Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 11:32
Static task
static1
Behavioral task
behavioral1
Sample
30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe
Resource
win10v2004-20240426-en
General
-
Target
30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe
-
Size
324KB
-
MD5
cbdedc1f3a4f57b61ec2d497ba18ce1f
-
SHA1
d3cd6370a4936a1366bc19443616939a6f24c410
-
SHA256
30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8
-
SHA512
879b0a23939c8b0f5e6f73968d7a55c79b292deab6c70995bc57cc0b861dc306c94c6f915b580d1eda8e7ebdceea11ea81aba653000f8f4d3d0daf39071c789c
-
SSDEEP
6144:ayiouaWCsfHt29qABThGvGJKCQcXkqE92RIUF6gXuRssjL8j6tFpJXq0AIlN1X:frtxsf4TcGKCFI2JT+9u6jpJa0NN1
Malware Config
Extracted
sodinokibi
$2a$10$gY18iotaXYmlrMg1kdA1A.nn.3UCuyrtv2KK1NDgXEMdKfXHHwDK.
7295
femxarxa.cat
mooshine.com
classycurtainsltd.co.uk
bookspeopleplaces.com
zonamovie21.net
waveneyrivercentre.co.uk
real-estate-experts.com
tigsltd.com
galleryartfair.com
herbstfeststaefa.ch
readberserk.com
waermetauscher-berechnen.de
haremnick.com
mariposapropaneaz.com
luckypatcher-apkz.com
slimani.net
greenpark.ch
assurancesalextrespaille.fr
cite4me.org
gymnasedumanagement.com
dsl-ip.de
verifort-capital.de
merzi.info
destinationclients.fr
kuntokeskusrok.fi
tongdaifpthaiphong.net
cortec-neuro.com
igorbarbosa.com
bridgeloanslenders.com
hkr-reise.de
pasvenska.se
monark.com
cheminpsy.fr
drnice.de
thedad.com
smartypractice.com
csgospeltips.se
lucidinvestbank.com
exenberger.at
gw2guilds.org
shadebarandgrillorlando.com
videomarketing.pro
hypozentrum.com
baustb.de
xoabigail.com
centrospgolega.com
dublikator.com
jameskibbie.com
geisterradler.de
wari.com.pe
bbsmobler.se
jeanlouissibomana.com
coastalbridgeadvisors.com
antenanavi.com
fundaciongregal.org
123vrachi.ru
vitavia.lt
autopfand24.de
micro-automation.de
sahalstore.com
hatech.io
logopaedie-blomberg.de
pubweb.carnet.hr
oncarrot.com
flexicloud.hk
vickiegrayimages.com
live-con-arte.de
smithmediastrategies.com
rota-installations.co.uk
cirugiauretra.es
gaiam.nl
toreria.es
bhwlawfirm.com
mercantedifiori.com
girlillamarketing.com
abitur-undwieweiter.de
collaborativeclassroom.org
schmalhorst.de
lukeshepley.wordpress.com
4youbeautysalon.com
bargningavesta.se
whyinterestingly.ru
oneheartwarriors.at
transliminaltribe.wordpress.com
vitalyscenter.es
quickyfunds.com
manifestinglab.com
brevitempore.net
greenfieldoptimaldentalcare.com
harveybp.com
myhealth.net.au
vox-surveys.com
vihannesporssi.fi
nestor-swiss.ch
global-kids.info
mir-na-iznanku.com
garage-lecompte-rouen.fr
hhcourier.com
bundabergeyeclinic.com.au
ivfminiua.com
atmos-show.com
bierensgebakkramen.nl
parks-nuernberg.de
hiddencitysecrets.com.au
plotlinecreative.com
dlc.berlin
uranus.nl
bxdf.info
pier40forall.org
sofavietxinh.com
ctrler.cn
fannmedias.com
michaelsmeriglioracing.com
pcprofessor.com
ceres.org.au
hotelsolbh.com.br
kingfamily.construction
levihotelspa.fi
olejack.ru
kaotikkustomz.com
xlarge.at
faronics.com
rocketccw.com
maineemploymentlawyerblog.com
justinvieira.com
oslomf.no
plv.media
kostenlose-webcams.com
meusharklinithome.wordpress.com
dubscollective.com
iphoneszervizbudapest.hu
iwelt.de
the-domain-trader.com
chatizel-paysage.fr
falcou.fr
lusak.at
pickanose.com
balticdermatology.lt
yousay.site
gadgetedges.com
forskolorna.org
ulyssemarketing.com
tux-espacios.com
hannah-fink.de
thomas-hospital.de
analiticapublica.es
marketingsulweb.com
lykkeliv.net
finediningweek.pl
abogadoengijon.es
carriagehousesalonvt.com
groupe-frayssinet.fr
promesapuertorico.com
edrcreditservices.nl
skiltogprint.no
bptdmaluku.com
directwindowco.com
joyeriaorindia.com
panelsandwichmadrid.es
tomoiyuma.com
alvinschwartz.wordpress.com
desert-trails.com
www1.proresult.no
roygolden.com
kojinsaisei.info
vannesteconstruct.be
oneplusresource.org
croftprecision.co.uk
upplandsspar.se
solerluethi-allart.ch
podsosnami.ru
shhealthlaw.com
nmiec.com
braffinjurylawfirm.com
elpa.se
tetinfo.in
bigler-hrconsulting.ch
toponlinecasinosuk.co.uk
bodyforwife.com
embracinghiscall.com
krcove-zily.eu
skanah.com
mylovelybluesky.com
walkingdeadnj.com
amylendscrestview.com
rehabilitationcentersinhouston.net
yamalevents.com
ilso.net
tenacitytenfold.com
brawnmediany.com
hairnetty.wordpress.com
myteamgenius.com
centromarysalud.com
filmvideoweb.com
narcert.com
walter-lemm.de
anybookreader.de
executiveairllc.com
denovofoodsgroup.com
datacenters-in-europe.com
pixelarttees.com
darrenkeslerministries.com
faroairporttransfers.net
saxtec.com
besttechie.com
naturalrapids.com
quemargrasa.net
quizzingbee.com
luxurytv.jp
heliomotion.com
lange.host
qualitus.com
brandl-blumen.de
artallnightdc.com
longislandelderlaw.com
madinblack.com
shsthepapercut.com
naswrrg.org
sportsmassoren.com
xn--fnsterputssollentuna-39b.se
lapmangfpt.info.vn
theduke.de
sexandfessenjoon.wordpress.com
westdeptfordbuyrite.com
babcockchurch.org
kadesignandbuild.co.uk
theclubms.com
boosthybrid.com.au
hushavefritid.dk
julis-lsa.de
kmbshipping.co.uk
gonzalezfornes.es
jenniferandersonwriter.com
ikads.org
allfortheloveofyou.com
amerikansktgodis.se
woodleyacademy.org
pv-design.de
pcp-nc.com
zso-mannheim.de
insp.bi
mrsplans.net
homesdollar.com
dnepr-beskid.com.ua
jasonbaileystudio.com
nosuchthingasgovernment.com
joseconstela.com
slupetzky.at
alhashem.net
gmto.fr
verbisonline.com
testcoreprohealthuk.com
urmasiimariiuniri.ro
effortlesspromo.com
aarvorg.com
artige.com
cyntox.com
tecnojobsnet.com
kissit.ca
deltacleta.cat
senson.fi
milltimber.aberdeen.sch.uk
mountaintoptinyhomes.com
grelot-home.com
piajeppesen.dk
bauertree.com
samnewbyjax.com
heurigen-bauer.at
cnoia.org
dr-tremel-rednitzhembach.de
linnankellari.fi
artotelamsterdam.com
humancondition.com
aakritpatel.com
bradynursery.com
koken-voor-baby.nl
smokeysstoves.com
seagatesthreecharters.com
licor43.de
villa-marrakesch.de
stefanpasch.me
epwritescom.wordpress.com
mousepad-direkt.de
sporthamper.com
ftf.or.at
izzi360.com
simpliza.com
zervicethai.co.th
herbayupro.com
pinkexcel.com
porno-gringo.com
romeguidedvisit.com
corendonhotels.com
blossombeyond50.com
d2marketing.co.uk
tuuliautio.fi
copystar.co.uk
siluet-decor.ru
allamatberedare.se
winrace.no
precisionbevel.com
rostoncastings.co.uk
xn--singlebrsen-vergleich-nec.com
fransespiegels.nl
shiresresidential.com
songunceliptv.com
sojamindbody.com
deschl.net
farhaani.com
baylegacy.com
sloverse.com
ateliergamila.com
hardinggroup.com
adoptioperheet.fi
aniblinova.wordpress.com
lubetkinmediacompanies.com
beyondmarcomdotcom.wordpress.com
ncuccr.org
tips.technology
promalaga.es
newstap.com.ng
thefixhut.com
ino-professional.ru
dramagickcom.wordpress.com
christinarebuffetcourses.com
zimmerei-fl.de
kosterra.com
morawe-krueger.de
deko4you.at
lmtprovisions.com
micahkoleoso.de
huehnerauge-entfernen.de
stupbratt.no
xn--rumung-bua.online
2ekeus.nl
baptisttabernacle.com
corola.es
hashkasolutindo.com
aunexis.ch
profectis.de
friendsandbrgrs.com
otsu-bon.com
slimidealherbal.com
polymedia.dk
torgbodenbollnas.se
kidbucketlist.com.au
veybachcenter.de
vdberg-autoimport.nl
symphonyenvironmental.com
blumenhof-wegleitner.at
agence-referencement-naturel-geneve.net
baumkuchenexpo.jp
iyengaryogacharlotte.com
admos-gleitlager.de
nandistribution.nl
syndikat-asphaltfieber.de
fax-payday-loans.com
eadsmurraypugh.com
liliesandbeauties.org
rumahminangberdaya.com
familypark40.com
edgewoodestates.org
jyzdesign.com
botanicinnovations.com
imadarchid.com
seminoc.com
softsproductkey.com
clos-galant.com
rerekatu.com
euro-trend.pl
darnallwellbeing.org.uk
antonmack.de
thee.network
live-your-life.jp
slashdb.com
solinegraphic.com
acomprarseguidores.com
jandaonline.com
zenderthelender.com
stingraybeach.com
kalkulator-oszczednosci.pl
eaglemeetstiger.de
saarland-thermen-resort.com
puertamatic.es
daniel-akermann-architektur-und-planung.ch
praxis-foerderdiagnostik.de
coding-machine.com
boisehosting.net
finde-deine-marke.de
danubecloud.com
associationanalytics.com
edv-live.de
insidegarage.pl
kedak.de
radaradvies.nl
maasreusel.nl
run4study.com
celularity.com
greenko.pl
sachnendoc.com
jorgobe.at
allure-cosmetics.at
mountsoul.de
spd-ehningen.de
catholicmusicfest.com
sotsioloogia.ee
ncid.bc.ca
rebeccarisher.com
cerebralforce.net
nhadatcanho247.com
dpo-as-a-service.com
wien-mitte.co.at
jvanvlietdichter.nl
igfap.com
associacioesportivapolitg.cat
vyhino-zhulebino-24.ru
unim.su
365questions.org
neuschelectrical.co.za
colorofhorses.com
vetapharma.fr
noskierrenteria.com
deoudedorpskernnoordwijk.nl
sabel-bf.com
thaysa.com
frontierweldingllc.com
drfoyle.com
modelmaking.nl
stoneys.ch
victoriousfestival.co.uk
levdittliv.se
lachofikschiet.nl
asiluxury.com
americafirstcommittee.org
modestmanagement.com
pelorus.group
tsklogistik.eu
simulatebrain.com
houseofplus.com
polzine.net
schraven.de
atalent.fi
otto-bollmann.de
kevinjodea.com
kirkepartner.dk
verytycs.com
asgestion.com
crosspointefellowship.church
chefdays.de
ncs-graphic-studio.com
tinkoff-mobayl.ru
expandet.dk
hebkft.hu
cimanchesterescorts.co.uk
hvccfloorcare.com
montrium.com
jobcenterkenya.com
kamahouse.net
controldekk.com
ceid.info.tr
pmcimpact.com
ligiercenter-sachsen.de
socialonemedia.com
accountancywijchen.nl
norovirus-ratgeber.de
rollingrockcolumbia.com
pridoxmaterieel.nl
cranleighscoutgroup.org
mediaplayertest.net
maryloutaylor.com
nataschawessels.com
opatrovanie-ako.sk
berliner-versicherungsvergleich.de
kampotpepper.gives
lebellevue.fr
seitzdruck.com
devstyle.org
schlafsack-test.net
ecopro-kanto.com
hellohope.com
n1-headache.com
you-bysia.com.au
zzyjtsgls.com
calxplus.eu
penco.ie
boompinoy.com
d1franchise.com
caffeinternet.it
delchacay.com.ar
rozemondcoaching.nl
iwr.nl
sla-paris.com
baronloan.org
stemenstilte.nl
klimt2012.info
blewback.com
ihr-news.jp
35-40konkatsu.net
ogdenvision.com
lynsayshepherd.co.uk
elimchan.com
rosavalamedahr.com
fotoscondron.com
advokathuset.dk
wychowanieprzedszkolne.pl
leather-factory.co.jp
facettenreich27.de
refluxreducer.com
ouryoungminds.wordpress.com
creative-waves.co.uk
smalltownideamill.wordpress.com
lescomtesdemean.be
purposeadvisorsolutions.com
lefumetdesdombes.com
ftlc.es
almosthomedogrescue.dog
notsilentmd.org
mank.de
insigniapmg.com
lorenacarnero.com
tandartspraktijkheesch.nl
ontrailsandboulevards.com
hrabritelefon.hr
web.ion.ag
esope-formation.fr
simplyblessedbykeepingitreal.com
hexcreatives.co
bogdanpeptine.ro
mylolis.com
iviaggisonciliegie.it
div-vertriebsforschung.de
starsarecircular.org
xltyu.com
xn--vrftet-pua.biz
bodyfulls.com
carrybrands.nl
macabaneaupaysflechois.com
xn--thucmctc-13a1357egba.com
allentownpapershow.com
wolf-glas-und-kunst.de
smejump.co.th
financescorecard.com
partnertaxi.sk
surespark.org.uk
diversiapsicologia.es
trulynolen.co.uk
wellplast.se
streamerzradio1.site
fitovitaforum.com
tanzprojekt.com
navyfederalautooverseas.com
proudground.org
bayoga.co.uk
personalenhancementcenter.com
firstpaymentservices.com
plantag.de
oceanastudios.com
krlosdavid.com
makeurvoiceheard.com
zflas.com
calabasasdigest.com
wasmachtmeinfonds.at
ostheimer.at
vermoote.de
grupocarvalhoerodrigues.com.br
tinyagency.com
bingonearme.org
bouquet-de-roses.com
withahmed.com
leeuwardenstudentcity.nl
mrxermon.de
waynela.com
faizanullah.com
thewellnessmimi.com
fairfriends18.de
punchbaby.com
pt-arnold.de
thedresserie.com
advizewealth.com
devlaur.com
urist-bogatyr.ru
norpol-yachting.com
onlybacklink.com
milanonotai.it
danielblum.info
kaminscy.com
koko-nora.dk
liveottelut.com
first-2-aid-u.com
bristolaeroclub.co.uk
huesges-gruppe.de
nancy-informatique.fr
mezhdu-delom.ru
manutouchmassage.com
sterlingessay.com
backstreetpub.com
autodemontagenijmegen.nl
crowcanyon.com
zweerscreatives.nl
restaurantesszimmer.de
kafu.ch
jerling.de
brigitte-erler.com
imperfectstore.com
spinheal.ru
the-virtualizer.com
corona-handles.com
blgr.be
ahouseforlease.com
chaotrang.com
ohidesign.com
maratonaclubedeportugal.com
people-biz.com
airconditioning-waalwijk.nl
augenta.com
easytrans.com.au
cwsitservices.co.uk
comparatif-lave-linge.fr
answerstest.ru
comarenterprises.com
connectedace.com
theadventureedge.com
mooreslawngarden.com
naturstein-hotte.de
shonacox.com
alten-mebel63.ru
blood-sports.net
lecantou-coworking.com
christ-michael.net
nsec.se
miriamgrimm.de
parebrise-tla.fr
international-sound-awards.com
agence-chocolat-noir.com
igrealestate.com
anteniti.com
mirjamholleman.nl
caribdoctor.org
ki-lowroermond.nl
planchaavapor.net
sauschneider.info
aminaboutique247.com
seevilla-dr-sturm.at
socstrp.org
id-vet.com
urclan.net
kariokids.com
bastutunnan.se
havecamerawilltravel2017.wordpress.com
seproc.hn
latestmodsapks.com
kisplanning.com.au
body-armour.online
dezatec.es
nurturingwisdom.com
cuppacap.com
thenewrejuveme.com
marathonerpaolo.com
noixdecocom.fr
kindersitze-vergleich.de
hotelzentral.at
yourobgyn.net
jolly-events.com
marchand-sloboda.com
mrsfieldskc.com
pomodori-pizzeria.de
vanswigchemdesign.com
stormwall.se
thomasvicino.com
stacyloeb.com
boulderwelt-muenchen-west.de
mikeramirezcpa.com
oemands.dk
danskretursystem.dk
ianaswanson.com
alysonhoward.com
ungsvenskarna.se
work2live.de
ledmes.ru
loprus.pl
lloydconstruction.com
oldschoolfun.net
candyhouseusa.com
stallbyggen.se
kenhnoithatgo.com
lionware.de
employeesurveys.com
schutting-info.nl
sevenadvertising.com
smart-light.co.uk
stopilhan.com
ausair.com.au
devok.info
digi-talents.com
delawarecorporatelaw.com
ilcdover.com
waywithwords.net
extensionmaison.info
adultgamezone.com
chavesdoareeiro.com
zewatchers.com
stoeberstuuv.de
myzk.site
body-guards.it
qlog.de
kojima-shihou.com
markelbroch.com
parking.netgateway.eu
fibrofolliculoma.info
synlab.lt
makeflowers.ru
dutchbrewingcoffee.com
fensterbau-ziegler.de
freie-baugutachterpraxis.de
tampaallen.com
ecoledansemulhouse.fr
wsoil.com.sg
biapi-coaching.fr
entopic.com
interactcenter.org
craigvalentineacademy.com
plastidip.com.ar
wmiadmin.com
scenepublique.net
bee4win.com
bildungsunderlebnis.haus
highlinesouthasc.com
intecwi.com
serce.info.pl
vibehouse.rw
tandartspraktijkhartjegroningen.nl
drugdevice.org
sanyue119.com
higadograsoweb.com
katiekerr.co.uk
petnest.ir
tradiematepro.com.au
heidelbergartstudio.gallery
tanzschule-kieber.de
freie-gewerkschaften.de
travelffeine.com
webhostingsrbija.rs
chandlerpd.com
dinslips.se
lapinlviasennus.fi
broseller.com
i-arslan.de
sw1m.ru
asteriag.com
x-ray.ca
beaconhealthsystem.org
sportiomsportfondsen.nl
tstaffing.nl
DupontSellsHomes.com
durganews.com
vibethink.net
architecturalfiberglass.org
degroenetunnel.com
phantastyk.com
art2gointerieurprojecten.nl
nakupunafoundation.org
deepsouthclothingcompany.com
bigasgrup.com
love30-chanko.com
austinlchurch.com
milsing.hr
aco-media.nl
projetlyonturin.fr
imaginado.de
spectrmash.ru
321play.com.hk
vietlawconsultancy.com
poultrypartners.nl
biortaggivaldelsa.com
c-a.co.in
no-plans.com
transportesycementoshidalgo.es
odiclinic.org
musictreehouse.net
tennisclubetten.nl
rafaut.com
teknoz.net
worldhealthbasicinfo.com
osterberg.fi
mastertechengineering.com
lascuola.nl
autofolierung-lu.de
sandd.nl
rhinosfootballacademy.com
supportsumba.nl
architekturbuero-wagner.net
onlyresultsmarketing.com
space.ua
ralister.co.uk
carolinepenn.com
em-gmbh.ch
abogadosaccidentetraficosevilla.es
cursosgratuitosnainternet.com
blog.solutionsarchitect.guru
leoben.at
behavioralmedicinespecialists.com
fizzl.ru
ditog.fr
smhydro.com.pl
ussmontanacommittee.us
i-trust.dk
arteservicefabbro.com
vancouver-print.ca
ivivo.es
liikelataamo.fi
danholzmann.com
harpershologram.wordpress.com
handi-jack-llc.com
enovos.de
pivoineetc.fr
bestbet.com
trystana.com
nachhilfe-unterricht.com
ra-staudte.de
fitnessingbyjessica.com
evologic-technologies.com
ladelirante.fr
turkcaparbariatrics.com
southeasternacademyofprosthodontics.org
huissier-creteil.com
eraorastudio.com
bockamp.com
gasolspecialisten.se
tomaso.gr
newyou.at
limassoldriving.com
mrtour.site
drinkseed.com
tarotdeseidel.com
naturavetal.hr
mdacares.com
trapiantofue.it
reddysbakery.com
manijaipur.com
satyayoga.de
dirittosanitario.biz
charlesreger.com
c2e-poitiers.com
birnam-wood.com
mbxvii.com
wraithco.com
actecfoundation.org
bunburyfreightservices.com.au
hihaho.com
mmgdouai.fr
karacaoglu.nl
minipara.com
ventti.com.ar
werkkring.nl
milestoneshows.com
idemblogs.com
cursoporcelanatoliquido.online
smessier.com
leda-ukraine.com.ua
layrshift.eu
id-et-d.fr
abogados-en-alicante.es
simoneblum.de
webcodingstudio.com
xn--fn-kka.no
modamilyon.com
juneauopioidworkgroup.org
healthyyworkout.com
caribbeansunpoker.com
goodgirlrecovery.com
summitmarketingstrategies.com
commonground-stories.com
theshungiteexperience.com.au
iyahayki.nl
y-archive.com
whittier5k.com
campus2day.de
corelifenutrition.com
importardechina.info
jiloc.com
talentwunder.com
launchhubl.com
bouncingbonanza.com
myhostcloud.com
dr-seleznev.com
spylista.com
cityorchardhtx.com
alsace-first.com
richard-felix.co.uk
bsaship.com
psnacademy.in
saka.gr
offroadbeasts.com
stemplusacademy.com
jusibe.com
tastewilliamsburg.com
beautychance.se
zimmerei-deboer.de
ravensnesthomegoods.com
pay4essays.net
siliconbeach-realestate.com
pferdebiester.de
nuzech.com
slwgs.org
argos.wityu.fund
conasmanagement.de
strategicstatements.com
all-turtles.com
hmsdanmark.dk
labobit.it
pmc-services.de
peterstrobos.com
conexa4papers.trade
mediaclan.info
fatfreezingmachines.com
sarbatkhalsafoundation.org
mymoneyforex.com
yassir.pro
parkcf.nl
katketytaanet.fi
schoolofpassivewealth.com
galserwis.pl
coursio.com
muamuadolls.com
themadbotter.com
blogdecachorros.com
wacochamber.com
figura.team
geekwork.pl
dutchcoder.nl
completeweddingkansas.com
pierrehale.com
spargel-kochen.de
qualitaetstag.de
extraordinaryoutdoors.com
truenyc.co
kunze-immobilien.de
solhaug.tk
kath-kirche-gera.de
iqbalscientific.com
globedivers.wordpress.com
suncrestcabinets.ca
crowd-patch.co.uk
bordercollie-nim.nl
burkert-ideenreich.de
dubnew.com
team-montage.dk
mediaacademy-iraq.org
paymybill.guru
psc.de
remcakram.com
funjose.org.gt
bafuncs.org
xtptrack.com
zieglerbrothers.de
evangelische-pfarrgemeinde-tuniberg.de
rimborsobancario.net
pasivect.co.uk
johnsonfamilyfarmblog.wordpress.com
bloggyboulga.net
pawsuppetlovers.com
mooglee.com
buymedical.biz
teresianmedia.org
moveonnews.com
sinal.org
noesis.tech
maureenbreezedancetheater.org
antiaginghealthbenefits.com
securityfmm.com
ilive.lt
roadwarrior.app
stoeferlehalle.de
strandcampingdoonbeg.com
judithjansen.com
wurmpower.at
lightair.com
kikedeoliveira.com
sanaia.com
gopackapp.com
dushka.ua
hoteledenpadova.it
troegs.com
paradicepacks.com
marcuswhitten.site
fitnessbazaar.com
psa-sec.de
pogypneu.sk
memaag.com
spacecitysisters.org
steampluscarpetandfloors.com
tanciu.com
chrissieperry.com
dareckleyministries.com
daklesa.de
gratispresent.se
gamesboard.info
sairaku.net
icpcnj.org
parkstreetauto.net
instatron.net
camsadviser.com
systemate.dk
mepavex.nl
carlosja.com
1kbk.com.ua
twohourswithlena.wordpress.com
groupe-cets.com
humanityplus.org
lillegrandpalais.com
ausbeverage.com.au
creamery201.com
blacksirius.de
bimnapratica.com
henricekupper.com
better.town
balticdentists.com
pocket-opera.de
aurum-juweliere.de
ai-spt.jp
despedidascostablanca.es
dontpassthepepper.com
forestlakeuca.org.au
dekkinngay.com
haar-spange.com
prochain-voyage.net
rieed.de
fayrecreations.com
spsshomeworkhelp.com
lbcframingelectrical.com
jakekozmor.com
centuryrs.com
ecpmedia.vn
boldcitydowntown.com
midmohandyman.com
servicegsm.net
teczowadolina.bytom.pl
smogathon.com
dw-css.de
appsformacpc.com
abogadosadomicilio.es
todocaracoles.com
testzandbakmetmening.online
denifl-consulting.at
vesinhnha.com.vn
mbfagency.com
miraclediet.fun
ora-it.de
stampagrafica.es
edelman.jp
praxis-management-plus.de
triggi.de
presseclub-magdeburg.de
aglend.com.au
nokesvilledentistry.com
basisschooldezonnewijzer.nl
journeybacktolife.com
gporf.fr
hokagestore.com
campusoutreach.org
hugoversichert.de
trackyourconstruction.com
sobreholanda.com
malychanieruchomoscipremium.com
nijaplay.com
glennroberts.co.nz
bargningharnosand.se
citymax-cr.com
triactis.com
patrickfoundation.net
mardenherefordshire-pc.gov.uk
marietteaernoudts.nl
buroludo.nl
visiativ-industry.fr
rksbusiness.com
craigmccabe.fun
charlottepoudroux-photographie.fr
bricotienda.com
notmissingout.com
coding-marking.com
tulsawaterheaterinstallation.com
1team.es
bowengroup.com.au
nvwoodwerks.com
aprepol.com
fiscalsort.com
vorotauu.ru
sagadc.com
kaliber.co.jp
maxadams.london
dr-pipi.de
lapinvihreat.fi
digivod.de
schoellhammer.com
simpkinsedwards.co.uk
cuspdental.com
nicoleaeschbachorg.wordpress.com
polychromelabs.com
itelagen.com
gastsicht.de
nativeformulas.com
pointos.com
philippedebroca.com
ymca-cw.org.uk
innote.fi
sweering.fr
craftleathermnl.com
latribuessentielle.com
kamienny-dywan24.pl
microcirc.net
101gowrie.com
foretprivee.ca
htchorst.nl
tonelektro.nl
geoffreymeuli.com
eglectonk.online
new.devon.gov.uk
ziegler-praezisionsteile.de
paulisdogshop.de
12starhd.online
berlin-bamboo-bikes.org
bouldercafe-wuppertal.de
fotoideaymedia.es
mindpackstudios.com
andersongilmour.co.uk
jbbjw.com
crediacces.com
mapawood.com
mytechnoway.com
vloeren-nu.nl
helikoptervluchtnewyork.nl
takeflat.com
jadwalbolanet.info
lichencafe.com
sportverein-tambach.de
deprobatehelp.com
coffreo.biz
upmrkt.co
kao.at
nacktfalter.de
autodujos.lt
abuelos.com
highimpactoutdoors.net
foryourhealth.live
apprendrelaudit.com
evergreen-fishing.com
portoesdofarrobo.com
uimaan.fi
mirkoreisser.de
cleliaekiko.online
renergysolution.com
eco-southafrica.com
gantungankunciakrilikbandung.com
jacquin-maquettes.com
outcomeisincome.com
commercialboatbuilding.com
homng.net
educar.org
binder-buerotechnik.at
helenekowalsky.com
ampisolabergeggi.it
thailandholic.com
4net.guru
platformier.com
happyeasterimages.org
knowledgemuseumbd.com
alfa-stroy72.com
aodaichandung.com
filmstreamingvfcomplet.be
8449nohate.org
ruralarcoiris.com
compliancesolutionsstrategies.com
webmaster-peloton.com
resortmtn.com
echtveilig.nl
selfoutlet.com
celeclub.org
raschlosser.de
xn--logopdie-leverkusen-kwb.de
homecomingstudio.com
anthonystreetrimming.com
gasbarre.com
cafemattmeera.com
retroearthstudio.com
argenblogs.com.ar
theletter.company
apolomarcas.com
tophumanservicescourses.com
ccpbroadband.com
gemeentehetkompas.nl
woodworkersolution.com
officehymy.com
littlebird.salon
courteney-cox.net
jobmap.at
physiofischer.de
smale-opticiens.nl
atozdistribution.co.uk
perbudget.com
shiftinspiration.com
theapifactory.com
erstatningsadvokaterne.dk
lenreactiv-shop.ru
sipstroysochi.ru
unetica.fr
consultaractadenacimiento.com
hairstylesnow.site
klusbeter.nl
rushhourappliances.com
operaslovakia.sk
cactusthebrand.com
jsfg.com
castillobalduz.es
bigbaguettes.eu
irinaverwer.com
abl1.net
aselbermachen.com
revezlimage.com
irishmachineryauctions.com
makeitcount.at
mdk-mediadesign.de
-
net
true
-
pid
$2a$10$gY18iotaXYmlrMg1kdA1A.nn.3UCuyrtv2KK1NDgXEMdKfXHHwDK.
-
prc
isqlplussvc
dbsnmp
mydesktopqos
msaccess
synctime
sql
steam
agntsvc
thebat
sqbcoreservice
mspub
firefox
tbirdconfig
infopath
oracle
thunderbird
xfssvccon
visio
onenote
wordpad
mydesktopservice
ocomm
winword
encsvc
excel
outlook
ocssd
powerpnt
dbeng50
ocautoupds
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, stolen, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7295
-
svc
memtas
backup
sql
veeam
sophos
svc$
vss
mepocs
Extracted
C:\Users\pr61z-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5D45199BC8A0FB68
http://decoder.re/5D45199BC8A0FB68
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\I: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\O: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\A: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\K: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\X: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\B: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\T: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\M: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\U: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\F: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\D: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\S: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\W: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\Z: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\E: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\G: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\J: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\P: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\L: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\N: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\R: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\Q: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\V: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened (read-only) \??\Y: 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dd8v.bmp" 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe -
Drops file in Program Files directory 28 IoCs
description ioc Process File opened for modification \??\c:\program files\CloseUnblock.mpv2 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\InvokeUnregister.pptx 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\InitializeBlock.csv 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\SuspendUnlock.svg 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\WriteRestore.tiff 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\pr61z-readme.txt 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\ConvertToProtect.ppt 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\PopSubmit.dwfx 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\DisconnectReceive.ADT 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\JoinUnblock.mpeg 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\RevokePop.xls 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\SuspendConnect.dot 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\UndoDeny.rtf 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\GrantWrite.gif 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\LockStart.gif 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\NewDeny.ppsm 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File created \??\c:\program files\pr61z-readme.txt 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\AddApprove.potm 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\ConfirmJoin.docx 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\JoinComplete.i64 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\MergeConfirm.mhtml 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\pr61z-readme.txt 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\pr61z-readme.txt 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\GetConvertTo.3g2 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File created \??\c:\program files (x86)\pr61z-readme.txt 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\ConvertMount.mpg 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\GetDisable.sql 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe File opened for modification \??\c:\program files\ResumeGet.m4v 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2388 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe 2388 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2388 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe Token: SeTakeOwnershipPrivilege 2388 30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe Token: SeBackupPrivilege 2496 vssvc.exe Token: SeRestorePrivilege 2496 vssvc.exe Token: SeAuditPrivilege 2496 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe"C:\Users\Admin\AppData\Local\Temp\30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2884
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
6KB
MD53450e5dbb039bda5b4cd0d900c040870
SHA1097618cb97f140b3fcc26d77e679c50ad01c21a1
SHA256287b8831505e6d0ce43d4ba59a080701f95d05f8625343884492f739c3975798
SHA51222e4e8a383a402102f90a003ae20276be511aced2341396b4c4d7c052e5309754f70078f8e93f93fe85f7f4c5ad037b1cc89884ae523ec0cf334595ddade0db9
-
Filesize
192KB
MD54214201fa9df6d293f9f131a37d5f203
SHA1202203741b22dd385bd0ce1ae64676a4b27c89be
SHA25650eb1ab28625258cdb6c589d9cd3854c9e002a1e2339510da6fd4fcfd7d38849
SHA5124506961328f3e02ab872951338abdaad0ea8f45c70eef003875bf1da6fcc87a630ed2ac84127ace0fec8b4fd0e48cd8eaec27b4cfdd9856aea0c899e4924a322