Analysis
- max time kernel
145s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/03/2024, 21:35
Behavioral task
behavioral1
Sample
2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe
Resource
win10v2004-20240226-en
General
- Target 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe
- Size 123KB
- Sample240308-1ft5ragf29
- SHA256 f3207b345d00de0722a1b533dbc4d9f2ff05b39e1393d780973ecbb3c7b008f3
- MD5 babc36b5ce70990d1cf3d47c704fc2db
- SHA1 f319267a09e4f1efa89c3a2b49a41373ead326ff
- SHA512 493764e7aa4a5646ed6f419b5310fb595e9835e7808c64c444dd3dce99ceb3573539c4b61c9581a6885494f246550d9e4e5512306cb54407c587cbf90914aab7
- SSDEEP 1536:7DvcP3nThpshwVs5OE8yNcYQp+2ZZICS4AIjnBR561lQVMr3IgmffEbjQFOxL:yESVhaNcYM8gnBR5uiV1UvQFOxL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
sodinokibi
-
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
-
4085
-
sandd.nl
-
digivod.de
-
southeasternacademyofprosthodontics.org
-
resortmtn.com
-
mdk-mediadesign.de
-
tetinfo.in
-
fayrecreations.com
-
ecpmedia.vn
-
physiofischer.de
-
highlinesouthasc.com
-
antenanavi.com
-
blog.solutionsarchitect.guru
-
deepsouthclothingcompany.com
-
coursio.com
-
quickyfunds.com
-
atmos-show.com
-
pawsuppetlovers.com
-
hokagestore.com
-
midmohandyman.com
-
mmgdouai.fr
-
stingraybeach.com
-
tandartspraktijkhartjegroningen.nl
-
leoben.at
-
licor43.de
-
xlarge.at
-
maasreusel.nl
-
lmtprovisions.com
-
destinationclients.fr
-
vannesteconstruct.be
-
ausbeverage.com.au
-
iyahayki.nl
-
goodgirlrecovery.com
-
aarvorg.com
-
wien-mitte.co.at
-
iviaggisonciliegie.it
-
mylolis.com
-
parks-nuernberg.de
-
gastsicht.de
-
iwr.nl
-
theshungiteexperience.com.au
-
katiekerr.co.uk
-
tuuliautio.fi
-
jeanlouissibomana.com
-
rosavalamedahr.com
-
teknoz.net
-
dekkinngay.com
-
abitur-undwieweiter.de
-
boisehosting.net
-
centrospgolega.com
-
tomoiyuma.com
-
tastewilliamsburg.com
-
creative-waves.co.uk
-
stoneys.ch
-
sweering.fr
-
maxadams.london
-
lascuola.nl
-
naturavetal.hr
-
nosuchthingasgovernment.com
-
worldhealthbasicinfo.com
-
digi-talents.com
-
thedad.com
-
teresianmedia.org
-
enovos.de
-
visiativ-industry.fr
-
hushavefritid.dk
-
helikoptervluchtnewyork.nl
-
hrabritelefon.hr
-
autopfand24.de
-
shadebarandgrillorlando.com
-
x-ray.ca
-
nmiec.com
-
modestmanagement.com
-
birnam-wood.com
-
farhaani.com
-
freie-baugutachterpraxis.de
-
klimt2012.info
-
xltyu.com
-
purposeadvisorsolutions.com
-
spinheal.ru
-
fitnessingbyjessica.com
-
geekwork.pl
-
igrealestate.com
-
solerluethi-allart.ch
-
tenacitytenfold.com
-
crosspointefellowship.church
-
koken-voor-baby.nl
-
caribbeansunpoker.com
-
wmiadmin.com
-
markelbroch.com
-
schlafsack-test.net
-
filmvideoweb.com
-
drfoyle.com
-
bsaship.com
-
bowengroup.com.au
-
ncuccr.org
-
ecopro-kanto.com
-
waynela.com
-
fitnessbazaar.com
-
global-kids.info
-
promesapuertorico.com
-
finediningweek.pl
-
qualitus.com
-
pferdebiester.de
-
c-a.co.in
-
vanswigchemdesign.com
-
mymoneyforex.com
-
basisschooldezonnewijzer.nl
-
denifl-consulting.at
-
mezhdu-delom.ru
-
homesdollar.com
-
stemplusacademy.com
-
naswrrg.org
-
myhostcloud.com
-
bauertree.com
-
365questions.org
-
bridgeloanslenders.com
-
marietteaernoudts.nl
-
caribdoctor.org
-
offroadbeasts.com
-
vitalyscenter.es
-
dutchbrewingcoffee.com
-
charlesreger.com
-
milltimber.aberdeen.sch.uk
-
simpliza.com
-
pasvenska.se
-
ateliergamila.com
-
ino-professional.ru
-
pier40forall.org
-
faizanullah.com
-
chaotrang.com
-
whittier5k.com
-
transportesycementoshidalgo.es
-
krlosdavid.com
-
colorofhorses.com
-
skiltogprint.no
-
sauschneider.info
-
hexcreatives.co
-
americafirstcommittee.org
-
blogdecachorros.com
-
sportsmassoren.com
-
celeclub.org
-
rushhourappliances.com
-
baptisttabernacle.com
-
rehabilitationcentersinhouston.net
-
falcou.fr
-
mooshine.com
-
longislandelderlaw.com
-
figura.team
-
yassir.pro
-
renergysolution.com
-
christ-michael.net
-
executiveairllc.com
-
ctrler.cn
-
cityorchardhtx.com
-
leather-factory.co.jp
-
kenhnoithatgo.com
-
mbxvii.com
-
ccpbroadband.com
-
schmalhorst.de
-
icpcnj.org
-
troegs.com
-
dirittosanitario.biz
-
lukeshepley.wordpress.com
-
aglend.com.au
-
wraithco.com
-
conasmanagement.de
-
sagadc.com
-
pomodori-pizzeria.de
-
darrenkeslerministries.com
-
kisplanning.com.au
-
wsoil.com.sg
-
embracinghiscall.com
-
makeitcount.at
-
odiclinic.org
-
bigasgrup.com
-
ihr-news.jp
-
blossombeyond50.com
-
boosthybrid.com.au
-
hotelzentral.at
-
operaslovakia.sk
-
caffeinternet.it
-
amerikansktgodis.se
-
onlybacklink.com
-
otsu-bon.com
-
rhinosfootballacademy.com
-
rota-installations.co.uk
-
dr-tremel-rednitzhembach.de
-
polychromelabs.com
-
saxtec.com
-
facettenreich27.de
-
bordercollie-nim.nl
-
4net.guru
-
navyfederalautooverseas.com
-
dubscollective.com
-
pay4essays.net
-
ymca-cw.org.uk
-
corola.es
-
gopackapp.com
-
kirkepartner.dk
-
unim.su
-
henricekupper.com
-
praxis-foerderdiagnostik.de
-
smale-opticiens.nl
-
eadsmurraypugh.com
-
qualitaetstag.de
-
bargningavesta.se
-
lenreactiv-shop.ru
-
fiscalsort.com
-
expandet.dk
-
oncarrot.com
-
manifestinglab.com
-
citymax-cr.com
-
accountancywijchen.nl
-
nativeformulas.com
-
gymnasedumanagement.com
-
tomaso.gr
-
tanciu.com
-
plastidip.com.ar
-
symphonyenvironmental.com
-
galleryartfair.com
-
commonground-stories.com
-
qlog.de
-
www1.proresult.no
-
antiaginghealthbenefits.com
-
insp.bi
-
saka.gr
-
steampluscarpetandfloors.com
-
alfa-stroy72.com
-
paymybill.guru
-
petnest.ir
-
maryloutaylor.com
-
memaag.com
-
directwindowco.com
-
ecoledansemulhouse.fr
-
stefanpasch.me
-
dlc.berlin
-
artotelamsterdam.com
-
vyhino-zhulebino-24.ru
-
whyinterestingly.ru
-
dareckleyministries.com
-
otto-bollmann.de
-
milsing.hr
-
kao.at
-
thefixhut.com
-
artige.com
-
groupe-frayssinet.fr
-
thailandholic.com
-
plv.media
-
edelman.jp
-
vetapharma.fr
-
judithjansen.com
-
candyhouseusa.com
-
tophumanservicescourses.com
-
forskolorna.org
-
maineemploymentlawyerblog.com
-
beautychance.se
-
amylendscrestview.com
-
portoesdofarrobo.com
-
zenderthelender.com
-
higadograsoweb.com
-
4youbeautysalon.com
-
buymedical.biz
-
socstrp.org
-
linnankellari.fi
-
frontierweldingllc.com
-
sevenadvertising.com
-
eglectonk.online
-
platformier.com
-
analiticapublica.es
-
zewatchers.com
-
gemeentehetkompas.nl
-
liikelataamo.fi
-
exenberger.at
-
garage-lecompte-rouen.fr
-
prochain-voyage.net
-
mir-na-iznanku.com
-
senson.fi
-
bouldercafe-wuppertal.de
-
withahmed.com
-
degroenetunnel.com
-
ouryoungminds.wordpress.com
-
echtveilig.nl
-
nijaplay.com
-
marchand-sloboda.com
-
besttechie.com
-
ontrailsandboulevards.com
-
smhydro.com.pl
-
ahouseforlease.com
-
zso-mannheim.de
-
ikads.org
-
puertamatic.es
-
logopaedie-blomberg.de
-
hellohope.com
-
jbbjw.com
-
celularity.com
-
thaysa.com
-
mediaplayertest.net
-
parebrise-tla.fr
-
stoeberstuuv.de
-
sarbatkhalsafoundation.org
-
dutchcoder.nl
-
boldcitydowntown.com
-
harveybp.com
-
trapiantofue.it
-
mikeramirezcpa.com
-
advokathuset.dk
-
jsfg.com
-
cafemattmeera.com
-
ncid.bc.ca
-
porno-gringo.com
-
ventti.com.ar
-
oemands.dk
-
you-bysia.com.au
-
rimborsobancario.net
-
associationanalytics.com
-
maureenbreezedancetheater.org
-
simpkinsedwards.co.uk
-
malychanieruchomoscipremium.com
-
gw2guilds.org
-
ora-it.de
-
walter-lemm.de
-
tsklogistik.eu
-
jameskibbie.com
-
1kbk.com.ua
-
friendsandbrgrs.com
-
victoriousfestival.co.uk
-
familypark40.com
-
fotoscondron.com
-
ceres.org.au
-
galserwis.pl
-
latribuessentielle.com
-
coastalbridgeadvisors.com
-
innote.fi
-
cirugiauretra.es
-
vox-surveys.com
-
charlottepoudroux-photographie.fr
-
real-estate-experts.com
-
bingonearme.org
-
ftf.or.at
-
iwelt.de
-
waveneyrivercentre.co.uk
-
sla-paris.com
-
courteney-cox.net
-
almosthomedogrescue.dog
-
zzyjtsgls.com
-
tulsawaterheaterinstallation.com
-
roygolden.com
-
satyayoga.de
-
muamuadolls.com
-
igorbarbosa.com
-
all-turtles.com
-
onlyresultsmarketing.com
-
jiloc.com
-
geoffreymeuli.com
-
greenpark.ch
-
i-trust.dk
-
kindersitze-vergleich.de
-
stemenstilte.nl
-
bastutunnan.se
-
daniel-akermann-architektur-und-planung.ch
-
bundabergeyeclinic.com.au
-
adultgamezone.com
-
greenfieldoptimaldentalcare.com
-
stacyloeb.com
-
bestbet.com
-
tigsltd.com
-
ledmes.ru
-
personalenhancementcenter.com
-
body-armour.online
-
hhcourier.com
-
bodyforwife.com
-
alysonhoward.com
-
luckypatcher-apkz.com
-
fannmedias.com
-
villa-marrakesch.de
-
vesinhnha.com.vn
-
bradynursery.com
-
bildungsunderlebnis.haus
-
nvwoodwerks.com
-
dramagickcom.wordpress.com
-
zimmerei-deboer.de
-
systemate.dk
-
crediacces.com
-
tinyagency.com
-
launchhubl.com
-
videomarketing.pro
-
shiftinspiration.com
-
bouquet-de-roses.com
-
retroearthstudio.com
-
teczowadolina.bytom.pl
-
xn--vrftet-pua.biz
-
alvinschwartz.wordpress.com
-
bouncingbonanza.com
-
dezatec.es
-
kedak.de
-
campus2day.de
-
proudground.org
-
mountaintoptinyhomes.com
-
zervicethai.co.th
-
herbstfeststaefa.ch
-
mindpackstudios.com
-
kidbucketlist.com.au
-
liveottelut.com
-
vickiegrayimages.com
-
serce.info.pl
-
humancondition.com
-
calabasasdigest.com
-
schoellhammer.com
-
kalkulator-oszczednosci.pl
-
newstap.com.ng
-
cite4me.org
-
lusak.at
-
interactcenter.org
-
nancy-informatique.fr
-
behavioralmedicinespecialists.com
-
takeflat.com
-
houseofplus.com
-
hihaho.com
-
kadesignandbuild.co.uk
-
eraorastudio.com
-
creamery201.com
-
tecnojobsnet.com
-
sotsioloogia.ee
-
femxarxa.cat
-
collaborativeclassroom.org
-
1team.es
-
smart-light.co.uk
-
12starhd.online
-
slashdb.com
-
unetica.fr
-
noesis.tech
-
oneheartwarriors.at
-
strategicstatements.com
-
gporf.fr
-
selfoutlet.com
-
wacochamber.com
-
pridoxmaterieel.nl
-
tux-espacios.com
-
tongdaifpthaiphong.net
-
hairstylesnow.site
-
pointos.com
-
sanaia.com
-
hugoversichert.de
-
mardenherefordshire-pc.gov.uk
-
geisterradler.de
-
sanyue119.com
-
ravensnesthomegoods.com
-
daklesa.de
-
seitzdruck.com
-
globedivers.wordpress.com
-
mank.de
-
bierensgebakkramen.nl
-
jorgobe.at
-
brigitte-erler.com
-
shiresresidential.com
-
blood-sports.net
-
asiluxury.com
-
fatfreezingmachines.com
-
pasivect.co.uk
-
kaotikkustomz.com
-
ai-spt.jp
-
webmaster-peloton.com
-
work2live.de
-
coffreo.biz
-
id-vet.com
-
cranleighscoutgroup.org
-
conexa4papers.trade
-
kunze-immobilien.de
-
simplyblessedbykeepingitreal.com
-
slimidealherbal.com
-
fitovitaforum.com
-
deschl.net
-
actecfoundation.org
-
edgewoodestates.org
-
milanonotai.it
-
botanicinnovations.com
-
despedidascostablanca.es
-
krcove-zily.eu
-
samnewbyjax.com
-
danholzmann.com
-
aselbermachen.com
-
funjose.org.gt
-
restaurantesszimmer.de
-
julis-lsa.de
-
smalltownideamill.wordpress.com
-
35-40konkatsu.net
-
better.town
-
lange.host
-
mepavex.nl
-
thomasvicino.com
-
saarland-thermen-resort.com
-
blgr.be
-
quizzingbee.com
-
chandlerpd.com
-
morawe-krueger.de
-
bimnapratica.com
-
jacquin-maquettes.com
-
manijaipur.com
-
smejump.co.th
-
edv-live.de
-
mrxermon.de
-
michaelsmeriglioracing.com
-
kissit.ca
-
waywithwords.net
-
monark.com
-
truenyc.co
-
socialonemedia.com
-
alhashem.net
-
slupetzky.at
-
faronics.com
-
foryourhealth.live
-
biapi-coaching.fr
-
ki-lowroermond.nl
-
zflas.com
-
centromarysalud.com
-
spectrmash.ru
-
pt-arnold.de
-
andersongilmour.co.uk
-
xtptrack.com
-
fotoideaymedia.es
-
rostoncastings.co.uk
-
kikedeoliveira.com
-
nsec.se
-
grupocarvalhoerodrigues.com.br
-
epwritescom.wordpress.com
-
huissier-creteil.com
-
bptdmaluku.com
-
gasbarre.com
-
durganews.com
-
smessier.com
-
psnacademy.in
-
strandcampingdoonbeg.com
-
chrissieperry.com
-
nakupunafoundation.org
-
bigbaguettes.eu
-
nhadatcanho247.com
-
argos.wityu.fund
-
makeurvoiceheard.com
-
architekturbuero-wagner.net
-
devlaur.com
-
transliminaltribe.wordpress.com
-
antonmack.de
-
tandartspraktijkheesch.nl
-
jvanvlietdichter.nl
-
devstyle.org
-
zweerscreatives.nl
-
camsadviser.com
-
tips.technology
-
stupbratt.no
-
partnertaxi.sk
-
philippedebroca.com
-
ladelirante.fr
-
gmto.fr
-
dw-css.de
-
verifort-capital.de
-
dubnew.com
-
newyou.at
-
paradicepacks.com
-
shhealthlaw.com
-
evergreen-fishing.com
-
naturstein-hotte.de
-
cactusthebrand.com
-
mirjamholleman.nl
-
autodujos.lt
-
spd-ehningen.de
-
liliesandbeauties.org
-
aniblinova.wordpress.com
-
div-vertriebsforschung.de
-
mylovelybluesky.com
-
nuzech.com
-
outcomeisincome.com
-
abogadoengijon.es
-
projetlyonturin.fr
-
myteamgenius.com
-
stampagrafica.es
-
cuppacap.com
-
fundaciongregal.org
-
mdacares.com
-
summitmarketingstrategies.com
-
vitavia.lt
-
ogdenvision.com
-
fransespiegels.nl
-
cwsitservices.co.uk
-
dinslips.se
-
lloydconstruction.com
-
turkcaparbariatrics.com
-
calxplus.eu
-
ra-staudte.de
-
sojamindbody.com
-
knowledgemuseumbd.com
-
pivoineetc.fr
-
reddysbakery.com
-
kampotpepper.gives
-
softsproductkey.com
-
abogados-en-alicante.es
-
extraordinaryoutdoors.com
-
pcprofessor.com
-
ausair.com.au
-
xn--logopdie-leverkusen-kwb.de
-
labobit.it
-
cerebralforce.net
-
naturalrapids.com
-
pv-design.de
-
bigler-hrconsulting.ch
-
space.ua
-
aunexis.ch
-
answerstest.ru
-
effortlesspromo.com
-
piajeppesen.dk
-
carriagehousesalonvt.com
-
airconditioning-waalwijk.nl
-
kojinsaisei.info
-
simoneblum.de
-
solhaug.tk
-
tarotdeseidel.com
-
herbayupro.com
-
poultrypartners.nl
-
homng.net
-
lillegrandpalais.com
-
euro-trend.pl
-
marathonerpaolo.com
-
simulatebrain.com
-
hmsdanmark.dk
-
first-2-aid-u.com
-
rollingrockcolumbia.com
-
beyondmarcomdotcom.wordpress.com
-
ulyssemarketing.com
-
carlosja.com
-
sinal.org
-
crowd-patch.co.uk
-
ralister.co.uk
-
tonelektro.nl
-
xn--fnsterputssollentuna-39b.se
-
leda-ukraine.com.ua
-
jyzdesign.com
-
miraclediet.fun
-
madinblack.com
-
notsilentmd.org
-
thedresserie.com
-
musictreehouse.net
-
roadwarrior.app
-
homecomingstudio.com
-
xn--rumung-bua.online
-
backstreetpub.com
-
themadbotter.com
-
stoeferlehalle.de
-
thewellnessmimi.com
-
lynsayshepherd.co.uk
-
podsosnami.ru
-
mrtour.site
-
bloggyboulga.net
-
tanzprojekt.com
-
commercialboatbuilding.com
-
testzandbakmetmening.online
-
mastertechengineering.com
-
grelot-home.com
-
shonacox.com
-
filmstreamingvfcomplet.be
-
kostenlose-webcams.com
-
sipstroysochi.ru
-
international-sound-awards.com
-
hkr-reise.de
-
321play.com.hk
-
bodyfulls.com
-
punchbaby.com
-
officehymy.com
-
arteservicefabbro.com
-
sw1m.ru
-
kingfamily.construction
-
assurancesalextrespaille.fr
-
siliconbeach-realestate.com
-
tennisclubetten.nl
-
jobcenterkenya.com
-
chavesdoareeiro.com
-
mirkoreisser.de
-
latestmodsapks.com
-
gantungankunciakrilikbandung.com
-
groupe-cets.com
-
clos-galant.com
-
mercantedifiori.com
-
corendonhotels.com
-
gaiam.nl
-
pocket-opera.de
-
oldschoolfun.net
-
lykkeliv.net
-
haar-spange.com
-
vdberg-autoimport.nl
-
dr-seleznev.com
-
lescomtesdemean.be
-
werkkring.nl
-
theclubms.com
-
modamilyon.com
-
pogypneu.sk
-
happyeasterimages.org
-
binder-buerotechnik.at
-
kojima-shihou.com
-
yousay.site
-
huehnerauge-entfernen.de
-
sterlingessay.com
-
pmc-services.de
-
klusbeter.nl
-
greenko.pl
-
polymedia.dk
-
streamerzradio1.site
-
chatizel-paysage.fr
-
readberserk.com
-
joseconstela.com
-
dr-pipi.de
-
promalaga.es
-
biortaggivaldelsa.com
-
croftprecision.co.uk
-
cheminpsy.fr
-
christinarebuffetcourses.com
-
joyeriaorindia.com
-
iqbalscientific.com
-
diversiapsicologia.es
-
abl1.net
-
modelmaking.nl
-
shsthepapercut.com
-
i-arslan.de
-
loprus.pl
-
blumenhof-wegleitner.at
-
datacenters-in-europe.com
-
aminaboutique247.com
-
aakritpatel.com
-
parkstreetauto.net
-
glennroberts.co.nz
-
centuryrs.com
-
smokeysstoves.com
-
syndikat-asphaltfieber.de
-
acomprarseguidores.com
-
love30-chanko.com
-
theduke.de
-
mediaacademy-iraq.org
-
wurmpower.at
-
verbisonline.com
-
uranus.nl
-
tradiematepro.com.au
-
lefumetdesdombes.com
-
easytrans.com.au
-
jenniferandersonwriter.com
-
controldekk.com
-
vloeren-nu.nl
-
gonzalezfornes.es
-
tampaallen.com
-
hotelsolbh.com.br
-
slwgs.org
-
live-your-life.jp
-
abogadosadomicilio.es
-
vihannesporssi.fi
-
jadwalbolanet.info
-
evangelische-pfarrgemeinde-tuniberg.de
-
ditog.fr
-
gasolspecialisten.se
-
gratispresent.se
-
securityfmm.com
-
irinaverwer.com
-
baumkuchenexpo.jp
-
katketytaanet.fi
-
psc.de
-
myzk.site
-
aprepol.com
-
levdittliv.se
-
milestoneshows.com
-
hvccfloorcare.com
-
atozdistribution.co.uk
-
jasonbaileystudio.com
-
lucidinvestbank.com
-
kaminscy.com
-
ftlc.es
-
narcert.com
-
ilcdover.com
-
balticdermatology.lt
-
parkcf.nl
-
advizewealth.com
-
completeweddingkansas.com
-
web.ion.ag
-
siluet-decor.ru
-
noixdecocom.fr
-
mooreslawngarden.com
-
live-con-arte.de
-
smithmediastrategies.com
-
burkert-ideenreich.de
-
drugdevice.org
-
appsformacpc.com
-
nachhilfe-unterricht.com
-
berlin-bamboo-bikes.org
-
coding-machine.com
-
dublikator.com
-
lebellevue.fr
-
art2gointerieurprojecten.nl
-
spargel-kochen.de
-
mousepad-direkt.de
-
hypozentrum.com
-
lorenacarnero.com
-
consultaractadenacimiento.com
-
zonamovie21.net
-
penco.ie
-
norpol-yachting.com
-
imadarchid.com
-
olejack.ru
-
compliancesolutionsstrategies.com
-
y-archive.com
-
ruralarcoiris.com
-
notmissingout.com
-
babcockchurch.org
-
entopic.com
-
spacecitysisters.org
-
campusoutreach.org
-
xoabigail.com
-
drnice.de
-
oneplusresource.org
-
wasmachtmeinfonds.at
-
101gowrie.com
-
bhwlawfirm.com
-
gamesboard.info
-
ligiercenter-sachsen.de
-
testcoreprohealthuk.com
-
solinegraphic.com
-
pcp-nc.com
-
tstaffing.nl
-
irishmachineryauctions.com
-
plotlinecreative.com
-
cnoia.org
-
xn--fn-kka.no
-
montrium.com
-
devok.info
-
mapawood.com
-
evologic-technologies.com
-
ostheimer.at
-
bristolaeroclub.co.uk
-
elimchan.com
-
csgospeltips.se
-
lightair.com
-
lubetkinmediacompanies.com
-
rumahminangberdaya.com
-
theapifactory.com
-
flexicloud.hk
-
micro-automation.de
-
htchorst.nl
-
profectis.de
-
wellplast.se
-
zimmerei-fl.de
-
cursosgratuitosnainternet.com
-
stopilhan.com
-
haremnick.com
-
walkingdeadnj.com
-
yourobgyn.net
-
oslomf.no
-
hairnetty.wordpress.com
-
mountsoul.de
-
baronloan.org
-
associacioesportivapolitg.cat
-
sachnendoc.com
-
bee4win.com
-
insigniapmg.com
-
perbudget.com
-
carolinepenn.com
-
miriamgrimm.de
-
romeguidedvisit.com
-
mooglee.com
-
connectedace.com
-
mrsplans.net
-
ussmontanacommittee.us
-
sabel-bf.com
-
wolf-glas-und-kunst.de
-
insidegarage.pl
-
thomas-hospital.de
-
journeybacktolife.com
-
bbsmobler.se
-
drinkseed.com
-
comarenterprises.com
-
kariokids.com
-
fensterbau-ziegler.de
-
intecwi.com
-
westdeptfordbuyrite.com
-
tanzschule-kieber.de
-
sexandfessenjoon.wordpress.com
-
fax-payday-loans.com
-
schraven.de
-
crowcanyon.com
-
imperfectstore.com
-
comparatif-lave-linge.fr
-
allure-cosmetics.at
-
erstatningsadvokaterne.dk
-
levihotelspa.fi
-
firstpaymentservices.com
-
microcirc.net
-
rocketccw.com
-
8449nohate.org
-
classycurtainsltd.co.uk
-
kaliber.co.jp
-
schoolofpassivewealth.com
-
chefdays.de
-
lecantou-coworking.com
-
asgestion.com
-
uimaan.fi
-
lionware.de
-
buroludo.nl
-
eco-southafrica.com
-
darnallwellbeing.org.uk
-
sportverein-tambach.de
-
layrshift.eu
-
koko-nora.dk
-
juneauopioidworkgroup.org
-
seevilla-dr-sturm.at
-
wychowanieprzedszkolne.pl
-
bookspeopleplaces.com
-
people-biz.com
-
berliner-versicherungsvergleich.de
-
forestlakeuca.org.au
-
refluxreducer.com
-
jandaonline.com
-
kuntokeskusrok.fi
-
webhostingsrbija.rs
-
nacktfalter.de
-
elpa.se
-
aco-media.nl
-
esope-formation.fr
-
pierrehale.com
-
importardechina.info
-
pixelarttees.com
-
cimanchesterescorts.co.uk
-
baylegacy.com
-
boompinoy.com
-
cuspdental.com
-
nurturingwisdom.com
-
kevinjodea.com
-
mediaclan.info
-
cortec-neuro.com
-
supportsumba.nl
-
heurigen-bauer.at
-
triggi.de
-
delchacay.com.ar
-
heidelbergartstudio.gallery
-
fibrofolliculoma.info
-
mariposapropaneaz.com
-
autodemontagenijmegen.nl
-
craftleathermnl.com
-
2ekeus.nl
-
heliomotion.com
-
verytycs.com
-
dpo-as-a-service.com
-
parking.netgateway.eu
-
talentwunder.com
-
craigmccabe.fun
-
broseller.com
-
lachofikschiet.nl
-
desert-trails.com
-
ceid.info.tr
-
deltacleta.cat
-
highimpactoutdoors.net
-
iphoneszervizbudapest.hu
-
helenekowalsky.com
-
marketingsulweb.com
-
ampisolabergeggi.it
-
maratonaclubedeportugal.com
-
baustb.de
-
theletter.company
-
toreria.es
-
nandistribution.nl
-
asteriag.com
-
spylista.com
-
surespark.org.uk
-
admos-gleitlager.de
-
financescorecard.com
-
wari.com.pe
-
c2e-poitiers.com
-
run4study.com
-
rozemondcoaching.nl
-
dnepr-beskid.com.ua
-
blewback.com
-
ivfminiua.com
-
bayoga.co.uk
-
twohourswithlena.wordpress.com
-
new.devon.gov.uk
-
vancouver-print.ca
-
sobreholanda.com
-
vietlawconsultancy.com
-
anteniti.com
-
marcuswhitten.site
-
humanityplus.org
-
meusharklinithome.wordpress.com
-
corelifenutrition.com
-
xn--singlebrsen-vergleich-nec.com
-
cursoporcelanatoliquido.online
-
psa-sec.de
-
catholicmusicfest.com
-
bafuncs.org
-
jobmap.at
-
seminoc.com
-
itelagen.com
-
slimani.net
-
jolly-events.com
-
stallbyggen.se
-
vibethink.net
-
n1-headache.com
-
limassoldriving.com
-
artallnightdc.com
-
argenblogs.com.ar
-
ilive.lt
-
ivivo.es
-
anybookreader.de
-
trackyourconstruction.com
-
dsl-ip.de
-
allfortheloveofyou.com
-
mrsfieldskc.com
-
jakekozmor.com
-
nicoleaeschbachorg.wordpress.com
-
sportiomsportfondsen.nl
-
upplandsspar.se
-
aodaichandung.com
-
extensionmaison.info
-
precisionbevel.com
-
agence-referencement-naturel-geneve.net
-
pickanose.com
-
polzine.net
-
suncrestcabinets.ca
-
hashkasolutindo.com
-
woodleyacademy.org
-
manutouchmassage.com
-
nestor-swiss.ch
-
schutting-info.nl
-
micahkoleoso.de
-
abuelos.com
-
quemargrasa.net
-
handi-jack-llc.com
-
austinlchurch.com
-
employeesurveys.com
-
waermetauscher-berechnen.de
-
lapmangfpt.info.vn
-
triactis.com
-
norovirus-ratgeber.de
-
balticdentists.com
-
toponlinecasinosuk.co.uk
-
castillobalduz.es
-
jerling.de
-
rebeccarisher.com
-
no-plans.com
-
body-guards.it
-
imaginado.de
-
songunceliptv.com
-
educar.org
-
sairaku.net
-
bxdf.info
-
urist-bogatyr.ru
-
luxurytv.jp
-
yamalevents.com
-
mytechnoway.com
-
vorotauu.ru
-
travelffeine.com
-
agence-chocolat-noir.com
-
allentownpapershow.com
-
mbfagency.com
-
d1franchise.com
-
littlebird.salon
-
brevitempore.net
-
danielblum.info
-
harpershologram.wordpress.com
-
hardinggroup.com
-
augenta.com
-
kath-kirche-gera.de
-
seproc.hn
-
aurum-juweliere.de
-
stormwall.se
-
sahalstore.com
-
smartypractice.com
-
xn--thucmctc-13a1357egba.com
-
justinvieira.com
-
DupontSellsHomes.com
-
the-virtualizer.com
-
thenewrejuveme.com
-
urmasiimariiuniri.ro
-
rerekatu.com
-
rieed.de
-
delawarecorporatelaw.com
-
finde-deine-marke.de
-
team-montage.dk
-
huesges-gruppe.de
-
izzi360.com
-
bricotienda.com
-
hoteledenpadova.it
-
edrcreditservices.nl
-
abogadosaccidentetraficosevilla.es
-
noskierrenteria.com
-
havecamerawilltravel2017.wordpress.com
-
cleliaekiko.online
-
radaradvies.nl
-
skanah.com
-
fairfriends18.de
-
seagatesthreecharters.com
-
rksbusiness.com
-
patrickfoundation.net
-
presseclub-magdeburg.de
-
copystar.co.uk
-
pelorus.group
-
hebkft.hu
-
kamahouse.net
-
opatrovanie-ako.sk
-
nokesvilledentistry.com
-
kosterra.com
-
danubecloud.com
-
foretprivee.ca
-
ohidesign.com
-
minipara.com
-
hiddencitysecrets.com.au
-
deoudedorpskernnoordwijk.nl
-
healthyyworkout.com
-
winrace.no
-
iyengaryogacharlotte.com
-
dushka.ua
-
servicegsm.net
-
moveonnews.com
-
richard-felix.co.uk
-
deko4you.at
-
anthonystreetrimming.com
-
apprendrelaudit.com
-
tinkoff-mobayl.ru
-
carrybrands.nl
-
em-gmbh.ch
-
plantag.de
-
faroairporttransfers.net
-
lichencafe.com
-
ncs-graphic-studio.com
-
starsarecircular.org
-
ungsvenskarna.se
-
braffinjurylawfirm.com
-
merzi.info
-
gadgetedges.com
-
fizzl.ru
-
hannah-fink.de
-
atalent.fi
-
rafaut.com
-
kmbshipping.co.uk
-
panelsandwichmadrid.es
-
planchaavapor.net
-
kafu.ch
-
girlillamarketing.com
-
sporthamper.com
-
123vrachi.ru
-
brawnmediany.com
-
myhealth.net.au
-
revezlimage.com
-
zieglerbrothers.de
-
apolomarcas.com
-
upmrkt.co
-
ziegler-praezisionsteile.de
-
the-domain-trader.com
-
dontpassthepepper.com
-
pubweb.carnet.hr
-
theadventureedge.com
-
adoptioperheet.fi
-
pinkexcel.com
-
sloverse.com
-
denovofoodsgroup.com
-
osterberg.fi
-
d2marketing.co.uk
-
lapinvihreat.fi
-
jusibe.com
-
alsace-first.com
-
todocaracoles.com
-
igfap.com
-
instatron.net
-
macabaneaupaysflechois.com
-
danskretursystem.dk
-
scenepublique.net
-
idemblogs.com
-
bogdanpeptine.ro
-
veybachcenter.de
-
autofolierung-lu.de
-
praxis-management-plus.de
-
hatech.io
-
smogathon.com
-
pmcimpact.com
-
eaglemeetstiger.de
-
lbcframingelectrical.com
-
cyntox.com
-
boulderwelt-muenchen-west.de
-
blacksirius.de
-
trystana.com
-
thee.network
-
id-et-d.fr
-
peterstrobos.com
-
neuschelectrical.co.za
-
leeuwardenstudentcity.nl
-
oceanastudios.com
-
vibehouse.rw
-
remcakram.com
-
nataschawessels.com
-
makeflowers.ru
-
trulynolen.co.uk
-
phantastyk.com
-
bunburyfreightservices.com.au
-
woodworkersolution.com
-
coding-marking.com
-
bargningharnosand.se
-
synlab.lt
-
webcodingstudio.com
-
spsshomeworkhelp.com
-
beaconhealthsystem.org
-
raschlosser.de
-
alten-mebel63.ru
-
lapinlviasennus.fi
-
kamienny-dywan24.pl
-
brandl-blumen.de
-
corona-handles.com
-
vermoote.de
-
karacaoglu.nl
-
bockamp.com
-
ianaswanson.com
-
torgbodenbollnas.se
-
urclan.net
-
deprobatehelp.com
-
allamatberedare.se
-
freie-gewerkschaften.de
-
johnsonfamilyfarmblog.wordpress.com
-
craigvalentineacademy.com
-
sofavietxinh.com
-
architecturalfiberglass.org
-
ilso.net
-
paulisdogshop.de
-
net
true
-
pid
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
-
prc
sqbcoreservice
dbsnmp
mydesktopservice
outlook
ocomm
excel
mydesktopqos
isqlplussvc
onenote
tbirdconfig
msaccess
encsvc
infopath
steam
thebat
agntsvc
sql
visio
wordpad
winword
dbeng50
powerpnt
firefox
xfssvccon
mspub
oracle
thunderbird
ocssd
synctime
ocautoupds
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
4085
-
svc
memtas
mepocs
backup
sophos
sql
svc$
veeam
vss
Extracted
-
C:\Recovery\ok1t1h7q43-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ok1t1h7q43. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2DBB4A69859B15D7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/2DBB4A69859B15D7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: VpByGND9eA3MgeWx8eenLDF50eNWPgWWSG2sHCvZnVVvuyqawqOibZJFf1ZRigLu Yjpfh9e9HOOxcQYHjUgfCuEGNjFluRYVB3aVET1a4kCZ19wdvcwxGEZ74XAwygMS ekxS87ohOLQPeW7mP/K/CnP141LPK6TCzBd0ODivEYR6JYwOe0a8O/3sMshYRLFl 3QmU4+l6seLrLnHNI3G0y0MhSVyIX+iOnsRxyrm0nADxzgZt81zDMVktYoR86uMM HgRy/mYLGANNq3vQhsdn4bT7yTsn/EMdD2Sen/pQTvEReWm869Z1uZ3ogh8x1OgO oP23bGBVAa4W8L5kLkh/uJxPgxE1BzL8mxtMnSxNl9+iki0yRnrVNynrBq/5ZxYo vI+RtpjWDCs0sGm7pgqdberwDZHrkQOgNGdx6T2iLTBl+yyinhgoIgXfkpxofl+4 xnjHRfjLsayZJl80PC8ovRkeQuc3NBOVVYobIp8QzsfkELL5YpFQubj4j7dsWiEe yuSZm0aTXUZN74+yiczD26BKoZZANWWGNxYzwPWBDYtJP3pZaKbJFgtQe4xqXII7 ISp85i12zKtVjjmmoc1fbkAv2QuqSELHFRAyVM8AHxJDMdVQcFk0A9Cweuy27KLA thJOg6IkeGIz47GCGXX2dZtdkxgkccyCOU7tFCPFCZDweFeORYmYRd8w1ome2xF6 ew3v7yNxcj9sN1Ex1EUBBz/wuTXu8JqyZxzPWzHWGV0/K9ncQKRDeypuda2J6UDn DgS2yVVkWuMCy6a3cfVsZwc2Tqs1wJdAIxL95/yki1jwRr3nK8s4P1KPRSbuskJc czybN9SMpcTGD7sE0QUjlsHZ1lzzv3AqkrHfTaQpSwxJkW04eWKDrtZaeVpf9eXw wrgb9NlYy4ShPMORcxS4k0Ie+SBZ+GSKfYN0fTYTNFJoKPUxUaNYtgJ3UPmDa88b uo8NHUmqpB/vvAQSpg64ozb3m9MOdAO+yU4GRMhUIQ1njSHRlYFzJMvNHoriFhUH 0GxYYpjpRQo/jdIasLDS4VgqbSzcCisOnAXfjzYvUSkwtEQEmCqNE9XeX4IiJ7sb vCqJfFVThvzsRmxnDu6xA4a2v7Kra8vLVD+yBRaDbj2aS3PIGYp11qPjOayENRUh 0Et3XRCP16N72q4zFimHqAArYZUqYNffjAH07+MyhVSrhGAaRsZPDdq8GRR7W8js AmMYvVsKfIv9vKcxqWh0FxFkit9d8Lwg6I6FoL4qqSRK3NQE1NDVCE3pwYGS7At1 ETvcF/2vqduDjFf2aqQsFME2Rcgwg/MsQelYFd25kdymyqKpEFfQNuTXuFVmgJFB 36lBM9UXr7ZG8PVt9+0+vyg/KK9bgMJ6SyQQuWJxZvBOrz4CFxp6zop62BKF5w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2DBB4A69859B15D7
-
http://decryptor.cc/2DBB4A69859B15D7
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DNXeNcyLON = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe" 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\U: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\I: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\K: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\Y: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\B: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\R: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\D: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\E: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\Q: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\S: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\F: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\G: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\M: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\W: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\Z: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\J: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\P: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\A: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\V: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\L: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\N: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\O: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\T: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened (read-only) \??\H: 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\748p90w2g.bmp" 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe - Drops file in Program Files directory 27 IoCs
description ioc Process File opened for modification \??\c:\program files\ReceiveTest.ppsx 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\RestoreUnblock.rtf 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\CloseUnlock.mpeg3 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\ConfirmConvert.cr2 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\EnterUse.dotm 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\SplitGroup.snd 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\StopCopy.au 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\ConfirmPop.i64 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\ReceiveSubmit.jpg 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\UndoUnpublish.xlsx 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\ResizeExpand.ppsx 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\UpdateHide.jpeg 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\BackupAssert.asx 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\ExitRename.pptm 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\LockConvertTo.html 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\ProtectMerge.wvx 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File created \??\c:\program files (x86)\ok1t1h7q43-readme.txt 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\EnterFormat.dib 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\ResumeUnlock.ogg 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\UninstallPublish.jfif 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\EditReset.pptm 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\GetPush.ogg 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\SelectHide.dib 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\WriteEnable.emf 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File created \??\c:\program files\ok1t1h7q43-readme.txt 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\DismountSuspend.odt 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe File opened for modification \??\c:\program files\GrantPing.midi 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3728 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe 3728 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe 2248 powershell.exe 2248 powershell.exe 2248 powershell.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3728 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe Token: SeDebugPrivilege 2248 powershell.exe Token: SeBackupPrivilege 4044 vssvc.exe Token: SeRestorePrivilege 4044 vssvc.exe Token: SeAuditPrivilege 4044 vssvc.exe Token: SeTakeOwnershipPrivilege 3728 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3728 wrote to memory of 2248 3728 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe 97 PID 3728 wrote to memory of 2248 3728 2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_babc36b5ce70990d1cf3d47c704fc2db_revil.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:4944
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:81⤵PID:2484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recovery\ok1t1h7q43-readme.txt
- Size 6KB
- SHA256 611e1645fa4889bfd091f45a47392bf28d98bf8d5f0dcb775fd4c1a1945391cf
- MD5 7c19a22857b7da1895fe7afa73a8fa2b
- SHA1 e4d926d13295aee3579031eb755b27af58966add
- SHA512 091b2dc0159933b04f808e296c9c1a4363503906f3c6478228fb10c6779836a2e1035709f37561af90a5d4db41af70b251604535bf851fca6f229413d2696d7f
- SSDEEP 96:GLEiNsQKxU3TPuaG2UgQ1E/0kmNBXX2jTVz9j0VVVd9Pr+5u:GLE43jDZUgQ1EK2jhWftDx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nj2sqeaw.503.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512