Analysis
- max time kernel
118s - max time network
134s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
15/06/2024, 11:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe
Resource
win7-20240611-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe
Resource
win11-20240508-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe
- Size 115KB
- Sample240615-n5gjqstdmp
- SHA256 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195
- MD5 63a945da1a63a8e56e8220c4ccf7fd0c
- SHA1 a99cf1a2426edeac97c789d0a4b7d38606d7aa45
- SHA512 34006d84587ea90e243ebe0dd6bde8bd502ed688001a412898cd4e4c16a5de5788a9fa4c53d3ea79e4307adaa74496e05b205bf9717ac833db976551b1a7c89c
- SSDEEP 1536:ikB/Ih3+7QuoZVQgf5GV2jSzGpAyZ4ICS4AwnfxnuLdSbSmoNUExd9M4dgS:gFW7gSzKDin5nWhw4dgS
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\pj328zw1-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension pj328zw1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/881AF8D02A6585AE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/881AF8D02A6585AE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: P58HocFcL5wyWYov4mRqXGXpxKFdz+xYKJuApYSBVc25/ROE6RCnEsJ8ID12nRrS Z9orJyTR6maEDn1eNqxJ7T/Cy5HwJZ7u66nPLwrNgSu/WCYzrZ6uywEGsJKAFR4E 0+kMfG4NDO0leecS75pCX0t7qXpZ5g3Y5zUSYuh50QQuv/QxQuImBfmuIxtAEtCD 30zP+0dv3Q48RVkxkqoBEIUhm9v5RrxzjrU8Pk0A7LQP46fQwQ3kiwtjgzAqJydQ 4kf4X0hdj2+0ga3/P5f15uVz3NSA+ax25BX101OlhkYnJGg3t01o+frOsPyrdj7Z L2ATTEUpzBxRZumXfVkJbscqHABv18hhI6WqHlNdzLs+XauBxEgs0gxHAz1HFyAw rj+cS57bkQ6E20f0Wb0WVYh8Gk3+CiCGNgirPPykcvzwgQdxH+BOFFWG7n4YWkMY gfkDO/V0223K13WAKDVVVm795FKrTAhX3j1jlmYsVOoYTK9j8p925aRhrmMMQYo+ fPEbu64T37jHt6BpGfvurEwCnAs0qtqv5nvjxRTpUSn53S3ATZxu12g5CzfXvq19 +I5g/89aLQ1jS9EdDsmQAZVOoJDOfy2zkcWf37S1WFSBwJy5e7JC2bZN2Wg41GUU fndeL9r/wQPyw3FYO5wbLr5a3eLq8TREleHMK0hS4GGfXzOTGv/Db6WzfKKxzo+u CrPFiiNVQisGjVW5vJSVZ12zrO8dS6kS7nhQYz7YUcnjESA5MRkClY+61xU2Nx9+ PJ63CTCH2S89TCgQdkxngW4p7Bt9slfUcs7BuFG/3k2zBwr0xirn5DDwDx+ogofK fQ5C78UToQgjCe/rjn891N2bA+iWSI1+3RoQnEoaarZwCu+0YkbegVIBu/9zJ3cl EZQQg0rTiv33vddL8dB5PA8DY3QqefZCtNewtiqjGpQDhg8OszZDWZgSxBfG6F9/ EsoxiFtjqskHvWb+jwERlctQQLYrkdObF8kQngBijB0hKLK+w+05V6QVf7dqCiUK sWrtls6O6WD4Q0UvxU/C9kQJuMTyVP0dLHLqIRGh7NyIDUtIarZZMWFrVTTuxHTg XUKGjMzIWNGJhhM7VTHM35lqriAP1LnEU+mO/i9LEXsksgzNaSH2iMjX6rUV18Vy ucTM5+NW5FiaF1CtPPqjO2arnbKB9A56/mGguTI1sxfMVkdKQ8z8bQ9SIYKI/iA1 jRvQ4lJzfFgB39vgdSVQEQ0s5ut8EempcqyTlf0mPasV2PCxru2VeG267MofTcFR haua2TKKZVFb+GaZGXPpOtkAPvGchRFURe95j1KaUXNYrbXAblLeRR0o95X08Hdw 33QEykuhp/xoJlj9ob7mQmT2zSQD/L4NW2d/yj0o77WEWdW3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/881AF8D02A6585AE
-
http://decryptor.cc/881AF8D02A6585AE
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\U: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\Y: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\F: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\L: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\P: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\N: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\T: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\D: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\A: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\H: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\I: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\J: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\V: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\X: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\R: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\W: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\B: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\G: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\M: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\O: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\K: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\Q: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\S: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened (read-only) \??\Z: ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\k72eb3.bmp" ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification \??\c:\program files\WaitApprove.vssm ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File created \??\c:\program files (x86)\pj328zw1-readme.txt ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened for modification \??\c:\program files\CompleteRegister.vst ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened for modification \??\c:\program files\ConnectGrant.rar ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened for modification \??\c:\program files\SearchSave.mpeg ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened for modification \??\c:\program files\SwitchCompare.pptm ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File created \??\c:\program files\pj328zw1-readme.txt ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened for modification \??\c:\program files\SaveReceive.php ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened for modification \??\c:\program files\UnblockAssert.pcx ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened for modification \??\c:\program files\SearchFormat.doc ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\pj328zw1-readme.txt ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\pj328zw1-readme.txt ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened for modification \??\c:\program files\ExportSkip.ppt ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File opened for modification \??\c:\program files\UnprotectStart.kix ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\pj328zw1-readme.txt ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2944 powershell.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe Token: SeDebugPrivilege 2944 powershell.exe Token: SeBackupPrivilege 2660 vssvc.exe Token: SeRestorePrivilege 2660 vssvc.exe Token: SeAuditPrivilege 2660 vssvc.exe Token: SeTakeOwnershipPrivilege 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2944 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 28 PID 2416 wrote to memory of 2944 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 28 PID 2416 wrote to memory of 2944 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 28 PID 2416 wrote to memory of 2944 2416 ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe 28 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe"C:\Users\Admin\AppData\Local\Temp\ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2292
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\pj328zw1-readme.txt1⤵PID:928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\pj328zw1-readme.txt
- Size 7KB
- SHA256 27260b742669db983a30060b75e5aadddfe4ba06b85f293c2320c8367bd6177f
- MD5 bda9f40c62f826d48eff2187c1059384
- SHA1 f00a3f1c1422f04b8148b8942449e563db83674f
- SHA512 0f37f52f703e7596cc3863ed33d48a93baa80b2d7cce2a0d898f1074e882815778eaa0e553f8421d4d4214594c7eb40e68e605c4933651cfc42bbd342711bc31
- SSDEEP 96:GLyE4M5a+J3cAYNsQKxU3TPicEsAcjsZBNlyMScyNe6gk9ua632s4+34TUV8uid/:GLyQG3jWZhVScH09ua9Cog8uCDx
- MD5 SHA1 SHA512 SSDEEP