Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 23:22
Behavioral task
behavioral1
Sample
2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe
-
Size
143KB
-
MD5
663069fe32ab671af55a5f79693aa937
-
SHA1
6dc5ba588eff210e790b81112c3614c8eb072f46
-
SHA256
626d8502352b9f4566cc6ed640b4dd22654e7f8ff8f8bd36b4c7b251f1e862ef
-
SHA512
74a46ae851d114398eb22abead0eaceace82b734d71a6b7a52c6b4db3c8e1843997275725177c1d77f2bc4cdce43549132fb30b6f51bc9cecd0b39e0d0b756c3
-
SSDEEP
3072:G3JTzbiW8jLbi4eTMlwDCnu/pGB96W/y1cL:GZn2WYbnWJ/0B9wcL
Malware Config
Extracted
sodinokibi
5
367
craftingalegacy.com
g2mediainc.com
brinkdoepke.eu
vipcarrental.ae
autoteamlast.de
hostastay.com
gavelmasters.com
ronaldhendriks.nl
successcolony.com.ng
medicalsupportco.com
kompresory-opravy.com
sveneulberg.de
oththukaruva.com
voetbalhoogeveen.nl
selected-minds.de
log-barn.co.uk
fsbforsale.com
jobkiwi.com.ng
ivancacu.com
11.in.ua
irizar.com
colored-shelves.com
soundseeing.net
scotlandsroute66.co.uk
hawaiisteelbuilding.com
mindfuelers.com
dentourage.com
hekecrm.com
finsahome.co.uk
cormanmarketing.com
morgansconsult.com
dnqa.co.uk
frimec-international.es
worldproskitour.com
csaballoons.com
krishnabrawijaya.com
tatyanakopieva.ru
silkeight.com
publicompserver.de
letsstopsmoking.co.uk
anleggsregisteret.no
arearugcleaningnyc.com
diverfiestas.com.es
lovcase.com
alltagsrassismus-entknoten.de
lassocrm.com
boyfriendsgoal.site
mbuildinghomes.com
santastoy.store
citiscapes-art.com
unislaw-narty.pl
envomask.com
patassociation.com
luvbec.com
keuken-prijs.nl
therapybusinessacademy.com
baikalflot.ru
piestar.com
diakonie-weitramsdorf-sesslach.de
klapanvent.ru
fysiotherapierijnmond.nl
avis.mantova.it
fla.se
sjtpo.org
kroophold-sjaelland.dk
alharsunindo.com
tothebackofthemoon.com
chainofhopeeurope.eu
smartmind.net
akcadagofis.com
bundan.com
graygreenbiomedservices.com
dogsunlimitedguide.com
rvside.com
davedavisphotos.com
johnstonmingmanning.com
mangimirossana.it
welovecustomers.fr
kenmccallum.com
glas-kuck.de
theboardroomafrica.com
slideevents.be
omegamarbella.com
zdrowieszczecin.pl
fotoslubna.com
mursall.de
forextimes.ru
hiddensee-buhne11.de
girlish.ae
motocrosshideout.com
billyoart.com
eafx.pro
patriotcleaning.net
renehartman.nl
xn--80addfr4ahr.dp.ua
speakaudible.com
magrinya.net
der-stempelking.de
trivselsguide.dk
mondolandscapes.com
nginx.com
voice2biz.com
hoteltantra.com
casinodepositors.com
wallflowersandrakes.com
bakingismyyoga.com
traitware.com
avtoboss163.ru:443
hvitfeldt.dk
natturestaurante.com.br
onlinemarketingsurgery.co.uk
brownswoodblog.com
reizenmetkinderen.be
mneti.ru
linkbuilding.life
levencovka.ru
bilius.dk
p-ride.live
tecleados.com
cl0nazepamblog.com
atelierkomon.com
oexebusiness.com
miscbo.it
kickittickets.com
rivermusic.nl
airserviceunlimited.com
pureelements.nl
subyard.com
pinkxgayvideoawards.com
eos-horlogerie.com
craftron.com
nationnewsroom.com
alaskaremote.com
askstaffing.com
springfieldplumbermo.com
ziliak.com
berdonllp.com
citydogslife.com
tradenavigator.ch
witraz.pl
jlwilsonbooks.com
nvisionsigns.com
espaciopolitica.com
singletonfinancial.com
ideamode.com
clinic-beethovenstrasse-ag.ch
precisetemp.com
kellengatton.com
bruut.online
matteoruzzaofficial.com
pourlabretagne.bzh
goeppinger-teppichreinigung.de
rhino-storage.co.uk
xtensifi.com
hm-com.com
vvego.com
startuplive.org
easydental.ae
alisodentalcare.com
weddingceremonieswithtim.com
tutvracks.com
harleystreetspineclinic.com
dantreranch.com
docarefoundation.org
lexced.com
palmecophilippines.com
louiedager.com
digitale-elite.de
sber-biznes.com
stabilisateur.fr
logosindustries.com
azloans.com
customroasts.com
mikegoodfellow.co.uk
annenymus.com
larchwoodmarketing.com
wineandgo.hu
smartspeak.com
nepal-pictures.com
aslog.fr
aceroprime.com
zorgboerderijravensbosch.nl
solutionshosting.co.uk
elex.is
mike.matthies.de
coachpreneuracademy.com
efficiencyconsulting.es
livelai.com
victorvictoria.com
signamedia.de
min-virksomhed.dk
sycamoregreenapts.com
ultimatelifesource.com
purepreprod4.com
kausette.com
luvinsburger.fr
mariamalmahdi.com
acornishstudio.co.uk
nepressurecleaning.com
malevannye.ru
banukumbak.com
metallbau-hartmann.eu
globalskills.pt
denhaagfoodie.nl
cxcompany.com
wordpress.idium.no
bcmets.info
koncept-m.ru
xn--80abehgab4ak0ddz.xn--p1ai
altitudeboise.com
bd2fly.com
foerderverein-vatterschule.de
rhino-turf.com
suitesartemis.gr
thiagoperez.com
kvetymichalovce.sk
netadultere.fr
sololibrerie.it
global-migrate.com
indiebizadvocates.org
juergenblaetz.de
signededenroth.dk
onlinetvgroup.com
fazagostar.co
stagefxinc.com
drbrianhweeks.com
ketomealprep.academy
saberconcrete.com
entdoctor-durban.com
oscommunity.de
chomiksy.net
latteswithleslie.com
annida.it
edrickennedymacfoy.com
midwestschool.org
michal-s.co.il
kartuindonesia.com
claudiakilian.de
thegetawaycollective.com
matthieupetel.fr
condormobile.fr
astrographic.com
marmarabasin.com
kelsigordon.com
forskolinslimeffect.net
cardsandloyalty.com
electricianul.com
buffdaddyblog.com
jandhpest.com
albcleaner.fr
concontactodirecto.com
heuvelland-oaze.nl
fixx-repair.com
awaisghauri.com
kiraribeaute-nani.com
fridakids.com
cascinarosa33.it
3daywebs.com
boloria.de
endstarvation.com
switch-made.com
aoyama.ac
universelle.fr
bodet150ans.com
mazift.dk
aciscomputers.com
mariannelemenestrel.com
explora.nl
haus-landliebe.de
geoweb.software
pansionatblago.ru
1deals.com
stralsund-ansichten.de
projektparkiet.pl
gsconcretecoatings.com
banksrl.co.za
bourchier.org
livedeveloper.com
stressreliefadvice.com
lagschools.ng
m2graph.fr
look.academy
turing.academy
daveystownhouse.com
myfbateam.com
penumbuhrambutkeiskei.com
imaginekithomes.co.nz
devplus.be
ruggestar.ch
proffteplo.com
oro.ae
paprikapod.com
drnelsonpediatrics.com
tramadolhealth.com
thehovecounsellingpractice.co.uk
speiserei-hannover.de
arthakapitalforvaltning.dk
skoczynski.eu
hotjapaneselesbian.com
cssp-mediation.org
cp-bap.de
ygallerysalonsoho.com:443
atma.nl
metcalfe.ca
insane.agency
sochi-okna23.ru
carolynfriedlander.com
liverpoolabudhabi.ae
hartofurniture.com
boomerslivinglively.com
moira-cristescu.com
texanscan.org
bohrlochversicherung.info
birthplacemag.com
primemarineengineering.com
angelsmirrorus.com
qandmmusiccenter.com
die-immo-agentur.de
the-beauty-guides.com
levelseven.be
catalyseurdetransformation.com
mollymccarthydesign.com
hutchstyle.co.uk
oportowebdesign.com
phoenixcrane.com
olry-cloisons.fr
alnectus.com
testitjavertailut.net
monstarrsoccer.com
sellthewrightway.com
cotton-avenue.co.il
lifeinbreaths.com
alwaysdc.com
rsidesigns.com
leadforensics.com
premiumweb.com.ua:443
rozmata.com
opticahubertruiz.com
ntinasfiloxenia.gr
so-sage.fr
polynine.com
k-zubki.ru
pisofare.co
tages-geldvergleich.de
funworx.de
smarttourism.academy
theater-lueneburg.de
bajova.sk
yvesdoin-aquarelles.fr
leatherjees.com
sarahspics.co.uk
yourcosmicbeing.com
rs-danmark.dk
simpleitsolutions.ch
makingmillionaires.net
epsondriversforwindows.com
ayudaespiritualtamara.com
trevi-vl.ru
vapiano.fr
antesacademy.it
rarefoods.ro
belinda.af
dennisverschuur.com
sprintcoach.com
martinipstudios.com
ddmgen.com
block-optic.com
almamidwifery.com
ncn.nl
alpesiberie.com
palmenhaus-erfurt.de
bcabattoirs.org
circlecitydj.com
slotenmakerszwijndrecht.nl
innersurrection.com
aheadloftladders.co.uk
angelika-schwarz.com
lapponiasafaris.com
jonnyhooley.com
oraweb.net
donau-guides.eu
istantidigitali.com
optigas.com
asiaartgallery.jp
limounie.com
rishigangoly.com
taulunkartano.fi
osn.ro
marcandy.com
jacquesgarcianoto.com
thepixelfairy.com
mariajosediazdemera.com
leopoldineroux.com
goodboyscustom.com
energosbit-rp.ru
eatyoveges.com
mac-computer-support-hamburg.de
tilldeeke.de
aberdeenartwalk.org
encounter-p.net
andreaskildegaard.dk
tweedekansenloket.nl
amorbellezaysalud.com
palema.gr
9nar.com
lunoluno.com
betterce.com
beauty-traveller.com
alattekniksipil.com
craftstone.co.nz
alene.co
jollity.hu
chorusconsulting.net
motocrossplace.co.uk
mieleshopping.it
mundo-pieces-auto.fr
richardkershawwines.co.za
salonlamar.nl
fotoeditores.com
axisoflove.org:443
ledyoucan.com
metroton.ru
apiarista.de
cmascd.com
karelinjames.com
gosouldeep.com
nieuwsindeklas.be
mediogiro.com.ar
jax-interim-and-projectmanagement.com
elliemaccreative.wordpress.com
eshop.design
billscars.net
verbouwingsdouche.nl
test-teleachat.fr
mazzaropi.com.br
finnergo.eu
jobscore.com
pedmanson.com
belofloripa.be
littlesaints.academy
eastgrinsteadwingchun.com
pharmeko-group.com
bridalcave.com
georgemuncey.com
glennverschueren.be
jag.me
groovedealers.ru
internalresults.com
wyreforest.net
uncensoredhentaigif.com
centuryvisionglobal.com
skyboundnutrition.co.uk
adedesign.com
thesilkroadny.com
fluzfluzrewards.com
hotelturbo.de
skidpiping.de
gurutechnologies.net
nxtstg.org
chris-anne.com
billigeflybilletter.dk
vitormmcosta.com
newonestop.com
adterium.com
janellrardon.com
crestgood.com
chatterchatterchatter.com
skooppi.fi
sealgrinderpt.com
towelroot.co
janasfokus.com
zuerich-umzug.ch
biketruck.de
iactechnologies.net
artcase.pl
otpusk.zp.ua
lookandseen.com
kristianboennelykke.dk
mahikuchen.com
kryptos72.com
supercarhire.co.uk
acb-gruppe.ch
stathmoulis.gr
globalcompliancenews.com
malzomattalar.com
peninggibadan.co.id
slotspinner.com
galaniuklaw.com
deziplan.ru
toranjtuition.org
loysonbryan.com
physio-lang.de
husetsanitas.dk
ced-elec.com
bescomedical.de
omnicademy.com
angeleyezstripclub.com
sppdstats.com
the3-week-diet.net
furland.ru
carmel-york.com
schlagbohrmaschinetests.com
golfclublandgoednieuwkerk.nl
maryairbnb.wordpress.com
legundschiess.de
schroederschoembs.com
subquercy.fr
chatberlin.de
happylublog.wordpress.com
fitnessblenderstory.com
schulz-moelln.de
justaroundthecornerpetsit.com
clemenfoto.dk
tanatek.com
rino-gmbh.com
soncini.ch
anchelor.com
shortysspices.com
charlottelhanna.com
avisioninthedesert.com
spartamovers.com
cmeow.com
transifer.fr
futurenetworking.com
theatre-embellie.fr
plbinsurance.com
adabible.org
zwemofficial.nl
triplettagaite.fr
fidelitytitleoregon.com
racefietsenblog.nl
keyboardjournal.com
a-zpaperwork.eu
relevantonline.eu
secrets-clubs.co.uk
utilisacteur.fr
ya-elka.ru
paardcentraal.nl
charlesfrancis.photos
floweringsun.org
b3b.ch
photographycreativity.co.uk
pro-gamer.pl
dentallabor-luenen.de
modamarfil.com
alabamaroofingllc.com
noda.com.ua
pajagus.fr
cincinnatiphotocompany.org
nevadaruralhousingstudies.org
eksperdanismanlik.com
kombi-dress.com
gardenpartner.pl
lesyeuxbleus.net
broccolisoep.nl
putzen-reinigen.com
nykfdyrehospital.dk
bringmehope.org
tetameble.pl
k-v-f.de
pinthelook.com
epicjapanart.com
apmollerpension.com
laaisterplakky.nl
protoplay.ca
gatlinburgcottage.com
tchernia-conseil.fr
biblica.com
prodentalblue.com
from02pro.com
brighthillgroup.com
mediabolmong.com
galatee-couture.com
humanviruses.org
katherinealy.com
cookinn.nl
sshomme.com
innovationgames-brabant.nl
limmortelyouth.com
theintellect.edu.pk
triplettabordeaux.fr
tbalp.co.uk
thisprettyhair.com
webforsites.com
parisschool.ru
mind2muscle.nl
laylavalentine.com
allinonecampaign.com
spirello.nl
heimdalbygg.no
kosten-vochtbestrijding.be
brisbaneosteopathic.com.au
margaretmcshane.com
adaduga.info
jayfurnitureco.com
agrifarm.dk
neolaiamedispa.com
redpebblephotography.com
poems-for-the-soul.ch
phukienbepthanhdat.com
forumsittard.nl
hnkns.com
dentalcircle.com
elitkeramika-shop.com.ua
rossomattonecase.it
direitapernambuco.com
catchup-mag.com
pubcon.com
cainlaw-okc.com
napisat-pismo-gubernatoru.ru:443
line-x.co.uk
riffenmattgarage.ch
liveyourheartout.co
yayasanprimaunggul.org
itheroes.dk
babysitting-hk.helpergo.co
skolaprome.eu
hepishopping.com
sytzedevries.com
xn--billigafrgpatroner-stb.se
stoneridgemontessori.com
buerocenter-butzbach-werbemittel.de
topvijesti.net
bluemarinefoundation.com
akwaba-safaris.com
studionumerik.fr
hawthornsretirement.co.uk
mamajenedesigns.com
grancanariaregional.com
campinglaforetdetesse.com
molade.nl
jeanmonti.com
valiant-voice.com
dr-vita.de
altocontatto.net
nicksrock.com
profibersan.com
agenceassemble.fr
c-sprop.com
jalkapuu.net
walterman.es
nrgvalue.com
web865.com
haard-totaal.nl
buzzneakers.com
5pointpt.com
dieetuniversiteit.nl
parksideseniorliving.net
teamsegeln.ch
ciga-france.fr
tellthebell.website
zealcon.ae
ramirezprono.com
ronielyn.com
jimprattmediations.com
mrmac.com
eventosvirtualesexitosos.com
egpu.fr
ikadomus.com
t3brothers.com
masecologicos.com
initconf.com
jlgraphisme.fr
ykobbqchicken.ca
dierenambulancealkmaar.nl
business-basic.de
leansupremegarcinia.net
uci-france.fr
leloupblanc.gr
saint-malo-developpement.fr
lmmont.sk
outstandingminialbums.com
advanced-removals.co.uk
bumbipdeco.site
augen-praxisklinik-rostock.de
vdolg24.online
circuit-diagramz.com
specialtyhomeservicesllc.com
onesynergyinternational.com
fi-institutionalfunds.com
apogeeconseils.fr
yournextshoes.com
campusescalade.com
mrcar.nl
kafkacare.com
metriplica.academy
narca.net
ikzoekgod.be
pvandambv.nl
auto-opel.ro
bellesiniacademy.org
yuanshenghotel.com
sweetz.fr
bonitabeachassociation.com
sambaglow.com
druktemakersheerenveen.nl
renderbox.ch
latableacrepes-meaux.fr
neonodi.be
lovetzuchia.com
cc-experts.de
awaitspain.com
schluesseldienste-hannover.de
cap29010.it
alcye.com
kookooo.com
richardmaybury.co.uk
cesep2019.com
rubyaudiology.com
smartercashsystem.com
bagaholics.in
loparnille.se
cuadc.org
mensemetgesigte.co.za
terraflair.de
triavlete.com
baita.ac
rtc24.com
pixelhealth.net
molinum.pt
randyabrown.com
imajyuku-sozoku.com
rattanwarehouse.co.uk
imagine-entertainment.com
brannbornfastigheter.se
chinowarehousespace.com
go.labibini.ch
tesisatonarim.com
enews-qca.com
ahgarage.com
reygroup.pt
artvark.nl
production-stills.co.uk
directique.com
skinkeeper.li
pankiss.ru
silverbird.dk
raeoflightmusic.com
computer-place.de
nbva.co.uk
volta.plus
jefersonalessandro.com
rename.kz
myplaywin3.com
rentingwell.com
muller.nl
operativadigital.com
perceptdecor.com
greatofficespaces.net
stanleyqualitysystems.com
yourhappyevents.fr
perfectgrin.com
wasnederland.nl
inewsstar.com
arazi.eus
xn--ziinoapte-6ld.ro
gazelle-du-web.com
lumturo.academy
innervisions-id.com
memphishealthandwellness.com
90nguyentuan.com
andermattswisswatches.ch
promus.ca
bayshoreelite.com
mesajjongeren.nl
agencewho-aixenprovence.fr
qwikcoach.com
pazarspor.org.tr
creohn.de
kamin-somnium.de
kuriero.pro
maxcube24.com.ua
expohomes.com
mayprogulka.ru
mgimalta.com
spectamarketingdigital.com.br
alexwenzel.de
fskhjalmar.se
oncarrot.com
pokemonturkiye.com
bg.szczecin.pl
werkzeugtrolley.net
5thactors.com
geitoniatonaggelon.gr
muni.pe
aktivfriskcenter.se
dmlcpa.com
frankgoll.com
devus.de
landgoedspica.nl
handyman-silkeborg.dk
queertube.net
gratiocafeblog.wordpress.com
techybash.com
karmeliterviertel.com
parentsandkids.com
grupoexin10.com
shrinkingplanet.com
hom-frisor.dk
bluelakevision.com
grafikstudio-visuell.de
pxsrl.it
mindsparkescape.com
iexpert99.com
lyricalduniya.com
animation-pro.co.uk
site.markkit.com.br
bluetenreich-brilon.de
mslp.org
licensed-public-adjuster.com
vedsegaard.dk
drvoip.com
satoblog.org
flossmoordental.com
bmw-i-pure-impulse.com
biodentify.ai
iron-mine.ru
redctei.co
bjornvanvulpen.nl
breakluckrecords.com
fta-media.com
domaine-des-pothiers.com
invela.dk
cymru.futbol
hinotruckwreckers.com.au
profiz.com
auberives-sur-vareze.fr
glende-pflanzenparadies.de
advancedeyecare.com
fanuli.com.au
bychowo.pl
catering.com
111firstdelray.com
mercadodelrio.com
interlinkone.com
greeneyetattoo.com
rapid5kloan.org
hensleymarketing.com
stage-infirmier.fr
ebible.co
lashandbrowenvy.com
sharonalbrightdds.com
collegetennis.info
photonag.com
ravage-webzine.nl
spacebel.be
johnkoen.com
unexplored.gr
thegrinningmanmusical.com
martha-frets-ceramics.nl
basindentistry.com
scietech.academy
wademurray.com
tzn.nu
bratek-immobilien.de
letterscan.de
n-newmedia.de
gta-jjb.fr
bodymindchallenger.com
veggienessa.com
suonenjoen.fi
dinedrinkdetroit.com
acumenconsultingcompany.com
hameghlim.com
quitescorting.com
dcc-eu.com
solidhosting.nl
ceocenters.com
hospitalitytrainingsolutions.co.uk
amyandzac.com
radishallgood.com
lgiwines.com
factorywizuk.com
dibli.store
lollachiro.com
goodherbalhealth.com
dinecorp.com
stitch-n-bitch.com
kdbrh.com
wribrazil.com
bubbalucious.com
rechtenplicht.be
aquacheck.co.za
buonabitare.com
framemyballs.com
campusce.com
datatri.be
eyedoctordallas.com
holocine.de
lisa-poncon.fr
designimage.ae
descargandoprogramas.com
jdscenter.com
blucamp.com
liepertgrafikweb.at
beandrivingschool.com.au
ludoil.it
acibademmobil.com.tr
brunoimmobilier.com
jglconsultancy.com
ingresosextras.online
wirmuessenreden.com
sachainchiuk.com
airvapourbarrier.com
lattalvor.com
powershell.su
advance-refle.com
housesofwa.com
blueridgeheritage.com
advesa.com
jaaphoekzema.nl
ox-home.com
sunsolutions.es
ufovidmag.com
markseymourphotography.co.uk
wrinstitute.org
focuskontur.com
comoserescritor.com
blavait.fr
evsynthacademy.org
pilotgreen.com
leijstrom.com
janmorgenstern.com
gaearoyals.com
nalliasmali.net
2020hindsight.info
scentedlair.com
greenrider.nl
lsngroupe.com
orchardbrickwork.com
rokthetalk.com
prometeyagro.com.ua
ijsselbeton.nl
kryddersnapsen.dk
baumfinancialservices.com
mjk.digital
corporacionrr.com
o2o-academy.com
manzel.tn
smartworkplaza.com
christopherhannan.com
carsten.sparen-it.de
peppergreenfarmcatering.com.au
reputation-medical.online
christianscholz.de
delegationhub.com
hostingbangladesh.net
nauticmarine.dk
ocduiblog.com
jakubrybak.com
teutoradio.de
zaczytana.com
zumrutkuyutemel.com
duthler.nl
dayenne-styling.nl
cleanroomequipment.ie
naukaip.ru
activeterroristwarningcompany.com
breathebettertolivebetter.com
tastevirginia.com
awag-blog.de
watchsale.biz
whoopingcrane.com
ilovefullcircle.com
bulyginnikitav.000webhostapp.com
saboboxtel.uk
zinnystar.com
factoriareloj.com
internestdigital.com
cops4causes.org
affligemsehondenschool.be
achetrabalhos.com
curtsdiscountguns.com
lidkopingsnytt.nu
cac2040.com
khtrx.com
barbaramcfadyenjewelry.com
agora-collectivites.com
nuohous.com
agendatwentytwenty.com
goddardleadership.org
fascaonline.com
opt4cdi.com
domilivefurniture.com
amelielecompte.wordpress.com
burg-zelem.de
mustangmarketinggroup.com
strauchs-wanderlust.info
aidanpublishing.co.uk
johnsonweekly.com
bavovrienden.nl
skyscanner.ro
jobstomoveamerica.org
etgdogz.de
abulanov.com
nourella.com
ncjc.ca
mrkluttz.com
ilveshistoria.com
frameshift.it
eurethicsport.eu
paradigmlandscape.com
jmmartinezilustrador.com
ninjaki.com
unboxtherapy.site
enactusnhlstenden.com
afbudsrejserallinclusive.dk
deduktia.fi
endlessrealms.net
fire-space.com
qrs-international.com
tieronechic.com
nutriwell.com.sg
trainiumacademy.com
kerstliedjeszingen.nl
bendel-partner.de
placermonticello.com
andrealuchesi.it
professionetata.com
happycatering.de
rolleepollee.com
thestudio.academy
linearete.com
magnetvisual.com
richardiv.com
baptistdistinctives.org
stringnosis.academy
vitoriaecoturismo.com.br
fbmagazine.ru
agriturismocastagneto.it
xrresources.com
atrgroup.it
premier-iowa.com
pays-saint-flour.fr
o90.dk
four-ways.com
scholarquotes.com
the5thquestion.com
shortsalemap.com
hostaletdelsindians.es
michaelfiegel.com
drbenveniste.com
arabianmice.com
the-cupboard.co.uk
benchbiz.com
cyberpromote.de
edvestors.org
rentsportsequip.com
fann.ru
nexstagefinancial.com
bookingwheel.com
dreamvoiceclub.org
jameswilliamspainting.com
ownidentity.com
thenalpa.com
denverwynkoopdentist.com
gbk-tp1.de
animalfood-online.de
hypogenforensic.com
parseport.com
azerbaycanas.com
mediahub.co.nz
julielusktherapy.com
topautoinsurers.net
bertbutter.nl
distrifresh.com
guohedd.com
amco.net.au
teethinadaydentalimplants.com
kemtron.fr
sbit.ag
wg-heiligenstadt.de
rizplakatjaya.com
-
net
true
-
pid
5
-
prc
wordpad.exe
outlook.exe
tbirdconfig.exe
agntsvc.exe
thebat.exe
mydesktopservice.exe
sqbcoreservice.exe
thunderbird.exe
ocomm.exe
excel.exe
thebat64.exe
steam.exe
xfssvccon.exe
firefoxconfig.exe
sqlagent.exe
ocssd.exe
mydesktopqos.exe
msaccess.exe
isqlplussvc.exe
mspub.exe
winword.exe
sqlbrowser.exe
dbeng50.exe
sqlservr.exe
oracle.exe
encsvc.exe
powerpnt.exe
dbsnmp.exe
infopath.exe
ocautoupds.exe
mysqld_opt.exe
visio.exe
msftesql.exe
mysqld_nt.exe
synctime.exe
sqlwriter.exe
mysqld.exe
onenote.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
367
Extracted
C:\Users\306yo41t3x-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2E14C29CADBC2F19
http://decryptor.top/2E14C29CADBC2F19
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\Q: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\R: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\S: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\U: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\V: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\B: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\N: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\Z: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\D: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\J: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\K: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\L: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\T: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\W: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\F: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\H: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\I: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\O: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\X: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\G: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\M: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\Y: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\A: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened (read-only) \??\E: 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewh6x6z4601g9.bmp" 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File opened for modification \??\c:\program files\JoinConvert.m4v 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification \??\c:\program files\ResolveUninstall.mpv2 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification \??\c:\program files\StepStart.cr2 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\d60dff40.lock 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File created \??\c:\program files\d60dff40.lock 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification \??\c:\program files\ApproveProtect.wax 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification \??\c:\program files\ImportNew.dib 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\306yo41t3x-readme.txt 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File created \??\c:\program files\306yo41t3x-readme.txt 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File created \??\c:\program files (x86)\306yo41t3x-readme.txt 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification \??\c:\program files\RequestDismount.mp4 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\306yo41t3x-readme.txt 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\d60dff40.lock 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification \??\c:\program files\InitializeSkip.DVR 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification \??\c:\program files\OutConfirm.xps 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification \??\c:\program files\RepairMount.mpe 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File created \??\c:\program files (x86)\d60dff40.lock 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\306yo41t3x-readme.txt 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\d60dff40.lock 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..ionengine.resources_31bf3856ad364e35_6.1.7600.16385_de-de_402dac258d03220a.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_6.1.7600.16385_none_db04d3f548508fd9_vgafix.fon_8caf829c 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_6.1.7600.16385_none_59590e92c817a4e0_vga855.fon_0b81b0a9 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-smartcardksp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_63097ee7553ecff7_scksp.dll.mui_05f14191 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-x..ollmentui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_949ca950b4247d26_certenrollui.dll.mui_e86ca64f 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_1d6cc00f7f128cc9_comctl32.dll.mui_0da4e682 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_0715316d7363738e.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rpc-local.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4ebfba4be85e2be4.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..ure-other.resources_31bf3856ad364e35_6.1.7600.16385_it-it_967d26877ca0e4c2.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_da-dk_ff2b8a4884ab92de_msimsg.dll.mui_72e8994f 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.1.7601.17514_none_d961938b8cd1e885_dhcpcore.dll_8036fe08 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-msvcp60_31bf3856ad364e35_6.1.7600.16385_none_9e968637cb108946_msvcp60.dll_d804e509 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-rasbase_31bf3856ad364e35_6.1.7601.17514_none_765b17a2c56f9155_rasdiag.dll_341d4299 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.7600.16385_es-es_3d0cf71ea727ac84_winhttp.dll.mui_f661192f 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_3899b0ad2bb77a86.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-smartcardksp.resources_31bf3856ad364e35_6.1.7600.16385_it-it_efb448111f69bd7c_scksp.dll.mui_05f14191 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_17fdb6bbc887fde4_authui.dll.mui_19b92789 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_17330d9420bf24e8_expand.exe_f43b24c8 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-smartcardksp.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9395ac8d670c4c46_scksp.dll.mui_05f14191 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2cd61650c375bd11.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a56cb41c8b19254a.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b4cd5acb2c49b651.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1d298d428a973659_gpapi.dll.mui_ef0a9748 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_ro-ro_8fd4ffd2d917abf4.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..itmap-ms_sans_serif_31bf3856ad364e35_6.1.7600.16385_none_ac9f9e10add68c8b_sseriff.fon_dacf6ef3 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-netio-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_b4c17244cbed11a0.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_it-it_84a967f3c21f5562_aelupsvc.dll.mui_5d6cb110 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-sendmail.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d8127e0b662b3fd6_sendmail.dll.mui_cbac108c 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_hu-hu_330f86d55de64a40.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-efs-service.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ffe72aa077a48b77.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mpr.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_454ac7da0af71f49_mpr.dll.mui_a313505c 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_6.1.7601.17514_de-de_f333274052deb889_user32.dll.mui_14652dbb 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5f3874d6c7dfca9f_winload.exe.mui_3bc5b827 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-cryptbase_31bf3856ad364e35_6.1.7600.16385_none_c15ac71fc7aafddc.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_6.1.7600.16385_none_db04d3f548508fd9_8514fixg.fon_f6656725 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mssmbios.resources_31bf3856ad364e35_6.1.7600.16385_it-it_90a25fd49cec8308.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-font-fms_31bf3856ad364e35_6.1.7601.17514_none_b04d655eff508002.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dd2822fe8544398a_mlang.dll.mui_2904864a 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-gabriola_31bf3856ad364e35_6.1.7601.17514_none_e65a866e9dc81eaf_gabriola.ttf_2896bb77 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_he-il_c8da0f0005e7bf7a_mlang.dll.mui_2904864a 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d02acaa3e17e4bae_wininit.exe.mui_997435f5 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-imm32_31bf3856ad364e35_6.1.7601.17514_none_c4d0cdd7c56b493e.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_fi-fi_e80fbb8ab24365d6.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7002897809b71b0c_dnsrslvr.dll.mui_1e1a1ed1 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shsvcs.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_96641712ecf270b7.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_de-de_59f90b40a942117e_wer.dll.mui_e68ddae7 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_ko-kr_1b637ee56cb9487d_msimsg.dll.mui_72e8994f 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_c718d071d9c10a2d_auditpol.exe_83c870f4 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a6c9ede9493e8861_scfilter.sys.mui_cebab716 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c0dcaa2ad5c24a80_unlodctr.exe.mui_53acc4d0 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase-rasl2tp_31bf3856ad364e35_6.1.7601.17514_none_f802520bfe8dd487_rasl2tp.sys_d69e0fa7 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_5e6a23443d69bea1.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-kernel32.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d234a7ae309c4199.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e31d2d92828b5ec3_expand.exe.mui_3f54e013 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_31ba297055661ca3.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-courier_31bf3856ad364e35_6.1.7600.16385_none_5283fef09ca6fa1a_courer.fon_792fc669 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..ltinstall.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3ba1f5d34890f57b.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..oradapter.resources_31bf3856ad364e35_6.1.7600.16385_en-us_688bce682bc4b24c.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-searchfolder.resources_31bf3856ad364e35_6.1.7600.16385_it-it_09d8903c3785e299.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_6.1.7600.16385_none_df4bbe8e10903104_svgasys.fon_32986711 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mpr.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ba274103957aa058.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_51a9c0732ea27a7c_wudfx.mfl_ed9a43c5 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-themeservice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ec2d87cac9a713a6.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..erservice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4c87c53cabac759d.manifest 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2852 vssadmin.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2268 vssvc.exe Token: SeRestorePrivilege 2268 vssvc.exe Token: SeAuditPrivilege 2268 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2332 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 30 PID 1732 wrote to memory of 2332 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 30 PID 1732 wrote to memory of 2332 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 30 PID 1732 wrote to memory of 2332 1732 2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe 30 PID 2332 wrote to memory of 2852 2332 cmd.exe 32 PID 2332 wrote to memory of 2852 2332 cmd.exe 32 PID 2332 wrote to memory of 2852 2332 cmd.exe 32 PID 2332 wrote to memory of 2852 2332 cmd.exe 32 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-18_663069fe32ab671af55a5f79693aa937_revil_sodinokibi.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2852
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5f243f82ddc61ae7541d7b0c8b1470c65
SHA1fab595af218cb96a6d7df37fe3a88b3b82327bb0
SHA256478e2699726f8e13ba0c72a4b12701d64518d113ac41ef9cb03321bca4d48ccc
SHA5120c2331c3cdaa4c4eeaa90290382e6c5d0add05c1d0034c129005df4dd01b809f7dfb912c577d26e64b92b6d23be8a06eade2f0fa2f44deb06b373712bc596d9e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b