sodinokibi | f442d0543f6df79be9fbaed90af2dedbcf2e4774561421763577b148a9ff8554

General

Target

v2.exe
Size

121KB
MD5

944ed18066724dc6ca3fb3d72e4b9bdf
SHA1

1a19c8793cd783a5bb89777f5bc09e580f97ce29
SHA256

74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
SHA512

a4d23cba68205350ae58920479cb52836f9c6dac20d1634993f3758a1e5866f40b0296226341958d1200e1fcd292b8138c41a9ed8911d7abeaa223a06bfe4ad3
SSDEEP

1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZs/WVEdz725sK:J1MZwlLk9Bm3uW/Wud2K36cn/wCY

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\Recovery\dq67c1h-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension dq67c1h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6CD58D914EFF79CB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/6CD58D914EFF79CB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 64XkcPwp5KdHl0XlJMe9iUsTqI2G4aIVkOdVoGGITbV9864alX3WUkv/PxsoFafM l3FSIPZ3LKaUAYUax0NhaSudkIknObQ4refuqQgSVpnDKdlBGxlfvqiDI+e2OK9X ah7OelwWzxa3ITnfVJLizum/4adkNQNoL3iWvMzkokWCUe/D/9A82MVYRAd1rTQi 4jmeyEYr4Q9q/eSTsznv6DZWc1Pd7sjX9A2tEL0CmXudFojKYCx4ShV7UFG4mH1e dhSsnrO1IYHxkgJvVggKaPvYKWEzrgfYfTanWanVR4Nc3bqZvKwhf9sE0Ocfzz3R wfF921ebdJWoUUt0l4mvb3rbpJS55pCoC5SBgLgZMBd58frs9lO+6aTiqQN3NTXT CzxmWfp4dvdjHb073jVIXzYvbRByRIWV48wMJLgvumhnR2G01kpTIQgSdESE7VEg elJsOeMR+f37Q7MsytbWz0ubVNH1ADLC+8nbzjTUjE0uq30bIj+DcflF6IQ55cWt Sc9Du21ofNQIwOV98pmvYIISGmTkVwRKakxQXztJ+pk0hQJmJk5Lro2CJu+RTf/N m9KgDb9Unpqt/3/ADiaa1T0ig8AQjR8WkfdWj/AAfRrdMTHSSJd53R0+kUyay3ZQ o2Ry/99v4Zi3JzUwawpYJZyGvnhuzubGH6TpPs+CMPxGMg19aksByshlH9hXDqGE styiFJvKlKu6fUebBpIg5mr7jbws/VZG6hmb1bmaDzNbQ5cKn21BFDUbr+4kmmGU g1v4GBPCpFL1gxotvFqFRA9nCcXdqrudNOcKnsDtoXKHo7PRZinI4e1NSXsK6nUh aAC29XgDGcZHbENLkBFokQOJV+vKgey4gz4SNnoMDb4YyH2Dr66rIvsRuud0nWKA irU9FpVT4e1KWketELoA4CDaRyAR3dIqXs3N2G4d6HX6C7TjgyicDeAwJ39vUu4F mHwY82JE00T9O6PBmSqhp7IB6cz/qZlKNtD6pJu7uGeUOubccdzZ5xr3nYHUE/R/ 5zZYT7zavVBnzv+065hITCBHuWiHsDjSNlEOIf+VngY3oM8KwR5UzbNejSMg2u5Z TpPtDGNuk9wiMw+tzkwkezxVXaFCwutOZypk/lKIvCAKBDCVilRjma9PRzxoa5tR UafmbDTywBumFSGr0kUTEFonUCeV40Ea+q/vw4gtnkkUJc7A1931smOWeAvctbVx vMWBGH8cwuEGSaytCWX+XCvvG+e0ck2w5BO+lbhmih1fAVridmDt41RCL8UBX23b /2sINZ5cRFtPrlduzQ4YA6ejB2WEDZ5kH/nHP4PYT/r05EJoZEUQaUE9+l4xPiX5 hFdKaIoaYrkc270gBzOcK85CGfuVj4Ur ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6CD58D914EFF79CB

http://decoder.re/6CD58D914EFF79CB

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

v2.exe

description	ioc	process
File opened (read-only)	\??\N:	v2.exe
File opened (read-only)	\??\B:	v2.exe
File opened (read-only)	\??\Q:	v2.exe
File opened (read-only)	\??\L:	v2.exe
File opened (read-only)	\??\M:	v2.exe
File opened (read-only)	\??\R:	v2.exe
File opened (read-only)	\??\F:	v2.exe
File opened (read-only)	\??\G:	v2.exe
File opened (read-only)	\??\D:	v2.exe
File opened (read-only)	\??\S:	v2.exe
File opened (read-only)	\??\P:	v2.exe
File opened (read-only)	\??\T:	v2.exe
File opened (read-only)	\??\O:	v2.exe
File opened (read-only)	\??\U:	v2.exe
File opened (read-only)	\??\I:	v2.exe
File opened (read-only)	\??\K:	v2.exe
File opened (read-only)	\??\J:	v2.exe
File opened (read-only)	\??\E:	v2.exe
File opened (read-only)	\??\H:	v2.exe
File opened (read-only)	\??\V:	v2.exe
File opened (read-only)	\??\W:	v2.exe
File opened (read-only)	\??\X:	v2.exe
File opened (read-only)	\??\Y:	v2.exe
File opened (read-only)	\??\Z:	v2.exe
File opened (read-only)	\??\A:	v2.exe

Drops file in System32 directory 1 IoCs

Processes:

v2.exe

description ioc process

File opened for modification C:\Windows\System32\CatRoot2\dberr.txt v2.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	v2.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

v2.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hd1.bmp"	v2.exe

Drops file in Program Files directory 40 IoCs

Processes:

v2.exe

description	ioc	process
File opened for modification	\??\c:\program files\RegisterShow.mhtml	v2.exe
File opened for modification	\??\c:\program files\ResetDeny.eps	v2.exe
File opened for modification	\??\c:\program files\WriteWait.rtf	v2.exe
File opened for modification	\??\c:\program files\BackupTrace.vssx	v2.exe
File opened for modification	\??\c:\program files\ExitEnable.asp	v2.exe
File opened for modification	\??\c:\program files\JoinSet.iso	v2.exe
File opened for modification	\??\c:\program files\ApprovePublish.clr	v2.exe
File opened for modification	\??\c:\program files\MountSet.TTS	v2.exe
File opened for modification	\??\c:\program files\OutRevoke.mpeg	v2.exe
File opened for modification	\??\c:\program files\ResolvePush.ex_	v2.exe
File opened for modification	\??\c:\program files\StartRegister.wps	v2.exe
File opened for modification	\??\c:\program files\UndoEnter.wma	v2.exe
File opened for modification	\??\c:\program files\CheckpointInitialize.wvx	v2.exe
File opened for modification	\??\c:\program files\DenyExit.aifc	v2.exe
File opened for modification	\??\c:\program files\ImportInstall.vsdx	v2.exe
File opened for modification	\??\c:\program files\UndoStop.dib	v2.exe
File opened for modification	\??\c:\program files\ConfirmSkip.gif	v2.exe
File opened for modification	\??\c:\program files\ImportRename.tmp	v2.exe
File opened for modification	\??\c:\program files\MeasureFormat.ini	v2.exe
File opened for modification	\??\c:\program files\MeasureInvoke.xlsx	v2.exe
File opened for modification	\??\c:\program files\RestartInitialize.docx	v2.exe
File created	\??\c:\program files\dq67c1h-readme.txt	v2.exe
File opened for modification	\??\c:\program files\BackupClose.png	v2.exe
File opened for modification	\??\c:\program files\ClearDisconnect.mpeg2	v2.exe
File opened for modification	\??\c:\program files\SubmitInitialize.jpg	v2.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\dq67c1h-readme.txt	v2.exe
File opened for modification	\??\c:\program files\InstallUpdate.png	v2.exe
File opened for modification	\??\c:\program files\StopExport.gif	v2.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\dq67c1h-readme.txt	v2.exe
File created	\??\c:\program files (x86)\dq67c1h-readme.txt	v2.exe
File opened for modification	\??\c:\program files\BackupStop.tif	v2.exe
File opened for modification	\??\c:\program files\FormatCopy.xls	v2.exe
File opened for modification	\??\c:\program files\PublishProtect.scf	v2.exe
File opened for modification	\??\c:\program files\UndoGrant.odp	v2.exe
File opened for modification	\??\c:\program files\SubmitRedo.xhtml	v2.exe
File opened for modification	\??\c:\program files\WriteUse.vstm	v2.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\dq67c1h-readme.txt	v2.exe
File opened for modification	\??\c:\program files\HideReset.xltx	v2.exe
File opened for modification	\??\c:\program files\ImportSwitch.xlsb	v2.exe
File opened for modification	\??\c:\program files\LimitUnpublish.dotx	v2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

v2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	v2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a919000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c02000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	v2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	v2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000002000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	v2.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

2440 vlc.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

v2.exe

pid process

1956 v2.exe
1956 v2.exe
1956 v2.exe
1956 v2.exe
1956 v2.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

2440 vlc.exe

pid	process
1956	v2.exe
1956	v2.exe
1956	v2.exe
1956	v2.exe
1956	v2.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

v2.exevssvc.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1956	v2.exe
Token: SeTakeOwnershipPrivilege	1956	v2.exe
Token: SeBackupPrivilege	2556	vssvc.exe
Token: SeRestorePrivilege	2556	vssvc.exe
Token: SeAuditPrivilege	2556	vssvc.exe
Token: SeBackupPrivilege	2952	vssvc.exe
Token: SeRestorePrivilege	2952	vssvc.exe
Token: SeAuditPrivilege	2952	vssvc.exe

Suspicious use of FindShellTrayWindow 24 IoCs

Processes:

vlc.exe

pid	process
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe

Suspicious use of SendNotifyMessage 23 IoCs

Processes:

vlc.exe

pid	process
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe
2440	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

2440 vlc.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\v2.exe
"C:\Users\Admin\AppData\Local\Temp\v2.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\dq67c1h-readme.txt
1⤵
PID:804

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\dq67c1h-readme.txt
1⤵
PID:1920

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ReadExport.mpa"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2440

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\dq67c1h-readme.txt
Filesize
7KB

MD5
1bddf87af0d343ac6392f23ff01e34bc

SHA1
60c2e91ab79cb18603d389199490c5b5069e9f06

SHA256
474e3a82446b569cb9150b8bb572d256c05999a2a2340a1a78cb8c890454e37a

SHA512
86e8e31fc078ab7410394cda73132cd503a6d1fc37d3465586784180321fa592664a4709cdac8b613747dd5c098884b3779424d8a2274b1661c775d354252b86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
dca45339ca3024e0b1c4a83a4fb20fb1

SHA1
cd4498d16465c1784f55f77712a9bdc5551f3ab2

SHA256
8c9b30710727762dfda9bf3752092c61e623f9b6d0d6639487f8de3a0bbb4302

SHA512
444b15c0c18443206bacc70b741bbe7d74aa83a6bb21323710fe114e633e1926ef98a3541c7b4c49e9acdf41ae11e326f3c6ccbe3969be844cac868230f4915c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA0A.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.em2440
Filesize
75B

MD5
abd44f6620f7c84f5bacd51e73bd4d49

SHA1
358c9a05b5b3944fdc43831094aa2b8ca3c82010

SHA256
98ac364853ef51634a0a9851caf2f2ba603279aac4c82a15dd35ab65b2ee3e36

SHA512
4aacfe1e0e9981d56a8bab88197115128f417c6894c3cc52324e356c03bd24a2d84df521d040f8fa1a91cefe28a8658b206517bf30d3a0fe9c8aba64bcf3545a

Download Submit
C:\Windows\System32\catroot2\dberr.txt
Filesize
192KB

MD5
cd5bd2de905cd091a9a0f87e208e7849

SHA1
2cb3e76cad47472afd6e89d92cd35a5e99f5c8c1

SHA256
9e6126142666ba73a365a0525f46093a3589fa27b9362981e645b2333487ff09

SHA512
6cdc453486c24a38c8c26a3b93249c3e9bc1293d9bcc34894051f28ad719b7efcfedff4d55381a9272810ea89a28817630af2a75f0fd53c7e5aa41eb028adbd2

Download Submit
memory/2440-2531-0x000000013F530000-0x000000013F628000-memory.dmp

Filesize
992KB

Download
memory/2440-2532-0x000007FEF65C0000-0x000007FEF65F4000-memory.dmp

Filesize
208KB

Download
memory/2440-2533-0x000007FEF5D50000-0x000007FEF6004000-memory.dmp

Filesize
2.7MB

Download
memory/2440-2534-0x000007FEF48F0000-0x000007FEF599B000-memory.dmp

Filesize
16.7MB

Download
memory/2440-2535-0x000007FEF3CE0000-0x000007FEF3DF2000-memory.dmp

Filesize
1.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads