.exe File opened for modification \??\c:\program files\UnprotectRead.csv svchost.exe File created \??\c:\program files\68yy5-readme.txt svchost.exe File opened for modification \??\c:\program files\ConvertFromSet.wdp svchost.exe File opened for modification \??\c:\program files\ExpandAssert.csv svchost.exe File opened for modification \??\c:\program files\ClosePush.pptx svchost.exe File opened for modification \??\c:\program files\GetResolve.search-ms svchost.exe File opened for modification \??\c:\program files\OptimizeUse.ram svchost.exe File opened for modification \??\c:\program files\CompressMerge.kix svchost.exe File opened for modification \??\c:\program files\JoinCompare.wdp svchost.exe File opened for modification \??\c:\program files\NewMeasure.TS svchost.exe File opened for modification \??\c:\program files\SubmitEdit.asf svchost.exe File opened for modification \??\c:\program files\UninstallRename.wma svchost.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD\Blob = 0f0000000100000014000000a16d1faa61f7277cd9abc31c9c893ed7b41efb197f0000000100000066000000306406082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030506082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b0601050507030809000000010000005c000000305a06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b0601050507030853000000010000004600000030443020060a2b06010401f33906010130123010060a2b0601040182373c0101030200c03020060a2b06010401f33906010230123010060a2b0601040182373c0101030200c062000000010000002000000023804203ca45d8cde716b8c13bf3b448457fa06cc10250997fa01458317c41e50b000000010000001600000049007a0065006e00700065002e0063006f006d0000001400000001000000140000001d1c650ea8f2257bb491cfe4b1b1e6bd55746c051d0000000100000010000000d895a1485825711bece16ab985d86da27a000000010000000c000000300a06082b060105050703097e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000030779e9315022e94856a3ff8bcf815b082f9aefd2000000001000000f4050000308205f0308203d8a003020102020f06e846272f1f0a8fd1845ce369f6d5300d06092a864886f70d01010505003038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d301e170d3037313231333133303832375a170d3337313231333038323732355a3038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c9d37aca0f1eaca786e816656ab1c21b45327195d9fe105bccafe7a579018f89c3caf25571f777be7794f372a42c44d89e929b143aa1e724900a0a568ec5d82694e1d948e12d3eda0a72dda39915da81a287f47b6e26778958add6eb0cb2417a736e6ddb7a7841e90888127e872e6611636c54fb3c9d72c0bc2effc2b7dd0d76e33ad7f7b468bea2f5e3816ec1466f5d8de04dc65455891a33310ab157b9a38a98c3ec3b34c59541697e75c23c20c561ba5147a0209093a1904bf34e7c8545549ad1052641b0b54d1d33bec403c8257cc170db3bf4092d542748ac2fe1c4ac3ec8cb924c53393723ecd301f9e009444d4d64c0e10d5a8722bcad1ba3fe26b515f3a7fc8419e9eca188b444698483f389d17406a9cc0bd6c2de27855026ca17b8c97a87562c1a011e6cbe13ad10acb524f53891a1d64bdaf1bbd2de47b5f1bc81f6596bcf1953e98d15cb4acba96f44e51b41cfe186a7cad06a9fbc4c8d06335aa285e59035a0625c164ef0e3a2fa031ab42c71b3582cde7b0bdb1a0febde211f06770603b0c9ef99fcc0b94f0b8628fed2b9eae3daa5c3476912e0dbf0f6198bed7b70d702d6ed8718282c04244c77e4488a1ac63b9ad40fcafa75d201405a8d79bf8bcf4bcfaa16c195e4ad4c8a3e1791d4b162e582e58004a4037e8dbfda7fa20f974f0cd30dfbd7d1e5727e1cc877ff5b9a0fb7ae0546e5f1a816ec47a4170203010001a381f63081f33081b00603551d110481a83081a5810f696e666f40697a656e70652e636f6da4819130818e31473045060355040a0c3e495a454e504520532e412e202d20434946204130313333373236302d524d6572632e5669746f7269612d4761737465697a205431303535204636322053383143304106035504090c3a417664612064656c204d65646974657272616e656f2045746f726269646561203134202d203031303130205669746f7269612d4761737465697a300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604141d1c650ea8f2257bb491cfe4b1b1e6bd55746c05300d06092a864886f70d01010505000382020100c781466f21184fa005efe7d5ba9750a260eda592141a529bf9f1884aa0dc7875d1d51f954ec5e7b769e622f4f829a82a89becfcf768fe331739d26d31c1b4716290768848ad2fbb11b243ed298182c248eaff67bea44161b2ac4faa097e9ea6c58a4ef75ab0062d19ded1336db220bb6f0d1f46e7b4687c29dbcbdbe423bb773d09a2a3cb45b121600af19398dad83501cc8814fbd020f3d9e3596eeefe4c2037c291c027ebd34275eaf53d69d17bf576ce9d08310afbf5d4def907b5d2bacecea7d002617cc025c63d71918a7ec2bc78a3e580e8a87e6839f4eb2341eac54094f1d020b397e810815b9a06913c8322be3ad6c13d6839d232db26da288867ea80d01260940d9ed284e8c93240fdbf11e4d7a7a5ae2a558f1dc8f5f99820c2ecfb2dd98cc92943ff909b3a596255b37f5128541e2194cc68a08c1dc187a0f1e3f8259a29a3e3ff9e0099ffdc1914b5dc97bd6b689fcdf1d7c86aacd03f20b5292f1626f7f87eaab76c96c50c21982afaa1df52028682ed5fc64374fcfa544c4be72b48c74b46ca7faf2bd7438432bdeaff9dcd8e09d9fdc3dcaa56344bf92a24f4c801cbb1ac39a4a04554dcaee260b1cbf02c564d39e7ed2d3911c4ba2f51ce5171c0d0c52a3911f9cf021ed02946fa9a049cae8438cc4f434da7c22a3c6663eb81b05885dbabcf7bce5dc143da786a8b6595221035e8be304ed4b2a1ea34f50 svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD\Blob = 0400000001000000100000008714ab83c4041bf193c750e2d721ebef03000000010000001400000030779e9315022e94856a3ff8bcf815b082f9aefd6800000001000000000000007e000000010000000800000000c0032f2df8d6017a000000010000000c000000300a06082b060105050703091d0000000100000010000000d895a1485825711bece16ab985d86da21400000001000000140000001d1c650ea8f2257bb491cfe4b1b1e6bd55746c050b000000010000001600000049007a0065006e00700065002e0063006f006d00000062000000010000002000000023804203ca45d8cde716b8c13bf3b448457fa06cc10250997fa01458317c41e553000000010000004600000030443020060a2b06010401f33906010130123010060a2b0601040182373c0101030200c03020060a2b06010401f33906010230123010060a2b0601040182373c0101030200c009000000010000005c000000305a06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703087f0000000100000066000000306406082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030506082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f0000000100000014000000a16d1faa61f7277cd9abc31c9c893ed7b41efb192000000001000000f4050000308205f0308203d8a003020102020f06e846272f1f0a8fd1845ce369f6d5300d06092a864886f70d01010505003038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d301e170d3037313231333133303832375a170d3337313231333038323732355a3038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c9d37aca0f1eaca786e816656ab1c21b45327195d9fe105bccafe7a579018f89c3caf25571f777be7794f372a42c44d89e929b143aa1e724900a0a568ec5d82694e1d948e12d3eda0a72dda39915da81a287f47b6e26778958add6eb0cb2417a736e6ddb7a7841e90888127e872e6611636c54fb3c9d72c0bc2effc2b7dd0d76e33ad7f7b468bea2f5e3816ec1466f5d8de04dc65455891a33310ab157b9a38a98c3ec3b34c59541697e75c23c20c561ba5147a0209093a1904bf34e7c8545549ad1052641b0b54d1d33bec403c8257cc170db3bf4092d542748ac2fe1c4ac3ec8cb924c53393723ecd301f9e009444d4d64c0e10d5a8722bcad1ba3fe26b515f3a7fc8419e9eca188b444698483f389d17406a9cc0bd6c2de27855026ca17b8c97a87562c1a011e6cbe13ad10acb524f53891a1d64bdaf1bbd2de47b5f1bc81f6596bcf1953e98d15cb4acba96f44e51b41cfe186a7cad06a9fbc4c8d06335aa285e59035a0625c164ef0e3a2fa031ab42c71b3582cde7b0bdb1a0febde211f06770603b0c9ef99fcc0b94f0b8628fed2b9eae3daa5c3476912e0dbf0f6198bed7b70d702d6ed8718282c04244c77e4488a1ac63b9ad40fcafa75d201405a8d79bf8bcf4bcfaa16c195e4ad4c8a3e1791d4b162e582e58004a4037e8dbfda7fa20f974f0cd30dfbd7d1e5727e1cc877ff5b9a0fb7ae0546e5f1a816ec47a4170203010001a381f63081f33081b00603551d110481a83081a5810f696e666f40697a656e70652e636f6da4819130818e31473045060355040a0c3e495a454e504520532e412e202d20434946204130313333373236302d524d6572632e5669746f7269612d4761737465697a205431303535204636322053383143304106035504090c3a417664612064656c204d65646974657272616e656f2045746f726269646561203134202d203031303130205669746f7269612d4761737465697a300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604141d1c650ea8f2257bb491cfe4b1b1e6bd55746c05300d06092a864886f70d01010505000382020100c781466f21184fa005efe7d5ba9750a260eda592141a529bf9f1884aa0dc7875d1d51f954ec5e7b769e622f4f829a82a89becfcf768fe331739d26d31c1b4716290768848ad2fbb11b243ed298182c248eaff67bea44161b2ac4faa097e9ea6c58a4ef75ab0062d19ded1336db220bb6f0d1f46e7b4687c29dbcbdbe423bb773d09a2a3cb45b121600af19398dad83501cc8814fbd020f3d9e3596eeefe4c2037c291c027ebd34275eaf53d69d17bf576ce9d08310afbf5d4def907b5d2bacecea7d002617cc025c63d71918a7ec2bc78a3e580e8a87e6839f4eb2341eac54094f1d020b397e810815b9a06913c8322be3ad6c13d6839d232db26da288867ea80d01260940d9ed284e8c93240fdbf11e4d7a7a5ae2a558f1dc8f5f99820c2ecfb2dd98cc92943ff909b3a596255b37f5128541e2194cc68a08c1dc187a0f1e3f8259a29a3e3ff9e0099ffdc1914b5dc97bd6b689fcdf1d7c86aacd03f20b5292f1626f7f87eaab76c96c50c21982afaa1df52028682ed5fc64374fcfa544c4be72b48c74b46ca7faf2bd7438432bdeaff9dcd8e09d9fdc3dcaa56344bf92a24f4c801cbb1ac39a4a04554dcaee260b1cbf02c564d39e7ed2d3911c4ba2f51ce5171c0d0c52a3911f9cf021ed02946fa9a049cae8438cc4f434da7c22a3c6663eb81b05885dbabcf7bce5dc143da786a8b6595221035e8be304ed4b2a1ea34f50 svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD\Blob = 190000000100000010000000ee8d49b7586d213f273a2c1e1b11bffb0f0000000100000014000000a16d1faa61f7277cd9abc31c9c893ed7b41efb197f0000000100000066000000306406082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030506082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b0601050507030809000000010000005c000000305a06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b0601050507030853000000010000004600000030443020060a2b06010401f33906010130123010060a2b0601040182373c0101030200c03020060a2b06010401f33906010230123010060a2b0601040182373c0101030200c062000000010000002000000023804203ca45d8cde716b8c13bf3b448457fa06cc10250997fa01458317c41e50b000000010000001600000049007a0065006e00700065002e0063006f006d0000001400000001000000140000001d1c650ea8f2257bb491cfe4b1b1e6bd55746c051d0000000100000010000000d895a1485825711bece16ab985d86da27a000000010000000c000000300a06082b060105050703097e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000030779e9315022e94856a3ff8bcf815b082f9aefd0400000001000000100000008714ab83c4041bf193c750e2d721ebef2000000001000000f4050000308205f0308203d8a003020102020f06e846272f1f0a8fd1845ce369f6d5300d06092a864886f70d01010505003038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d301e170d3037313231333133303832375a170d3337313231333038323732355a3038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c9d37aca0f1eaca786e816656ab1c21b45327195d9fe105bccafe7a579018f89c3caf25571f777be7794f372a42c44d89e929b143aa1e724900a0a568ec5d82694e1d948e12d3eda0a72dda39915da81a287f47b6e26778958add6eb0cb2417a736e6ddb7a7841e90888127e872e6611636c54fb3c9d72c0bc2effc2b7dd0d76e33ad7f7b468bea2f5e3816ec1466f5d8de04dc65455891a33310ab157b9a38a98c3ec3b34c59541697e75c23c20c561ba5147a0209093a1904bf34e7c8545549ad1052641b0b54d1d33bec403c8257cc170db3bf4092d542748ac2fe1c4ac3ec8cb924c53393723ecd301f9e009444d4d64c0e10d5a8722bcad1ba3fe26b515f3a7fc8419e9eca188b444698483f389d17406a9cc0bd6c2de27855026ca17b8c97a87562c1a011e6cbe13ad10acb524f53891a1d64bdaf1bbd2de47b5f1bc81f6596bcf1953e98d15cb4acba96f44e51b41cfe186a7cad06a9fbc4c8d06335aa285e59035a0625c164ef0e3a2fa031ab42c71b3582cde7b0bdb1a0febde211f06770603b0c9ef99fcc0b94f0b8628fed2b9eae3daa5c3476912e0dbf0f6198bed7b70d702d6ed8718282c04244c77e4488a1ac63b9ad40fcafa75d201405a8d79bf8bcf4bcfaa16c195e4ad4c8a3e1791d4b162e582e58004a4037e8dbfda7fa20f974f0cd30dfbd7d1e5727e1cc877ff5b9a0fb7ae0546e5f1a816ec47a4170203010001a381f63081f33081b00603551d110481a83081a5810f696e666f40697a656e70652e636f6da4819130818e31473045060355040a0c3e495a454e504520532e412e202d20434946204130313333373236302d524d6572632e5669746f7269612d4761737465697a205431303535204636322053383143304106035504090c3a417664612064656c204d65646974657272616e656f2045746f726269646561203134202d203031303130205669746f7269612d4761737465697a300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604141d1c650ea8f2257bb491cfe4b1b1e6bd55746c05300d06092a864886f70d01010505000382020100c781466f21184fa005efe7d5ba9750a260eda592141a529bf9f1884aa0dc7875d1d51f954ec5e7b769e622f4f829a82a89becfcf768fe331739d26d31c1b4716290768848ad2fbb11b243ed298182c248eaff67bea44161b2ac4faa097e9ea6c58a4ef75ab0062d19ded1336db220bb6f0d1f46e7b4687c29dbcbdbe423bb773d09a2a3cb45b121600af19398dad83501cc8814fbd020f3d9e3596eeefe4c2037c291c027ebd34275eaf53d69d17bf576ce9d08310afbf5d4def907b5d2bacecea7d002617cc025c63d71918a7ec2bc78a3e580e8a87e6839f4eb2341eac54094f1d020b397e810815b9a06913c8322be3ad6c13d6839d232db26da288867ea80d01260940d9ed284e8c93240fdbf11e4d7a7a5ae2a558f1dc8f5f99820c2ecfb2dd98cc92943ff909b3a596255b37f5128541e2194cc68a08c1dc187a0f1e3f8259a29a3e3ff9e0099ffdc1914b5dc97bd6b689fcdf1d7c86aacd03f20b5292f1626f7f87eaab76c96c50c21982afaa1df52028682ed5fc64374fcfa544c4be72b48c74b46ca7faf2bd7438432bdeaff9dcd8e09d9fdc3dcaa56344bf92a24f4c801cbb1ac39a4a04554dcaee260b1cbf02c564d39e7ed2d3911c4ba2f51ce5171c0d0c52a3911f9cf021ed02946fa9a049cae8438cc4f434da7c22a3c6663eb81b05885dbabcf7bce5dc143da786a8b6595221035e8be304ed4b2a1ea34f50 svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD\Blob = 5c0000000100000004000000001000000400000001000000100000008714ab83c4041bf193c750e2d721ebef03000000010000001400000030779e9315022e94856a3ff8bcf815b082f9aefd6800000001000000000000007e000000010000000800000000c0032f2df8d6017a000000010000000c000000300a06082b060105050703091d0000000100000010000000d895a1485825711bece16ab985d86da21400000001000000140000001d1c650ea8f2257bb491cfe4b1b1e6bd55746c050b000000010000001600000049007a0065006e00700065002e0063006f006d00000062000000010000002000000023804203ca45d8cde716b8c13bf3b448457fa06cc10250997fa01458317c41e553000000010000004600000030443020060a2b06010401f33906010130123010060a2b0601040182373c0101030200c03020060a2b06010401f33906010230123010060a2b0601040182373c0101030200c009000000010000005c000000305a06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703087f0000000100000066000000306406082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030506082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f0000000100000014000000a16d1faa61f7277cd9abc31c9c893ed7b41efb19190000000100000010000000ee8d49b7586d213f273a2c1e1b11bffb2000000001000000f4050000308205f0308203d8a003020102020f06e846272f1f0a8fd1845ce369f6d5300d06092a864886f70d01010505003038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d301e170d3037313231333133303832375a170d3337313231333038323732355a3038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c9d37aca0f1eaca786e816656ab1c21b45327195d9fe105bccafe7a579018f89c3caf25571f777be7794f372a42c44d89e929b143aa1e724900a0a568ec5d82694e1d948e12d3eda0a72dda39915da81a287f47b6e26778958add6eb0cb2417a736e6ddb7a7841e90888127e872e6611636c54fb3c9d72c0bc2effc2b7dd0d76e33ad7f7b468bea2f5e3816ec1466f5d8de04dc65455891a33310ab157b9a38a98c3ec3b34c59541697e75c23c20c561ba5147a0209093a1904bf34e7c8545549ad1052641b0b54d1d33bec403c8257cc170db3bf4092d542748ac2fe1c4ac3ec8cb924c53393723ecd301f9e009444d4d64c0e10d5a8722bcad1ba3fe26b515f3a7fc8419e9eca188b444698483f389d17406a9cc0bd6c2de27855026ca17b8c97a87562c1a011e6cbe13ad10acb524f53891a1d64bdaf1bbd2de47b5f1bc81f6596bcf1953e98d15cb4acba96f44e51b41cfe186a7cad06a9fbc4c8d06335aa285e59035a0625c164ef0e3a2fa031ab42c71b3582cde7b0bdb1a0febde211f06770603b0c9ef99fcc0b94f0b8628fed2b9eae3daa5c3476912e0dbf0f6198bed7b70d702d6ed8718282c04244c77e4488a1ac63b9ad40fcafa75d201405a8d79bf8bcf4bcfaa16c195e4ad4c8a3e1791d4b162e582e58004a4037e8dbfda7fa20f974f0cd30dfbd7d1e5727e1cc877ff5b9a0fb7ae0546e5f1a816ec47a4170203010001a381f63081f33081b00603551d110481a83081a5810f696e666f40697a656e70652e636f6da4819130818e31473045060355040a0c3e495a454e504520532e412e202d20434946204130313333373236302d524d6572632e5669746f7269612d4761737465697a205431303535204636322053383143304106035504090c3a417664612064656c204d65646974657272616e656f2045746f726269646561203134202d203031303130205669746f7269612d4761737465697a300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604141d1c650ea8f2257bb491cfe4b1b1e6bd55746c05300d06092a864886f70d01010505000382020100c781466f21184fa005efe7d5ba9750a260eda592141a529bf9f1884aa0dc7875d1d51f954ec5e7b769e622f4f829a82a89becfcf768fe331739d26d31c1b4716290768848ad2fbb11b243ed298182c248eaff67bea44161b2ac4faa097e9ea6c58a4ef75ab0062d19ded1336db220bb6f0d1f46e7b4687c29dbcbdbe423bb773d09a2a3cb45b121600af19398dad83501cc8814fbd020f3d9e3596eeefe4c2037c291c027ebd34275eaf53d69d17bf576ce9d08310afbf5d4def907b5d2bacecea7d002617cc025c63d71918a7ec2bc78a3e580e8a87e6839f4eb2341eac54094f1d020b397e810815b9a06913c8322be3ad6c13d6839d232db26da288867ea80d01260940d9ed284e8c93240fdbf11e4d7a7a5ae2a558f1dc8f5f99820c2ecfb2dd98cc92943ff909b3a596255b37f5128541e2194cc68a08c1dc187a0f1e3f8259a29a3e3ff9e0099ffdc1914b5dc97bd6b689fcdf1d7c86aacd03f20b5292f1626f7f87eaab76c96c50c21982afaa1df52028682ed5fc64374fcfa544c4be72b48c74b46ca7faf2bd7438432bdeaff9dcd8e09d9fdc3dcaa56344bf92a24f4c801cbb1ac39a4a04554dcaee260b1cbf02c564d39e7ed2d3911c4ba2f51ce5171c0d0c52a3911f9cf021ed02946fa9a049cae8438cc4f434da7c22a3c6663eb81b05885dbabcf7bce5dc143da786a8b6595221035e8be304ed4b2a1ea34f50 svchost.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 544 svchost.exe 544 svchost.exe 1888 powershell.exe 1888 powershell.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 544 svchost.exe Token: SeDebugPrivilege 1888 powershell.exe Token: SeBackupPrivilege 1516 vssvc.exe Token: SeRestorePrivilege 1516 vssvc.exe Token: SeAuditPrivilege 1516 vssvc.exe Token: SeTakeOwnershipPrivilege 544 svchost.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 544 wrote to memory of 1888 544 svchost.exe 87 PID 544 wrote to memory of 1888 544 svchost.exe 87 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1736
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recovery\68yy5-readme.txt
- Size 6KB
- SHA256 401e2bf816cab5c6b2c9b7acb6d29d9e267a4f8cbdb67717aa015d89b5d25616
- MD5 27aff71e622ee6cc4054d54608b72e94
- SHA1 a1476eaf069172a700a39076534a1e0327eb43ee
- SHA512 9bff69091c6913e1760b38d1ae6bdbb01bf263290c725de515dc3be80107c2c907efacb1a5214cc5d38faeb19e95433310f1f97a1460eaa170cfa709ef34ae7f
- SSDEEP 96:GL2iNsgSxU3TPbMdobFAdzm8IL6BiVsQxyp0uxa+bKhQAZDADiVSZDd9PrR5u:GL2A3jnKk8BOJxY0uxVG5DfVSZrDW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lzhukaml.au0.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512