sodinokibi | 8cdb5bb1b487ca269ff5381d8b026d409fbef4383fbb17b5b1b9013d790fe3f3

General

Target

66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe
Size

917KB
MD5

5a97a50e45e64db41049fd88a75f2dd2
SHA1

20e3a0955baca4dc7f1f36d3b865e632474add77
SHA256

66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8
SHA512

fdba305a5334e583da463bd4147a27ac67c0d7de86bbaf040dfde6b9c4afc42ec93cda6ae297eda324dfb008b2e3cfc322bbdbb2ef45fa17b8d74b5f68e61dfb
SSDEEP

24576:rVxcSetOx8KDbPPeTMF+Iyy77UkQkyoPJHiat:4SjDDjeEY7uVt

Score

10^/10

sodinokibi $2a$12$l4/dnshgqodznkcm0fyzke6taice.tk6cqsrt9y0x6xcl.5fn2d7k 7422 ransomware spyware stealer

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$l4/DnshgQODzNkCM0FyZke6taIcE.TK6CQsrt9Y0X6XCl.5fn2d7K

Campaign

7422

Decoy

slimidealherbal.com

ulyssemarketing.com

lescomtesdemean.be

bayoga.co.uk

drinkseed.com

lachofikschiet.nl

sportsmassoren.com

financescorecard.com

teknoz.net

xn--singlebrsen-vergleich-nec.com

ecoledansemulhouse.fr

epwritescom.wordpress.com

penco.ie

stopilhan.com

thewellnessmimi.com

pawsuppetlovers.com

marketingsulweb.com

smart-light.co.uk

id-vet.com

norovirus-ratgeber.de

Attributes

net
false
pid
$2a$12$l4/DnshgQODzNkCM0FyZke6taIcE.TK6CQsrt9Y0X6XCl.5fn2d7K
prc
allegro

steam

xtop

ocssd

xfssvccon

onenote

isqlplussvc

msaccess

powerpnt

cad

sqbcoreservice

thunderbird

oracle

infopath

dbeng50

pro_comm_msg

agntsvc

thebat

firefox

ocautoupds

winword

synctime

tbirdconfig

mspub

visio

sql

ocomm

orcad

mydesktopservice

dbsnmp

outlook

cadence

excel

wordpad

creoagent

encsvc

mydesktopqos
ransom_oneliner
All of your files are encrypted! Find {EXT}-read.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
7422
svc
sophos

svc$

sql

mepocs

vss

backupбмукшефы

veeam

memtas

Extracted

Path

C:\Recovery\sqdn7tk1-read.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension sqdn7tk1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4D1A760E626E35B8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/4D1A760E626E35B8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: brwtCg817yQaQ5/+KH9K2E/LWEglvZfvLiVwuP6LB3zvFwrIfqCn8WDxNzzLKJNb eMrK0OnHcD6jcv0Fh2Mg5yxhnoySC5ngWcOpAVQ+LIWcslPacjhgqNJeSuFuwICV GMTB+nZ028ke57UeGe5qToWyjJlKtTOqfKTuOfEjPwi4smpwF8nK95pVPwfRrgvo k7wEt+JnIIjO11RSdT9q5+22ZFFNDnT2prGCcAts4VIsdYNSoqWFgmudAhQVnoGm v4kydP2XxFxWnbtxcms0JoyQxwrvnu583cfQ1OU98iisvcrDH0ckHctslPwwLIQx VYOcX0aixtRBtiMXunth2Gm5tutAuFHLa0VrvUCwSfnsGl9ZpqWQZUCerd1TtY90 +Vn29HUrY/LpxZdt9oVvn3u0+HEHe9qdgd+cjwPa6vQFI4lzCHAwF1XiGrlz8KGH UK3+Z91U5w+Gm4qMP0AW2XUlN1f9EYirNwNwcDKfqr9hkbZnMYg9FedrOdWpPRjM oMRTPJ3HjTWA2zPGdUuKGYOpzLef6KsCH4dI1Bc/UVQ5dhH/+sN8bHIAH9ZcLx9j 64WHxG/ZPeXm3qiaOWZ2a1pVHIyuUexQcVzvok8y0A4iIw1KnvwowCjn8F4GtVNe WJF2+SOwgGXhe/ow5HHUsXNUaGkYJi+urxAtGoLprLTkzaI1c4mPV4hnW/yPZWVS NqvK3S5Q+tN6wo2Qlnfxc8ihQAuBFbkwOMr8WRGRTixK5ifQhja5sdqjYs+Q1nBQ L374I6/lSFMU4B8xP6wEyOhhYiCrZvVuLcxDZ/mE2/xI15xFbJOEMDUIx7ARZXEV oIcAksVYDORR0aCCXA0q2APOOPkuzUs6THh6vjczsn0VJOtbdQ32g30LgQqfJPAA 8Zc34fosWxtIjf59GeJkTfIdnRCqR2QxVy8u+1RMzBBCUdXPYTCKK8fcIUQN6qbL eDwPs/1pHo01vaf5axszjALA7e2mh+N+CFyD3gdQhYjKS/5bcEiNdmMeBM1xIa3y sifTKIANBdGcWP1wsQHdOAAHbBC9+Ce8cSqb471fhsIanUljpF0uxlsmXm5Pk2TC jxAauzffjvDzrZdLaoz19RkCeduYAH+g/tVcCjzpg4Ot6a0aWP8tGThUO4UNfmK9 GG+dEM1j+Aju4I+JIK9XhnNUSZx2enq+47AIRvlhsSoQWu1T9ZEF2GeH6GfMNE2o MeEcRlbQDURFO9MnmXx7kjSOrjOwuzYfnW1XbI6JzO4OiRtyv9urpuv74Rop6PJu cUAb2NDxhdJcY0vBCU2ljMd5a1ieCOH37MK1TpjBM5DtbGOYe5aMXMzr9a6RGcQp hljuXtLuU4apLqEJrTJaiO2AK3swXwW5YgwaJECwQzw= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4D1A760E626E35B8

http://decoder.re/4D1A760E626E35B8

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Executes dropped EXE 1 IoCs

pid	Process
860	MsMpEng.exe

Loads dropped DLL 1 IoCs

pid	Process
860	MsMpEng.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	MsMpEng.exe
File opened (read-only)	\??\V:	MsMpEng.exe
File opened (read-only)	\??\Z:	MsMpEng.exe
File opened (read-only)	\??\Q:	MsMpEng.exe
File opened (read-only)	\??\N:	MsMpEng.exe
File opened (read-only)	\??\S:	MsMpEng.exe
File opened (read-only)	\??\U:	MsMpEng.exe
File opened (read-only)	\??\Y:	MsMpEng.exe
File opened (read-only)	\??\B:	MsMpEng.exe
File opened (read-only)	\??\I:	MsMpEng.exe
File opened (read-only)	\??\K:	MsMpEng.exe
File opened (read-only)	\??\E:	MsMpEng.exe
File opened (read-only)	\??\M:	MsMpEng.exe
File opened (read-only)	\??\O:	MsMpEng.exe
File opened (read-only)	\??\R:	MsMpEng.exe
File opened (read-only)	\??\F:	MsMpEng.exe
File opened (read-only)	\??\L:	MsMpEng.exe
File opened (read-only)	\??\P:	MsMpEng.exe
File opened (read-only)	\??\A:	MsMpEng.exe
File opened (read-only)	\??\J:	MsMpEng.exe
File opened (read-only)	\??\X:	MsMpEng.exe
File opened (read-only)	\??\H:	MsMpEng.exe
File opened (read-only)	\??\T:	MsMpEng.exe
File opened (read-only)	\??\W:	MsMpEng.exe
File opened (read-only)	\??\D:	MsMpEng.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5le19kd2h2g.bmp"	MsMpEng.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\ImportCompare.rtf	MsMpEng.exe
File opened for modification	\??\c:\program files\StopClose.vsdx	MsMpEng.exe
File opened for modification	\??\c:\program files\UnregisterRevoke.mpv2	MsMpEng.exe
File created	\??\c:\program files (x86)\sqdn7tk1-read.txt	MsMpEng.exe
File opened for modification	\??\c:\program files\ApproveUnregister.m3u	MsMpEng.exe
File opened for modification	\??\c:\program files\ConvertUndo.vbs	MsMpEng.exe
File opened for modification	\??\c:\program files\EditUpdate.ppsm	MsMpEng.exe
File opened for modification	\??\c:\program files\ExitConnect.snd	MsMpEng.exe
File opened for modification	\??\c:\program files\ExpandEnter.ini	MsMpEng.exe
File opened for modification	\??\c:\program files\FormatProtect.mid	MsMpEng.exe
File opened for modification	\??\c:\program files\ShowStep.pcx	MsMpEng.exe
File opened for modification	\??\c:\program files\StepPing.docm	MsMpEng.exe
File opened for modification	\??\c:\program files\UnlockMeasure.easmx	MsMpEng.exe
File opened for modification	\??\c:\program files\ClearUnblock.xlt	MsMpEng.exe
File opened for modification	\??\c:\program files\DenyEnable.rm	MsMpEng.exe
File opened for modification	\??\c:\program files\OptimizeLimit.docx	MsMpEng.exe
File opened for modification	\??\c:\program files\RepairHide.ex_	MsMpEng.exe
File opened for modification	\??\c:\program files\SearchSwitch.rm	MsMpEng.exe
File created	\??\c:\program files\sqdn7tk1-read.txt	MsMpEng.exe
File opened for modification	\??\c:\program files\ConvertFromUnpublish.vdx	MsMpEng.exe
File opened for modification	\??\c:\program files\SaveStep.wmf	MsMpEng.exe
File opened for modification	\??\c:\program files\UnprotectDisable.svgz	MsMpEng.exe
File opened for modification	\??\c:\program files\UnpublishRepair.vssx	MsMpEng.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
860	MsMpEng.exe
860	MsMpEng.exe
860	MsMpEng.exe
860	MsMpEng.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	860	MsMpEng.exe
Token: SeBackupPrivilege	1516	vssvc.exe
Token: SeRestorePrivilege	1516	vssvc.exe
Token: SeAuditPrivilege	1516	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3420	SearchApp.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 208	2080	66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe	83
PID 2080 wrote to memory of 208	2080	66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe	83
PID 2080 wrote to memory of 208	2080	66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe	83
PID 208 wrote to memory of 860	208	cmd.exe	84
PID 208 wrote to memory of 860	208	cmd.exe	84
PID 208 wrote to memory of 860	208	cmd.exe	84

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe
"C:\Users\Admin\AppData\Local\Temp\66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\System32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe
    C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Sets desktop wallpaper using registry
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:860

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:232

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\sqdn7tk1-read.txt

Filesize
6KB

MD5
2078f3fab5143634866048971b8795aa

SHA1
746ceb684de932a35f4adca3c1fd7bf16d1db498

SHA256
30c38b499731c7cbb34adbff9775593d937fed3dcc5a9f0e1629dd7213a90357

SHA512
38bd3e4ca63800b75ece5b70d8beb02f38d5a9eb78a0999a82f327f966ba108b6f5cfbe515724bc978a05d4544dc2560e101416ae5abb6a64fcf83ce0e321066

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133647510242107014.txt

Filesize
74KB

MD5
2f109ad3eef6d129dc1c3171330ed6b2

SHA1
a8687f69445411ee3e6d63a5bffd9e6526654f4b

SHA256
9facf344bcc18e8b7381e570c108d1dd13a10398b862d04a28d5b9ca2cdc13e0

SHA512
93e56832b36323aa42156fac90ab7ab8bf356860e6ad36482b9543cc83782c0e87e8479d9cdab346e903312a5d64655c71b1b2296a2b2a88f2eb855e0be476cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe

Filesize
21KB

MD5
8cc83221870dd07144e63df594c391d9

SHA1
3d409b39b8502fcd23335a878f2cbdaf6d721995

SHA256
33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a

SHA512
e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpsvc.dll

Filesize
819KB

MD5
78066a1c4e075941272a86d4a8e49471

SHA1
6ee656604df8760981db003ae9dce5232d01da72

SHA256
cbfb6099868eef636f97847fb509527894938c8768028935e658b121b8372922

SHA512
9bca159273fc397343f4555c3fbf882301fdb9bfe7f8d130212033e76dfdbad31fdd978292b8a029f7521dfa3eeac7c0a76c9833cc2fca8312de4a651284284a

Download Submit
memory/860-428-0x00000000013D0000-0x00000000013F1000-memory.dmp

Filesize
132KB

Download
memory/860-30-0x00000000013D0000-0x00000000013F1000-memory.dmp

Filesize
132KB

Download
memory/860-10-0x00000000013D0000-0x00000000013F1000-memory.dmp

Filesize
132KB

Download
memory/860-416-0x00000000013D0000-0x00000000013F1000-memory.dmp

Filesize
132KB

Download
memory/860-9-0x00000000013D0000-0x00000000013F1000-memory.dmp

Filesize
132KB

Download
memory/860-427-0x0000000001400000-0x0000000001500000-memory.dmp

Filesize
1024KB

Download
memory/860-8-0x0000000001400000-0x0000000001500000-memory.dmp

Filesize
1024KB

Download
memory/860-566-0x00000000013D0000-0x00000000013F1000-memory.dmp

Filesize
132KB

Download
memory/860-608-0x00000000013D0000-0x00000000013F1000-memory.dmp

Filesize
132KB

Download
memory/3420-467-0x000001C0AD770000-0x000001C0AD790000-memory.dmp

Filesize
128KB

Download
memory/3420-436-0x000001C0AD3A0000-0x000001C0AD3C0000-memory.dmp

Filesize
128KB

Download
memory/3420-454-0x000001C0AD360000-0x000001C0AD380000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads