Analysis
- max time kernel
94s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system - submitted
06/07/2024, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe
Resource
win10v2004-20240704-en
General
- Target 66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe
- Size 917KB
- Sample240706-sbqb1a1grp
- SHA256 66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8
- MD5 5a97a50e45e64db41049fd88a75f2dd2
- SHA1 20e3a0955baca4dc7f1f36d3b865e632474add77
- SHA512 fdba305a5334e583da463bd4147a27ac67c0d7de86bbaf040dfde6b9c4afc42ec93cda6ae297eda324dfb008b2e3cfc322bbdbb2ef45fa17b8d74b5f68e61dfb
- SSDEEP 24576:rVxcSetOx8KDbPPeTMF+Iyy77UkQkyoPJHiat:4SjDDjeEY7uVt
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
sodinokibi
-
$2a$12$l4/DnshgQODzNkCM0FyZke6taIcE.TK6CQsrt9Y0X6XCl.5fn2d7K
-
7422
-
slimidealherbal.com
-
ulyssemarketing.com
-
lescomtesdemean.be
-
bayoga.co.uk
-
drinkseed.com
-
lachofikschiet.nl
-
sportsmassoren.com
-
financescorecard.com
-
teknoz.net
-
xn--singlebrsen-vergleich-nec.com
-
ecoledansemulhouse.fr
-
epwritescom.wordpress.com
-
penco.ie
-
stopilhan.com
-
thewellnessmimi.com
-
pawsuppetlovers.com
-
marketingsulweb.com
-
smart-light.co.uk
-
id-vet.com
-
norovirus-ratgeber.de
-
latestmodsapks.com
-
vorotauu.ru
-
advizewealth.com
-
heurigen-bauer.at
-
katiekerr.co.uk
-
nokesvilledentistry.com
-
smejump.co.th
-
hugoversichert.de
-
blogdecachorros.com
-
ivivo.es
-
em-gmbh.ch
-
rumahminangberdaya.com
-
licor43.de
-
hebkft.hu
-
xltyu.com
-
suncrestcabinets.ca
-
mountsoul.de
-
thaysa.com
-
baronloan.org
-
parkcf.nl
-
faronics.com
-
ki-lowroermond.nl
-
xn--rumung-bua.online
-
testzandbakmetmening.online
-
cimanchesterescorts.co.uk
-
nsec.se
-
bbsmobler.se
-
klusbeter.nl
-
gastsicht.de
-
marchand-sloboda.com
-
tennisclubetten.nl
-
visiativ-industry.fr
-
expandet.dk
-
evergreen-fishing.com
-
crowcanyon.com
-
centrospgolega.com
-
navyfederalautooverseas.com
-
sarbatkhalsafoundation.org
-
simulatebrain.com
-
acomprarseguidores.com
-
karacaoglu.nl
-
lbcframingelectrical.com
-
onlybacklink.com
-
catholicmusicfest.com
-
linnankellari.fi
-
homesdollar.com
-
greenko.pl
-
gantungankunciakrilikbandung.com
-
abl1.net
-
seagatesthreecharters.com
-
rosavalamedahr.com
-
schraven.de
-
oslomf.no
-
themadbotter.com
-
surespark.org.uk
-
ncid.bc.ca
-
celeclub.org
-
seminoc.com
-
klimt2012.info
-
boosthybrid.com.au
-
vibethink.net
-
hypozentrum.com
-
art2gointerieurprojecten.nl
-
educar.org
-
fitnessbazaar.com
-
destinationclients.fr
-
hannah-fink.de
-
heidelbergartstudio.gallery
-
psc.de
-
vannesteconstruct.be
-
stallbyggen.se
-
mindpackstudios.com
-
danholzmann.com
-
liliesandbeauties.org
-
bowengroup.com.au
-
sabel-bf.com
-
global-kids.info
-
tomoiyuma.com
-
filmvideoweb.com
-
abuelos.com
-
scenepublique.net
-
resortmtn.com
-
lefumetdesdombes.com
-
fax-payday-loans.com
-
plv.media
-
stampagrafica.es
-
malychanieruchomoscipremium.com
-
degroenetunnel.com
-
hotelzentral.at
-
zflas.com
-
cursosgratuitosnainternet.com
-
kikedeoliveira.com
-
buroludo.nl
-
offroadbeasts.com
-
mercantedifiori.com
-
huissier-creteil.com
-
tuuliautio.fi
-
bsaship.com
-
ilso.net
-
autodujos.lt
-
cwsitservices.co.uk
-
atalent.fi
-
faizanullah.com
-
torgbodenbollnas.se
-
mdacares.com
-
levihotelspa.fi
-
pv-design.de
-
newyou.at
-
dr-pipi.de
-
collaborativeclassroom.org
-
autopfand24.de
-
digivod.de
-
cranleighscoutgroup.org
-
autodemontagenijmegen.nl
-
gemeentehetkompas.nl
-
sloverse.com
-
sagadc.com
-
jiloc.com
-
faroairporttransfers.net
-
mbxvii.com
-
kojinsaisei.info
-
space.ua
-
wasmachtmeinfonds.at
-
finde-deine-marke.de
-
sporthamper.com
-
vihannesporssi.fi
-
twohourswithlena.wordpress.com
-
lorenacarnero.com
-
nijaplay.com
-
makeurvoiceheard.com
-
evologic-technologies.com
-
bristolaeroclub.co.uk
-
sairaku.net
-
memaag.com
-
transliminaltribe.wordpress.com
-
executiveairllc.com
-
johnsonfamilyfarmblog.wordpress.com
-
adoptioperheet.fi
-
body-armour.online
-
irinaverwer.com
-
rebeccarisher.com
-
comarenterprises.com
-
compliancesolutionsstrategies.com
-
conexa4papers.trade
-
walter-lemm.de
-
fiscalsort.com
-
analiticapublica.es
-
accountancywijchen.nl
-
moveonnews.com
-
stormwall.se
-
kaliber.co.jp
-
precisionbevel.com
-
pt-arnold.de
-
vyhino-zhulebino-24.ru
-
elpa.se
-
ilcdover.com
-
n1-headache.com
-
zimmerei-fl.de
-
deprobatehelp.com
-
carlosja.com
-
wurmpower.at
-
greenfieldoptimaldentalcare.com
-
noixdecocom.fr
-
starsarecircular.org
-
classycurtainsltd.co.uk
-
galleryartfair.com
-
cactusthebrand.com
-
ligiercenter-sachsen.de
-
victoriousfestival.co.uk
-
ostheimer.at
-
stoeferlehalle.de
-
vietlawconsultancy.com
-
chefdays.de
-
praxis-foerderdiagnostik.de
-
bradynursery.com
-
hellohope.com
-
completeweddingkansas.com
-
worldhealthbasicinfo.com
-
besttechie.com
-
jenniferandersonwriter.com
-
greenpark.ch
-
rieed.de
-
roygolden.com
-
woodworkersolution.com
-
ecopro-kanto.com
-
sinal.org
-
vickiegrayimages.com
-
stoeberstuuv.de
-
lascuola.nl
-
justinvieira.com
-
asteriag.com
-
eaglemeetstiger.de
-
iwelt.de
-
fransespiegels.nl
-
todocaracoles.com
-
henricekupper.com
-
vitalyscenter.es
-
flexicloud.hk
-
pmc-services.de
-
mylovelybluesky.com
-
allentownpapershow.com
-
copystar.co.uk
-
nakupunafoundation.org
-
westdeptfordbuyrite.com
-
pridoxmaterieel.nl
-
theadventureedge.com
-
psnacademy.in
-
refluxreducer.com
-
trystana.com
-
kuntokeskusrok.fi
-
4net.guru
-
darnallwellbeing.org.uk
-
effortlesspromo.com
-
houseofplus.com
-
geisterradler.de
-
ohidesign.com
-
dnepr-beskid.com.ua
-
sanaia.com
-
admos-gleitlager.de
-
triggi.de
-
lucidinvestbank.com
-
schlafsack-test.net
-
toponlinecasinosuk.co.uk
-
hairstylesnow.site
-
miraclediet.fun
-
simplyblessedbykeepingitreal.com
-
rehabilitationcentersinhouston.net
-
profectis.de
-
izzi360.com
-
dareckleyministries.com
-
journeybacktolife.com
-
slupetzky.at
-
smokeysstoves.com
-
parkstreetauto.net
-
jacquin-maquettes.com
-
pferdebiester.de
-
deko4you.at
-
igrealestate.com
-
lichencafe.com
-
allamatberedare.se
-
corola.es
-
kingfamily.construction
-
logopaedie-blomberg.de
-
whittier5k.com
-
durganews.com
-
kao.at
-
spylista.com
-
pubweb.carnet.hr
-
braffinjurylawfirm.com
-
phantastyk.com
-
proudground.org
-
steampluscarpetandfloors.com
-
directwindowco.com
-
boompinoy.com
-
smale-opticiens.nl
-
aselbermachen.com
-
geekwork.pl
-
huesges-gruppe.de
-
nurturingwisdom.com
-
thedad.com
-
ikads.org
-
y-archive.com
-
whyinterestingly.ru
-
sportiomsportfondsen.nl
-
deltacleta.cat
-
artallnightdc.com
-
winrace.no
-
bundabergeyeclinic.com.au
-
35-40konkatsu.net
-
commercialboatbuilding.com
-
slashdb.com
-
parks-nuernberg.de
-
4youbeautysalon.com
-
crediacces.com
-
international-sound-awards.com
-
321play.com.hk
-
handi-jack-llc.com
-
webcodingstudio.com
-
thomasvicino.com
-
thedresserie.com
-
purposeadvisorsolutions.com
-
seproc.hn
-
extensionmaison.info
-
colorofhorses.com
-
sandd.nl
-
jsfg.com
-
jobcenterkenya.com
-
wellplast.se
-
ihr-news.jp
-
aunexis.ch
-
schmalhorst.de
-
body-guards.it
-
boldcitydowntown.com
-
tradiematepro.com.au
-
fensterbau-ziegler.de
-
tanzschule-kieber.de
-
notmissingout.com
-
i-trust.dk
-
sobreholanda.com
-
maryloutaylor.com
-
ventti.com.ar
-
psa-sec.de
-
judithjansen.com
-
atmos-show.com
-
dramagickcom.wordpress.com
-
hkr-reise.de
-
layrshift.eu
-
bodyfulls.com
-
fatfreezingmachines.com
-
socialonemedia.com
-
blewback.com
-
pickanose.com
-
manutouchmassage.com
-
dw-css.de
-
employeesurveys.com
-
thenewrejuveme.com
-
monark.com
-
hmsdanmark.dk
-
healthyyworkout.com
-
pixelarttees.com
-
kadesignandbuild.co.uk
-
naswrrg.org
-
ruralarcoiris.com
-
delchacay.com.ar
-
grupocarvalhoerodrigues.com.br
-
icpcnj.org
-
abogadosadomicilio.es
-
kalkulator-oszczednosci.pl
-
morawe-krueger.de
-
humancondition.com
-
balticdermatology.lt
-
fairfriends18.de
-
kisplanning.com.au
-
yamalevents.com
-
edv-live.de
-
clos-galant.com
-
binder-buerotechnik.at
-
strandcampingdoonbeg.com
-
dezatec.es
-
mmgdouai.fr
-
nachhilfe-unterricht.com
-
dekkinngay.com
-
broseller.com
-
homecomingstudio.com
-
allfortheloveofyou.com
-
freie-baugutachterpraxis.de
-
cuppacap.com
-
theshungiteexperience.com.au
-
augenta.com
-
trackyourconstruction.com
-
harveybp.com
-
cyntox.com
-
jusibe.com
-
facettenreich27.de
-
bxdf.info
-
devstyle.org
-
dpo-as-a-service.com
-
thefixhut.com
-
friendsandbrgrs.com
-
katketytaanet.fi
-
simpliza.com
-
lusak.at
-
praxis-management-plus.de
-
dontpassthepepper.com
-
skiltogprint.no
-
helenekowalsky.com
-
aglend.com.au
-
summitmarketingstrategies.com
-
theclubms.com
-
dr-seleznev.com
-
foretprivee.ca
-
polymedia.dk
-
fayrecreations.com
-
sla-paris.com
-
caribdoctor.org
-
tandartspraktijkheesch.nl
-
noesis.tech
-
bigler-hrconsulting.ch
-
boisehosting.net
-
ivfminiua.com
-
DupontSellsHomes.com
-
ra-staudte.de
-
cleliaekiko.online
-
agence-referencement-naturel-geneve.net
-
patrickfoundation.net
-
lapinvihreat.fi
-
krlosdavid.com
-
heliomotion.com
-
lebellevue.fr
-
work2live.de
-
lapinlviasennus.fi
-
jadwalbolanet.info
-
sahalstore.com
-
jameskibbie.com
-
chatizel-paysage.fr
-
madinblack.com
-
charlottepoudroux-photographie.fr
-
kevinjodea.com
-
botanicinnovations.com
-
dr-tremel-rednitzhembach.de
-
calabasasdigest.com
-
schoolofpassivewealth.com
-
lenreactiv-shop.ru
-
mepavex.nl
-
alhashem.net
-
leda-ukraine.com.ua
-
interactcenter.org
-
gadgetedges.com
-
micahkoleoso.de
-
tips.technology
-
siluet-decor.ru
-
shonacox.com
-
notsilentmd.org
-
bee4win.com
-
dushka.ua
-
securityfmm.com
-
femxarxa.cat
-
sipstroysochi.ru
-
instatron.net
-
innote.fi
-
digi-talents.com
-
gw2guilds.org
-
all-turtles.com
-
hairnetty.wordpress.com
-
eraorastudio.com
-
verytycs.com
-
officehymy.com
-
strategicstatements.com
-
caffeinternet.it
-
denifl-consulting.at
-
craftleathermnl.com
-
makeflowers.ru
-
amylendscrestview.com
-
nacktfalter.de
-
christinarebuffetcourses.com
-
enovos.de
-
id-et-d.fr
-
peterstrobos.com
-
caribbeansunpoker.com
-
rota-installations.co.uk
-
courteney-cox.net
-
hardinggroup.com
-
narcert.com
-
idemblogs.com
-
theletter.company
-
intecwi.com
-
ralister.co.uk
-
abitur-undwieweiter.de
-
smogathon.com
-
spd-ehningen.de
-
partnertaxi.sk
-
jyzdesign.com
-
myhostcloud.com
-
pierrehale.com
-
beyondmarcomdotcom.wordpress.com
-
crosspointefellowship.church
-
zimmerei-deboer.de
-
eadsmurraypugh.com
-
smessier.com
-
candyhouseusa.com
-
cirugiauretra.es
-
mrtour.site
-
brandl-blumen.de
-
quickyfunds.com
-
cortec-neuro.com
-
imaginado.de
-
higadograsoweb.com
-
crowd-patch.co.uk
-
vancouver-print.ca
-
eglectonk.online
-
vitavia.lt
-
live-your-life.jp
-
satyayoga.de
-
oncarrot.com
-
croftprecision.co.uk
-
norpol-yachting.com
-
gmto.fr
-
101gowrie.com
-
argenblogs.com.ar
-
assurancesalextrespaille.fr
-
actecfoundation.org
-
mezhdu-delom.ru
-
bafuncs.org
-
qualitaetstag.de
-
corelifenutrition.com
-
iphoneszervizbudapest.hu
-
creative-waves.co.uk
-
architecturalfiberglass.org
-
vanswigchemdesign.com
-
fitnessingbyjessica.com
-
milsing.hr
-
readberserk.com
-
chavesdoareeiro.com
-
groupe-frayssinet.fr
-
sachnendoc.com
-
happyeasterimages.org
-
cheminpsy.fr
-
vermoote.de
-
romeguidedvisit.com
-
zzyjtsgls.com
-
ctrler.cn
-
joseconstela.com
-
hatech.io
-
tophumanservicescourses.com
-
wraithco.com
-
alsace-first.com
-
ceid.info.tr
-
edgewoodestates.org
-
nmiec.com
-
drugdevice.org
-
cnoia.org
-
bhwlawfirm.com
-
rushhourappliances.com
-
highlinesouthasc.com
-
waywithwords.net
-
roadwarrior.app
-
advokathuset.dk
-
kenhnoithatgo.com
-
serce.info.pl
-
transportesycementoshidalgo.es
-
danskretursystem.dk
-
kamahouse.net
-
coding-machine.com
-
bastutunnan.se
-
craigvalentineacademy.com
-
lmtprovisions.com
-
hvccfloorcare.com
-
villa-marrakesch.de
-
cityorchardhtx.com
-
aniblinova.wordpress.com
-
alvinschwartz.wordpress.com
-
coastalbridgeadvisors.com
-
spectrmash.ru
-
leoben.at
-
michaelsmeriglioracing.com
-
pay4essays.net
-
vox-surveys.com
-
leeuwardenstudentcity.nl
-
schutting-info.nl
-
berlin-bamboo-bikes.org
-
gporf.fr
-
ouryoungminds.wordpress.com
-
labobit.it
-
birnam-wood.com
-
celularity.com
-
blood-sports.net
-
bockamp.com
-
walkingdeadnj.com
-
iqbalscientific.com
-
symphonyenvironmental.com
-
mytechnoway.com
-
abogadoengijon.es
-
drfoyle.com
-
coursio.com
-
sotsioloogia.ee
-
bouquet-de-roses.com
-
kampotpepper.gives
-
microcirc.net
-
sojamindbody.com
-
iyahayki.nl
-
buymedical.biz
-
tinkoff-mobayl.ru
-
tinyagency.com
-
fannmedias.com
-
latribuessentielle.com
-
bunburyfreightservices.com.au
-
stupbratt.no
-
ussmontanacommittee.us
-
otto-bollmann.de
-
spacecitysisters.org
-
jakekozmor.com
-
conasmanagement.de
-
asiluxury.com
-
drnice.de
-
austinlchurch.com
-
delawarecorporatelaw.com
-
homng.net
-
galserwis.pl
-
xoabigail.com
-
selfoutlet.com
-
balticdentists.com
-
modelmaking.nl
-
team-montage.dk
-
filmstreamingvfcomplet.be
-
andersongilmour.co.uk
-
wien-mitte.co.at
-
babcockchurch.org
-
helikoptervluchtnewyork.nl
-
zso-mannheim.de
-
irishmachineryauctions.com
-
krcove-zily.eu
-
plastidip.com.ar
-
kmbshipping.co.uk
-
mylolis.com
-
gasbarre.com
-
gamesboard.info
-
extraordinaryoutdoors.com
-
almosthomedogrescue.dog
-
tomaso.gr
-
gymnasedumanagement.com
-
agence-chocolat-noir.com
-
sw1m.ru
-
antenanavi.com
-
evangelische-pfarrgemeinde-tuniberg.de
-
videomarketing.pro
-
better.town
-
echtveilig.nl
-
ccpbroadband.com
-
juneauopioidworkgroup.org
-
easytrans.com.au
-
calxplus.eu
-
cite4me.org
-
modamilyon.com
-
littlebird.salon
-
hokagestore.com
-
you-bysia.com.au
-
bodyforwife.com
-
webmaster-peloton.com
-
siliconbeach-realestate.com
-
kafu.ch
-
tanciu.com
-
iviaggisonciliegie.it
-
bigasgrup.com
-
ftlc.es
-
bookspeopleplaces.com
-
deepsouthclothingcompany.com
-
insidegarage.pl
-
schoellhammer.com
-
campusoutreach.org
-
newstap.com.ng
-
stacyloeb.com
-
miriamgrimm.de
-
ecpmedia.vn
-
highimpactoutdoors.net
-
argos.wityu.fund
-
seitzdruck.com
-
mymoneyforex.com
-
ziegler-praezisionsteile.de
-
new.devon.gov.uk
-
chrissieperry.com
-
stoneys.ch
-
thailandholic.com
-
rerekatu.com
-
presseclub-magdeburg.de
-
marathonerpaolo.com
-
kariokids.com
-
bauertree.com
-
unim.su
-
mbfagency.com
-
gasolspecialisten.se
-
woodleyacademy.org
-
the-domain-trader.com
-
arteservicefabbro.com
-
freie-gewerkschaften.de
-
dutchbrewingcoffee.com
-
webhostingsrbija.rs
-
pasvenska.se
-
songunceliptv.com
-
slwgs.org
-
live-con-arte.de
-
teczowadolina.bytom.pl
-
opatrovanie-ako.sk
-
stemplusacademy.com
-
sexandfessenjoon.wordpress.com
-
shadebarandgrillorlando.com
-
behavioralmedicinespecialists.com
-
consultaractadenacimiento.com
-
xn--logopdie-leverkusen-kwb.de
-
ledmes.ru
-
jolly-events.com
-
kunze-immobilien.de
-
slimani.net
-
web.ion.ag
-
csgospeltips.se
-
centromarysalud.com
-
vetapharma.fr
-
supportsumba.nl
-
mrsplans.net
-
fizzl.ru
-
2ekeus.nl
-
macabaneaupaysflechois.com
-
remcakram.com
-
abogadosaccidentetraficosevilla.es
-
alfa-stroy72.com
-
people-biz.com
-
tarotdeseidel.com
-
ogdenvision.com
-
1kbk.com.ua
-
pelorus.group
-
devok.info
-
tampaallen.com
-
richard-felix.co.uk
-
retroearthstudio.com
-
osterberg.fi
-
herbayupro.com
-
knowledgemuseumbd.com
-
jandaonline.com
-
trulynolen.co.uk
-
div-vertriebsforschung.de
-
pocket-opera.de
-
sweering.fr
-
haar-spange.com
-
launchhubl.com
-
backstreetpub.com
-
verbisonline.com
-
aco-media.nl
-
zewatchers.com
-
spsshomeworkhelp.com
-
yourobgyn.net
-
erstatningsadvokaterne.dk
-
physiofischer.de
-
farhaani.com
-
plantag.de
-
ausbeverage.com.au
-
baustb.de
-
milestoneshows.com
-
tonelektro.nl
-
pcprofessor.com
-
ausair.com.au
-
saxtec.com
-
odiclinic.org
-
thee.network
-
verifort-capital.de
-
darrenkeslerministries.com
-
artotelamsterdam.com
-
carriagehousesalonvt.com
-
luxurytv.jp
-
platformier.com
-
run4study.com
-
atozdistribution.co.uk
-
oneheartwarriors.at
-
saarland-thermen-resort.com
-
tandartspraktijkhartjegroningen.nl
-
streamerzradio1.site
-
anybookreader.de
-
plotlinecreative.com
-
maxadams.london
-
samnewbyjax.com
-
mrxermon.de
-
ravensnesthomegoods.com
-
importardechina.info
-
igfap.com
-
kirkepartner.dk
-
radaradvies.nl
-
creamery201.com
-
kaminscy.com
-
airconditioning-waalwijk.nl
-
leather-factory.co.jp
-
philippedebroca.com
-
imperfectstore.com
-
olejack.ru
-
christ-michael.net
-
dutchcoder.nl
-
paradicepacks.com
-
forskolorna.org
-
baumkuchenexpo.jp
-
antonmack.de
-
fundaciongregal.org
-
mirjamholleman.nl
-
bierensgebakkramen.nl
-
foryourhealth.live
-
tenacitytenfold.com
-
wychowanieprzedszkolne.pl
-
ai-spt.jp
-
jeanlouissibomana.com
-
renergysolution.com
-
gopackapp.com
-
fotoscondron.com
-
stingraybeach.com
-
testcoreprohealthuk.com
-
groupe-cets.com
-
punchbaby.com
-
dinslips.se
-
ahouseforlease.com
-
answerstest.ru
-
allure-cosmetics.at
-
adultgamezone.com
-
citymax-cr.com
-
marcuswhitten.site
-
parebrise-tla.fr
-
smalltownideamill.wordpress.com
-
tigsltd.com
-
baylegacy.com
-
pinkexcel.com
-
maineemploymentlawyerblog.com
-
otsu-bon.com
-
quemargrasa.net
-
embracinghiscall.com
-
tux-espacios.com
-
figura.team
-
frontierweldingllc.com
-
biortaggivaldelsa.com
-
rhinosfootballacademy.com
-
naturstein-hotte.de
-
ncuccr.org
-
burkert-ideenreich.de
-
hiddencitysecrets.com.au
-
lykkeliv.net
-
shiftinspiration.com
-
pogypneu.sk
-
dirittosanitario.biz
-
jorgobe.at
-
anteniti.com
-
lapmangfpt.info.vn
-
elimchan.com
-
mrsfieldskc.com
-
systemate.dk
-
despedidascostablanca.es
-
real-estate-experts.com
-
insp.bi
-
oemands.dk
-
c2e-poitiers.com
-
d1franchise.com
-
gaiam.nl
-
commonground-stories.com
-
imadarchid.com
-
paymybill.guru
-
talentwunder.com
-
danubecloud.com
-
hexcreatives.co
-
rimborsobancario.net
-
manifestinglab.com
-
perbudget.com
-
turkcaparbariatrics.com
-
vloeren-nu.nl
-
kidbucketlist.com.au
-
solerluethi-allart.ch
-
hrabritelefon.hr
-
blossombeyond50.com
-
ora-it.de
-
girlillamarketing.com
-
tanzprojekt.com
-
comparatif-lave-linge.fr
-
maureenbreezedancetheater.org
-
marietteaernoudts.nl
-
iwr.nl
-
mediaclan.info
-
oceanastudios.com
-
bildungsunderlebnis.haus
-
mapawood.com
-
thomas-hospital.de
-
julis-lsa.de
-
euro-trend.pl
-
edelman.jp
-
sevenadvertising.com
-
aurum-juweliere.de
-
ino-professional.ru
-
mousepad-direkt.de
-
bricotienda.com
-
jbbjw.com
-
dsl-ip.de
-
camsadviser.com
-
paulisdogshop.de
-
bargningharnosand.se
-
baptisttabernacle.com
-
merzi.info
-
sportverein-tambach.de
-
daniel-akermann-architektur-und-planung.ch
-
spinheal.ru
-
associationanalytics.com
-
the-virtualizer.com
-
tecnojobsnet.com
-
edrcreditservices.nl
-
puertamatic.es
-
vdberg-autoimport.nl
-
bloggyboulga.net
-
hihaho.com
-
mirkoreisser.de
-
haremnick.com
-
onlyresultsmarketing.com
-
eco-southafrica.com
-
solhaug.tk
-
socstrp.org
-
daklesa.de
-
parking.netgateway.eu
-
americafirstcommittee.org
-
wsoil.com.sg
-
bargningavesta.se
-
igorbarbosa.com
-
aprepol.com
-
mooshine.com
-
castillobalduz.es
-
kostenlose-webcams.com
-
withahmed.com
-
connectedace.com
-
panelsandwichmadrid.es
-
jobmap.at
-
abogados-en-alicante.es
-
nancy-informatique.fr
-
coding-marking.com
-
rostoncastings.co.uk
-
fotoideaymedia.es
-
pivoineetc.fr
-
nhadatcanho247.com
-
yassir.pro
-
promesapuertorico.com
-
htchorst.nl
-
ceres.org.au
-
dlc.berlin
-
basisschooldezonnewijzer.nl
-
raschlosser.de
-
zervicethai.co.th
-
herbstfeststaefa.ch
-
sofavietxinh.com
-
hotelsolbh.com.br
-
nicoleaeschbachorg.wordpress.com
-
mooglee.com
-
gonzalezfornes.es
-
markelbroch.com
-
lynsayshepherd.co.uk
-
fibrofolliculoma.info
-
ncs-graphic-studio.com
-
skanah.com
-
tstaffing.nl
-
bouldercafe-wuppertal.de
-
brevitempore.net
-
dubnew.com
-
mdk-mediadesign.de
-
xlarge.at
-
qlog.de
-
anthonystreetrimming.com
-
autofolierung-lu.de
-
uranus.nl
-
havecamerawilltravel2017.wordpress.com
-
datacenters-in-europe.com
-
smithmediastrategies.com
-
boulderwelt-muenchen-west.de
-
meusharklinithome.wordpress.com
-
xn--thucmctc-13a1357egba.com
-
liveottelut.com
-
365questions.org
-
nestor-swiss.ch
-
werkkring.nl
-
pmcimpact.com
-
deoudedorpskernnoordwijk.nl
-
ditog.fr
-
ymca-cw.org.uk
-
humanityplus.org
-
ontrailsandboulevards.com
-
corona-handles.com
-
kamienny-dywan24.pl
-
kissit.ca
-
asgestion.com
-
cursoporcelanatoliquido.online
-
troegs.com
-
carrybrands.nl
-
qualitus.com
-
syndikat-asphaltfieber.de
-
oldschoolfun.net
-
zieglerbrothers.de
-
blacksirius.de
-
ladelirante.fr
-
luckypatcher-apkz.com
-
wolf-glas-und-kunst.de
-
ilive.lt
-
limassoldriving.com
-
huehnerauge-entfernen.de
-
vibehouse.rw
-
forestlakeuca.org.au
-
aminaboutique247.com
-
prochain-voyage.net
-
xtptrack.com
-
zenderthelender.com
-
lillegrandpalais.com
-
artige.com
-
koko-nora.dk
-
urmasiimariiuniri.ro
-
brigitte-erler.com
-
sterlingessay.com
-
nvwoodwerks.com
-
lloydconstruction.com
-
brawnmediany.com
-
gratispresent.se
-
outcomeisincome.com
-
finediningweek.pl
-
ftf.or.at
-
xn--fn-kka.no
-
fitovitaforum.com
-
rozemondcoaching.nl
-
itelagen.com
-
associacioesportivapolitg.cat
-
stemenstilte.nl
-
jasonbaileystudio.com
-
uimaan.fi
-
spargel-kochen.de
-
waermetauscher-berechnen.de
-
no-plans.com
-
wari.com.pe
-
simpkinsedwards.co.uk
-
apolomarcas.com
-
tulsawaterheaterinstallation.com
-
micro-automation.de
-
familypark40.com
-
aakritpatel.com
-
nosuchthingasgovernment.com
-
makeitcount.at
-
theduke.de
-
bordercollie-nim.nl
-
senson.fi
-
unetica.fr
-
appsformacpc.com
-
lukeshepley.wordpress.com
-
vesinhnha.com.vn
-
toreria.es
-
musictreehouse.net
-
alten-mebel63.ru
-
smhydro.com.pl
-
loprus.pl
-
wmiadmin.com
-
solinegraphic.com
-
dublikator.com
-
milanonotai.it
-
architekturbuero-wagner.net
-
beaconhealthsystem.org
-
shiresresidential.com
-
truenyc.co
-
neuschelectrical.co.za
-
denovofoodsgroup.com
-
personalenhancementcenter.com
-
zweerscreatives.nl
-
mardenherefordshire-pc.gov.uk
-
12starhd.online
-
southeasternacademyofprosthodontics.org
-
synlab.lt
-
love30-chanko.com
-
revezlimage.com
-
craigmccabe.fun
-
sanyue119.com
-
1team.es
-
kedak.de
-
lubetkinmediacompanies.com
-
blgr.be
-
bingonearme.org
-
longislandelderlaw.com
-
noskierrenteria.com
-
petnest.ir
-
goodgirlrecovery.com
-
portoesdofarrobo.com
-
mooreslawngarden.com
-
jerling.de
-
upplandsspar.se
-
takeflat.com
-
myzk.site
-
aarvorg.com
-
ianaswanson.com
-
coffreo.biz
-
devlaur.com
-
entopic.com
-
cuspdental.com
-
nativeformulas.com
-
restaurantesszimmer.de
-
bigbaguettes.eu
-
myhealth.net.au
-
mikeramirezcpa.com
-
polzine.net
-
tsklogistik.eu
-
kojima-shihou.com
-
d2marketing.co.uk
-
hhcourier.com
-
koken-voor-baby.nl
-
rollingrockcolumbia.com
-
apprendrelaudit.com
-
glennroberts.co.nz
-
bridgeloanslenders.com
-
mank.de
-
x-ray.ca
-
antiaginghealthbenefits.com
-
charlesreger.com
-
carolinepenn.com
-
danielblum.info
-
8449nohate.org
-
operaslovakia.sk
-
wacochamber.com
-
grelot-home.com
-
cafemattmeera.com
-
first-2-aid-u.com
-
trapiantofue.it
-
geoffreymeuli.com
-
shhealthlaw.com
-
seevilla-dr-sturm.at
-
blumenhof-wegleitner.at
-
mariposapropaneaz.com
-
rocketccw.com
-
porno-gringo.com
-
pier40forall.org
-
campus2day.de
-
garage-lecompte-rouen.fr
-
rksbusiness.com
-
joyeriaorindia.com
-
nuzech.com
-
maasreusel.nl
-
kosterra.com
-
manijaipur.com
-
funjose.org.gt
-
waynela.com
-
naturalrapids.com
-
pomodori-pizzeria.de
-
tongdaifpthaiphong.net
-
shsthepapercut.com
-
stefanpasch.me
-
insigniapmg.com
-
aodaichandung.com
-
centuryrs.com
-
yousay.site
-
amerikansktgodis.se
-
blog.solutionsarchitect.guru
-
mastertechengineering.com
-
milltimber.aberdeen.sch.uk
-
sauschneider.info
-
xn--fnsterputssollentuna-39b.se
-
bptdmaluku.com
-
dubscollective.com
-
pasivect.co.uk
-
smartypractice.com
-
mir-na-iznanku.com
-
oneplusresource.org
-
globedivers.wordpress.com
-
falcou.fr
-
podsosnami.ru
-
maratonaclubedeportugal.com
-
saka.gr
-
beautychance.se
-
mediaplayertest.net
-
pointos.com
-
reddysbakery.com
-
promalaga.es
-
hashkasolutindo.com
-
teresianmedia.org
-
chandlerpd.com
-
poultrypartners.nl
-
rafaut.com
-
nataschawessels.com
-
jvanvlietdichter.nl
-
berliner-versicherungsvergleich.de
-
tastewilliamsburg.com
-
triactis.com
-
zonamovie21.net
-
naturavetal.hr
-
mediaacademy-iraq.org
-
hushavefritid.dk
-
projetlyonturin.fr
-
midmohandyman.com
-
c-a.co.in
-
waveneyrivercentre.co.uk
-
lightair.com
-
travelffeine.com
-
iyengaryogacharlotte.com
-
controldekk.com
-
ateliergamila.com
-
nandistribution.nl
-
quizzingbee.com
-
123vrachi.ru
-
lecantou-coworking.com
-
diversiapsicologia.es
-
planchaavapor.net
-
urist-bogatyr.ru
-
ampisolabergeggi.it
-
simoneblum.de
-
cerebralforce.net
-
firstpaymentservices.com
-
modestmanagement.com
-
ungsvenskarna.se
-
minipara.com
-
kindersitze-vergleich.de
-
biapi-coaching.fr
-
lange.host
-
pcp-nc.com
-
muamuadolls.com
-
desert-trails.com
-
servicegsm.net
-
bouncingbonanza.com
-
levdittliv.se
-
urclan.net
-
myteamgenius.com
-
softsproductkey.com
-
bestbet.com
-
mountaintoptinyhomes.com
-
xn--vrftet-pua.biz
-
harpershologram.wordpress.com
-
i-arslan.de
-
bogdanpeptine.ro
-
exenberger.at
-
lionware.de
-
montrium.com
-
liikelataamo.fi
-
tetinfo.in
-
corendonhotels.com
-
alysonhoward.com
-
upmrkt.co
-
theapifactory.com
-
www1.proresult.no
-
polychromelabs.com
-
bimnapratica.com
-
deschl.net
-
veybachcenter.de
-
kath-kirche-gera.de
-
kaotikkustomz.com
-
chaotrang.com
-
piajeppesen.dk
-
hoteledenpadova.it
-
esope-formation.fr
-
net
false
-
pid
$2a$12$l4/DnshgQODzNkCM0FyZke6taIcE.TK6CQsrt9Y0X6XCl.5fn2d7K
-
prc
allegro
steam
xtop
ocssd
xfssvccon
onenote
isqlplussvc
msaccess
powerpnt
cad
sqbcoreservice
thunderbird
oracle
infopath
dbeng50
pro_comm_msg
agntsvc
thebat
firefox
ocautoupds
winword
synctime
tbirdconfig
mspub
visio
sql
ocomm
orcad
mydesktopservice
dbsnmp
outlook
cadence
excel
wordpad
creoagent
encsvc
mydesktopqos
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-read.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7422
-
svc
sophos
svc$
sql
mepocs
vss
backupбмукшефы
veeam
memtas
Extracted
-
C:\Recovery\yde1s-read.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension yde1s. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/91B1A46A85B13430 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/91B1A46A85B13430 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 74AL7KOsjYjOY/DH+Zt4DNV8HSh5O4MijKOTwKm8GXv5TggGPcoM4hcag00G77MZ PZIxBS74nmC0nptgLBljksvHacAdDgsKdWxrLX7nYgBpnnNXkS8mFeyVAxo4VRz1 dFgPi4rNgqhhm1NGaP+Mv6Yq2mfVz72w4ps6R9Gfgwx6Wvd6/8wcCA1J/EmO6UXr OwagsrYCOkuRdEHp+r3bGJd/lWfzLg4hYT0oqc37vf/IFxrJdbolDBxI9/9lSXWr IXDZY9h5Nd8SF177cab9M719C1to8L4KFnasJfTWAaDM766mwt7bpPb7q6AVefsm lXepQLYXN2DIPNutBa+17jCGu1kWVuaw4Sscg6+PGtdsKr/JNiW2VMQuhORdOzsk DlDEJhTk9clJCPEcomw1gQdchuSZKthdP3r9cmJlIC2ro4NosL9n1RIx3UvDhKHg vEbmHPFZP02Gdb9pP8qTnTgODUMV7dhqZipoAQOea7ZnZHrAIQYacgrFkaYvqAkR FUx/XtUHPm2MxtgKax13ons62ZiogrSuPzk8ZlxkR/yzFjF6GkWzIThfOlEWVHQ5 Tdywd0MoL3KMxLydku2qKBpjRFuu4k9ibXRRZlgrhCFmcqc8BFDIcHHSsxq0Kp24 BUJ2Uivy+Va/J8KLRq5PGqH22hZFrwA8fDPeV3yQ3SgDB1NOl9rza6zSbWVJ9O2O 57xlLEQsJBCGRGLHJZ9cXIATMZCYssxj1CEX0lLfnzBkUvNLYoWYj20TGvpFTfSW cDPdbJjLQynP3E4ZiMgvtVgtPB1Q4vw+i+nGLfKYh/ykppELdGtl7AAYw96gtar5 y2I6c6/HTEvxHXD+0xRK3N3OM57b33/5iD70ZUNeIYEXzWeYQqh5k7/OkSZv2KcW O9K7Zt0Jlj94iioq/PVw5DQ38REi8VnSjthz3VqN8Bk3bOM3AFvEf22Lr1xL5uVR AvlHaelwts/QaSgUWXbt3oWvzPAPTy/oDe7ZvZDU7AQs98Ye3m/ttGJm5V60G8oI I9Hza51vyE7TuD7wV4DWfYfk40Fg2zrPVkVuQI8wGev4bJv/3pqJtWjoYJWzla7Y vofnmzmcV/qSH8IHaHxeSMNs9S0lwjc1IOwNZatIy3/Ku/hnNw4Tbfes5+zJK5bM TWcchlt5aR5KWnjuOI4vYLEpRzIEBo1+bEMuwqC+6k+Dyqj+jr95oCDyM4DClQ8I fNDPhCQ6UlldqQWHZqcCd+PF6TFBw7L28qA8oEP8BLKU9VIP0RxQ3VdSFDhLZtyi Xc0QVCz5djim9hPZUBJ+bNOg8U3pl5uUzLmYNcFfORWp/4nVBjzs37H2Fh23S/4j 2XfFWNN2777KLhnSw9gQaEHRpC4LYgI55Dg= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/91B1A46A85B13430
-
http://decoder.re/91B1A46A85B13430
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Executes dropped EXE 1 IoCs
pid Process 1988 MsMpEng.exe - Loads dropped DLL 1 IoCs
pid Process 1988 MsMpEng.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: MsMpEng.exe File opened (read-only) \??\Z: MsMpEng.exe File opened (read-only) \??\P: MsMpEng.exe File opened (read-only) \??\D: MsMpEng.exe File opened (read-only) \??\G: MsMpEng.exe File opened (read-only) \??\J: MsMpEng.exe File opened (read-only) \??\K: MsMpEng.exe File opened (read-only) \??\X: MsMpEng.exe File opened (read-only) \??\R: MsMpEng.exe File opened (read-only) \??\T: MsMpEng.exe File opened (read-only) \??\V: MsMpEng.exe File opened (read-only) \??\F: MsMpEng.exe File opened (read-only) \??\L: MsMpEng.exe File opened (read-only) \??\Q: MsMpEng.exe File opened (read-only) \??\S: MsMpEng.exe File opened (read-only) \??\E: MsMpEng.exe File opened (read-only) \??\O: MsMpEng.exe File opened (read-only) \??\Y: MsMpEng.exe File opened (read-only) \??\M: MsMpEng.exe File opened (read-only) \??\N: MsMpEng.exe File opened (read-only) \??\U: MsMpEng.exe File opened (read-only) \??\B: MsMpEng.exe File opened (read-only) \??\A: MsMpEng.exe File opened (read-only) \??\H: MsMpEng.exe File opened (read-only) \??\I: MsMpEng.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\86r8ffd.bmp" MsMpEng.exe - Drops file in Program Files directory 28 IoCs
description ioc Process File opened for modification \??\c:\program files\UnregisterEnter.mpg MsMpEng.exe File opened for modification \??\c:\program files\CompareResize.css MsMpEng.exe File opened for modification \??\c:\program files\SuspendRegister.rar MsMpEng.exe File opened for modification \??\c:\program files\SwitchTrace.pps MsMpEng.exe File created \??\c:\program files (x86)\yde1s-read.txt MsMpEng.exe File opened for modification \??\c:\program files\ResetDisconnect.dotm MsMpEng.exe File opened for modification \??\c:\program files\WatchRename.pptm MsMpEng.exe File opened for modification \??\c:\program files\CompareConvertTo.DVR MsMpEng.exe File opened for modification \??\c:\program files\FindCheckpoint.reg MsMpEng.exe File opened for modification \??\c:\program files\ConvertFromUninstall.odt MsMpEng.exe File opened for modification \??\c:\program files\NewUnpublish.rtf MsMpEng.exe File opened for modification \??\c:\program files\RestoreGroup.sql MsMpEng.exe File opened for modification \??\c:\program files\DenyMeasure.crw MsMpEng.exe File opened for modification \??\c:\program files\EditJoin.otf MsMpEng.exe File opened for modification \??\c:\program files\TestSync.temp MsMpEng.exe File opened for modification \??\c:\program files\RevokeUnregister.ogg MsMpEng.exe File opened for modification \??\c:\program files\UninstallCheckpoint.xht MsMpEng.exe File created \??\c:\program files\yde1s-read.txt MsMpEng.exe File opened for modification \??\c:\program files\CompareResize.temp MsMpEng.exe File opened for modification \??\c:\program files\CompareWatch.aiff MsMpEng.exe File opened for modification \??\c:\program files\UnlockConvert.WTV MsMpEng.exe File opened for modification \??\c:\program files\GrantConnect.mp4 MsMpEng.exe File opened for modification \??\c:\program files\SetConvert.mpp MsMpEng.exe File opened for modification \??\c:\program files\SplitReset.vst MsMpEng.exe File opened for modification \??\c:\program files\SelectInitialize.css MsMpEng.exe File opened for modification \??\c:\program files\CompressClose.inf MsMpEng.exe File opened for modification \??\c:\program files\DismountPing.svg MsMpEng.exe File opened for modification \??\c:\program files\ProtectPublish.cr2 MsMpEng.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1988 MsMpEng.exe 1988 MsMpEng.exe 1988 MsMpEng.exe 1988 MsMpEng.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1988 MsMpEng.exe Token: SeTakeOwnershipPrivilege 1988 MsMpEng.exe Token: SeBackupPrivilege 3996 vssvc.exe Token: SeRestorePrivilege 3996 vssvc.exe Token: SeAuditPrivilege 3996 vssvc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 764 wrote to memory of 1588 764 66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe 82 PID 764 wrote to memory of 1588 764 66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe 82 PID 764 wrote to memory of 1588 764 66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe 82 PID 1588 wrote to memory of 1988 1588 cmd.exe 84 PID 1588 wrote to memory of 1988 1588 cmd.exe 84 PID 1588 wrote to memory of 1988 1588 cmd.exe 84 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe"C:\Users\Admin\AppData\Local\Temp\66490c59cb9630b53fa3fa7125b5c9511afde38edab4459065938c1974229ca8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exeC:\Users\Admin\AppData\Local\Temp\MsMpEng.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:4768
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recovery\yde1s-read.txt
- Size 6KB
- SHA256 fb3fa73bcbc8d5617e562118f23cd917c04f8feda713b6f7842b3918dd4d6344
- MD5 92561734c49a561b03558016cc9dab1c
- SHA1 2ec40c819010b82912c621a55815daa89f25ddb3
- SHA512 88732b4c02fdc8953d0efc585bf61b5a3eaad40949087d25e3f0e59d9d4c8995e93e32cce2fa6e81b5d909fb5b43831f047828c05a84ee187d4758d823e1f172
- SSDEEP 96:GLPiNsgdxU3TPPOx2h4ldvgfBZ6J2r5gi2tINd9PrR5u:GLPr3jmQKdYfBZd9tgI1DW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe
- Size 21KB
- SHA256 33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a
- MD5 8cc83221870dd07144e63df594c391d9
- SHA1 3d409b39b8502fcd23335a878f2cbdaf6d721995
- SHA512 e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c
- SSDEEP 384:NDr3WIqWJ1q//0GftpBjRwtxO4HRN7uJlYaibn6:FLe8ifJkuUaY6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\mpsvc.dll
- Size 819KB
- SHA256 cbfb6099868eef636f97847fb509527894938c8768028935e658b121b8372922
- MD5 78066a1c4e075941272a86d4a8e49471
- SHA1 6ee656604df8760981db003ae9dce5232d01da72
- SHA512 9bca159273fc397343f4555c3fbf882301fdb9bfe7f8d130212033e76dfdbad31fdd978292b8a029f7521dfa3eeac7c0a76c9833cc2fca8312de4a651284284a
- SSDEEP 24576:+cSetOx8KDbPPeTMF+Iyy77UkQkyoPJHia/:xSjDDjeEY7uV/
- MD5 SHA1 SHA512 SSDEEP