Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 21:39
Static task
static1
Behavioral task
behavioral1
Sample
735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe
Resource
win10v2004-20241007-en
General
-
Target
735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe
-
Size
324KB
-
MD5
20defcd42cabf5da27a21dd342e58068
-
SHA1
408cfabc99c350ad28def5475cfff5dc2de02543
-
SHA256
735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c
-
SHA512
8a6a2f462b9e5ecccae13ecf176c8d2ec93e1c535f3541aa9a39151ea7874e730bdb627b422fbe2ba1c51c98c9c5a2b35da79433fbe9105038836ca33f31814d
-
SSDEEP
6144:uhHmIZ1A3Lp5r8Xjv0PZNVhmN7r6PNkr1UT:iHdA3Lp5YzIH7mNyFqo
Malware Config
Extracted
sodinokibi
$2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu
51
woodleyacademy.org
bookspeopleplaces.com
despedidascostablanca.es
lapinvihreat.fi
drfoyle.com
carolinepenn.com
abuelos.com
groupe-frayssinet.fr
tecnojobsnet.com
deoudedorpskernnoordwijk.nl
siluet-decor.ru
smessier.com
calxplus.eu
julis-lsa.de
aminaboutique247.com
pier40forall.org
coding-machine.com
longislandelderlaw.com
expandet.dk
blogdecachorros.com
grupocarvalhoerodrigues.com.br
the-virtualizer.com
kindersitze-vergleich.de
edv-live.de
gasbarre.com
ulyssemarketing.com
thomasvicino.com
sevenadvertising.com
sporthamper.com
myhostcloud.com
iviaggisonciliegie.it
plastidip.com.ar
zewatchers.com
saxtec.com
smale-opticiens.nl
haar-spange.com
zimmerei-deboer.de
ralister.co.uk
eraorastudio.com
antiaginghealthbenefits.com
hashkasolutindo.com
spsshomeworkhelp.com
parkcf.nl
rosavalamedahr.com
worldhealthbasicinfo.com
new.devon.gov.uk
micro-automation.de
justinvieira.com
live-con-arte.de
jiloc.com
corona-handles.com
urclan.net
leeuwardenstudentcity.nl
maureenbreezedancetheater.org
mepavex.nl
shiftinspiration.com
allentownpapershow.com
skanah.com
cyntox.com
wsoil.com.sg
heliomotion.com
romeguidedvisit.com
pcprofessor.com
ccpbroadband.com
sachnendoc.com
planchaavapor.net
exenberger.at
koko-nora.dk
thee.network
gantungankunciakrilikbandung.com
bastutunnan.se
eco-southafrica.com
broseller.com
cimanchesterescorts.co.uk
theclubms.com
bigasgrup.com
theadventureedge.com
gamesboard.info
jobcenterkenya.com
kampotpepper.gives
modestmanagement.com
supportsumba.nl
craigmccabe.fun
daklesa.de
modelmaking.nl
hatech.io
noesis.tech
directwindowco.com
acomprarseguidores.com
koken-voor-baby.nl
labobit.it
whittier5k.com
tandartspraktijkheesch.nl
praxis-foerderdiagnostik.de
southeasternacademyofprosthodontics.org
clos-galant.com
upmrkt.co
helikoptervluchtnewyork.nl
mapawood.com
alten-mebel63.ru
dareckleyministries.com
dublikator.com
femxarxa.cat
architekturbuero-wagner.net
ladelirante.fr
consultaractadenacimiento.com
bayoga.co.uk
ahouseforlease.com
homecomingstudio.com
elpa.se
lusak.at
berliner-versicherungsvergleich.de
mirkoreisser.de
zervicethai.co.th
unetica.fr
glennroberts.co.nz
shonacox.com
4youbeautysalon.com
globedivers.wordpress.com
reddysbakery.com
igfap.com
nmiec.com
ikads.org
baronloan.org
leather-factory.co.jp
mountaintoptinyhomes.com
xltyu.com
boosthybrid.com.au
quickyfunds.com
tongdaifpthaiphong.net
abogadosaccidentetraficosevilla.es
abogadoengijon.es
milanonotai.it
danielblum.info
assurancesalextrespaille.fr
echtveilig.nl
mbxvii.com
euro-trend.pl
porno-gringo.com
sarbatkhalsafoundation.org
vitavia.lt
kamahouse.net
joyeriaorindia.com
liikelataamo.fi
woodworkersolution.com
izzi360.com
revezlimage.com
fiscalsort.com
dlc.berlin
bingonearme.org
troegs.com
1team.es
malychanieruchomoscipremium.com
vermoote.de
the-domain-trader.com
helenekowalsky.com
answerstest.ru
synlab.lt
logopaedie-blomberg.de
christ-michael.net
trulynolen.co.uk
bptdmaluku.com
stupbratt.no
baumkuchenexpo.jp
tinkoff-mobayl.ru
lenreactiv-shop.ru
htchorst.nl
presseclub-magdeburg.de
mountsoul.de
bauertree.com
houseofplus.com
caffeinternet.it
antenanavi.com
veybachcenter.de
galleryartfair.com
lapmangfpt.info.vn
merzi.info
berlin-bamboo-bikes.org
parks-nuernberg.de
evangelische-pfarrgemeinde-tuniberg.de
sportverein-tambach.de
schoolofpassivewealth.com
stacyloeb.com
gratispresent.se
bildungsunderlebnis.haus
funjose.org.gt
zenderthelender.com
antonmack.de
proudground.org
fannmedias.com
castillobalduz.es
lykkeliv.net
bargningharnosand.se
tomaso.gr
dubnew.com
nijaplay.com
trystana.com
pivoineetc.fr
crowcanyon.com
kadesignandbuild.co.uk
manijaipur.com
latribuessentielle.com
autodemontagenijmegen.nl
nsec.se
fitnessingbyjessica.com
kariokids.com
vickiegrayimages.com
smart-light.co.uk
bargningavesta.se
coffreo.biz
bhwlawfirm.com
iqbalscientific.com
michaelsmeriglioracing.com
sportiomsportfondsen.nl
chatizel-paysage.fr
pinkexcel.com
grelot-home.com
heidelbergartstudio.gallery
i-arslan.de
gopackapp.com
completeweddingkansas.com
norovirus-ratgeber.de
saka.gr
otto-bollmann.de
uranus.nl
vanswigchemdesign.com
lange.host
quemargrasa.net
backstreetpub.com
abogados-en-alicante.es
chandlerpd.com
thailandholic.com
leoben.at
deschl.net
corola.es
celeclub.org
vietlawconsultancy.com
4net.guru
creative-waves.co.uk
devlaur.com
petnest.ir
mardenherefordshire-pc.gov.uk
better.town
kevinjodea.com
calabasasdigest.com
ivivo.es
renergysolution.com
instatron.net
vyhino-zhulebino-24.ru
levihotelspa.fi
rehabilitationcentersinhouston.net
bigbaguettes.eu
edgewoodestates.org
jandaonline.com
brevitempore.net
bouldercafe-wuppertal.de
tinyagency.com
kissit.ca
blacksirius.de
coding-marking.com
makeflowers.ru
partnertaxi.sk
hannah-fink.de
parkstreetauto.net
amylendscrestview.com
jenniferandersonwriter.com
besttechie.com
gporf.fr
1kbk.com.ua
deprobatehelp.com
ungsvenskarna.se
bsaship.com
plantag.de
journeybacktolife.com
stoeberstuuv.de
buymedical.biz
rota-installations.co.uk
rieed.de
mastertechengineering.com
hotelzentral.at
streamerzradio1.site
ilive.lt
markelbroch.com
klusbeter.nl
bouncingbonanza.com
liliesandbeauties.org
smalltownideamill.wordpress.com
seagatesthreecharters.com
fitnessbazaar.com
memaag.com
simulatebrain.com
paradicepacks.com
hrabritelefon.hr
maxadams.london
wmiadmin.com
tarotdeseidel.com
apprendrelaudit.com
ceres.org.au
stefanpasch.me
sinal.org
ncs-graphic-studio.com
frontierweldingllc.com
artallnightdc.com
havecamerawilltravel2017.wordpress.com
pocket-opera.de
personalenhancementcenter.com
homng.net
bxdf.info
i-trust.dk
adoptioperheet.fi
lbcframingelectrical.com
henricekupper.com
neuschelectrical.co.za
kalkulator-oszczednosci.pl
team-montage.dk
kmbshipping.co.uk
35-40konkatsu.net
osterberg.fi
jusibe.com
kojima-shihou.com
rimborsobancario.net
polychromelabs.com
qualitus.com
schoellhammer.com
quizzingbee.com
nhadatcanho247.com
psnacademy.in
oneheartwarriors.at
montrium.com
id-et-d.fr
jolly-events.com
foretprivee.ca
ogdenvision.com
thenewrejuveme.com
eadsmurraypugh.com
judithjansen.com
schlafsack-test.net
gadgetedges.com
remcakram.com
paymybill.guru
bestbet.com
desert-trails.com
wychowanieprzedszkolne.pl
mrsfieldskc.com
international-sound-awards.com
xoabigail.com
coastalbridgeadvisors.com
blewback.com
drinkseed.com
id-vet.com
jasonbaileystudio.com
marchand-sloboda.com
aniblinova.wordpress.com
financescorecard.com
dubscollective.com
ditog.fr
siliconbeach-realestate.com
filmstreamingvfcomplet.be
cheminpsy.fr
turkcaparbariatrics.com
perbudget.com
mylovelybluesky.com
ausbeverage.com.au
rollingrockcolumbia.com
familypark40.com
adultgamezone.com
chavesdoareeiro.com
stopilhan.com
compliancesolutionsstrategies.com
nicoleaeschbachorg.wordpress.com
advizewealth.com
pridoxmaterieel.nl
vihannesporssi.fi
piajeppesen.dk
sagadc.com
atozdistribution.co.uk
kostenlose-webcams.com
atalent.fi
pmc-services.de
paulisdogshop.de
vdberg-autoimport.nl
gymnasedumanagement.com
teresianmedia.org
n1-headache.com
milestoneshows.com
blossombeyond50.com
socialonemedia.com
comarenterprises.com
dr-seleznev.com
d1franchise.com
zflas.com
all-turtles.com
caribdoctor.org
naturalrapids.com
galserwis.pl
run4study.com
sla-paris.com
hihaho.com
stingraybeach.com
hokagestore.com
ecopro-kanto.com
precisionbevel.com
bridgeloanslenders.com
agence-referencement-naturel-geneve.net
unim.su
mdacares.com
tennisclubetten.nl
321play.com.hk
charlottepoudroux-photographie.fr
pixelarttees.com
liveottelut.com
zweerscreatives.nl
buroludo.nl
dutchcoder.nl
brawnmediany.com
d2marketing.co.uk
kosterra.com
marathonerpaolo.com
collaborativeclassroom.org
kenhnoithatgo.com
cnoia.org
stoneys.ch
intecwi.com
toponlinecasinosuk.co.uk
mediaacademy-iraq.org
web.ion.ag
ouryoungminds.wordpress.com
oncarrot.com
imaginado.de
theapifactory.com
ihr-news.jp
love30-chanko.com
beyondmarcomdotcom.wordpress.com
sloverse.com
alvinschwartz.wordpress.com
yourobgyn.net
smejump.co.th
ostheimer.at
hmsdanmark.dk
lucidinvestbank.com
tulsawaterheaterinstallation.com
littlebird.salon
global-kids.info
drugdevice.org
sahalstore.com
wurmpower.at
solinegraphic.com
crosspointefellowship.church
architecturalfiberglass.org
pv-design.de
autopfand24.de
marketingsulweb.com
highimpactoutdoors.net
darnallwellbeing.org.uk
advokathuset.dk
gemeentehetkompas.nl
ora-it.de
meusharklinithome.wordpress.com
hairstylesnow.site
waywithwords.net
mindpackstudios.com
mdk-mediadesign.de
raschlosser.de
theshungiteexperience.com.au
spectrmash.ru
yousay.site
handi-jack-llc.com
spargel-kochen.de
polzine.net
jerling.de
vannesteconstruct.be
lachofikschiet.nl
div-vertriebsforschung.de
you-bysia.com.au
operaslovakia.sk
roadwarrior.app
lapinlviasennus.fi
rksbusiness.com
hebkft.hu
copystar.co.uk
irishmachineryauctions.com
hkr-reise.de
healthyyworkout.com
ilcdover.com
refluxreducer.com
daniel-akermann-architektur-und-planung.ch
marcuswhitten.site
solhaug.tk
jadwalbolanet.info
gasolspecialisten.se
diversiapsicologia.es
norpol-yachting.com
interactcenter.org
celularity.com
danskretursystem.dk
navyfederalautooverseas.com
binder-buerotechnik.at
bodyforwife.com
abogadosadomicilio.es
tampaallen.com
hoteledenpadova.it
cactusthebrand.com
ai-spt.jp
hellohope.com
dekkinngay.com
gw2guilds.org
qlog.de
joseconstela.com
rushhourappliances.com
steampluscarpetandfloors.com
baylegacy.com
sipstroysochi.ru
xtptrack.com
csgospeltips.se
strandcampingdoonbeg.com
dinslips.se
kikedeoliveira.com
conexa4papers.trade
seminoc.com
winrace.no
argenblogs.com.ar
tetinfo.in
hhcourier.com
uimaan.fi
aurum-juweliere.de
connectedace.com
sojamindbody.com
tastewilliamsburg.com
importardechina.info
myhealth.net.au
milsing.hr
newstap.com.ng
nurturingwisdom.com
aunexis.ch
x-ray.ca
itelagen.com
bogdanpeptine.ro
mooglee.com
naturavetal.hr
aco-media.nl
micahkoleoso.de
nosuchthingasgovernment.com
icpcnj.org
drnice.de
creamery201.com
cursoporcelanatoliquido.online
abl1.net
sexandfessenjoon.wordpress.com
elimchan.com
onlybacklink.com
fayrecreations.com
ftf.or.at
sotsioloogia.ee
walkingdeadnj.com
admos-gleitlager.de
bundabergeyeclinic.com.au
oceanastudios.com
nvwoodwerks.com
tips.technology
cortec-neuro.com
brandl-blumen.de
slimidealherbal.com
geekwork.pl
geisterradler.de
alhashem.net
iyengaryogacharlotte.com
goodgirlrecovery.com
smhydro.com.pl
em-gmbh.ch
miraclediet.fun
transliminaltribe.wordpress.com
summitmarketingstrategies.com
mrsplans.net
forestlakeuca.org.au
myteamgenius.com
kuntokeskusrok.fi
faroairporttransfers.net
karacaoglu.nl
cirugiauretra.es
mrtour.site
fairfriends18.de
nancy-informatique.fr
boompinoy.com
beautychance.se
kisplanning.com.au
igrealestate.com
imperfectstore.com
biapi-coaching.fr
ino-professional.ru
testzandbakmetmening.online
work2live.de
mezhdu-delom.ru
art2gointerieurprojecten.nl
bristolaeroclub.co.uk
insp.bi
huissier-creteil.com
baptisttabernacle.com
manutouchmassage.com
jeanlouissibomana.com
thedad.com
naturstein-hotte.de
stallbyggen.se
haremnick.com
pasivect.co.uk
sportsmassoren.com
nativeformulas.com
mousepad-direkt.de
dushka.ua
mooshine.com
gastsicht.de
rumahminangberdaya.com
mooreslawngarden.com
greenpark.ch
craftleathermnl.com
slashdb.com
tonelektro.nl
mmgdouai.fr
delawarecorporatelaw.com
lorenacarnero.com
smartypractice.com
craigvalentineacademy.com
bradynursery.com
dr-tremel-rednitzhembach.de
zimmerei-fl.de
jobmap.at
carlosja.com
herbayupro.com
musictreehouse.net
tuuliautio.fi
maasreusel.nl
resortmtn.com
thefixhut.com
sofavietxinh.com
smithmediastrategies.com
muamuadolls.com
dontpassthepepper.com
DupontSellsHomes.com
schmalhorst.de
atmos-show.com
outcomeisincome.com
truenyc.co
erstatningsadvokaterne.dk
ctrler.cn
pointos.com
y-archive.com
foryourhealth.live
nandistribution.nl
purposeadvisorsolutions.com
ncuccr.org
girlillamarketing.com
bockamp.com
hypozentrum.com
classycurtainsltd.co.uk
rerekatu.com
serce.info.pl
trackyourconstruction.com
colorofhorses.com
layrshift.eu
poultrypartners.nl
richard-felix.co.uk
promalaga.es
krcove-zily.eu
tigsltd.com
ilso.net
bordercollie-nim.nl
ncid.bc.ca
croftprecision.co.uk
idemblogs.com
pasvenska.se
brigitte-erler.com
cleliaekiko.online
iwelt.de
slupetzky.at
ligiercenter-sachsen.de
fotoscondron.com
zso-mannheim.de
babcockchurch.org
maryloutaylor.com
kao.at
hugoversichert.de
live-your-life.jp
withahmed.com
alsace-first.com
corendonhotels.com
ruralarcoiris.com
fotoideaymedia.es
commercialboatbuilding.com
luckypatcher-apkz.com
punchbaby.com
biortaggivaldelsa.com
finde-deine-marke.de
boulderwelt-muenchen-west.de
jvanvlietdichter.nl
lecantou-coworking.com
shadebarandgrillorlando.com
www1.proresult.no
faizanullah.com
psc.de
simpliza.com
innote.fi
spacecitysisters.org
harveybp.com
yassir.pro
pickanose.com
mylolis.com
sweering.fr
verytycs.com
almosthomedogrescue.dog
microcirc.net
blumenhof-wegleitner.at
mediaplayertest.net
evologic-technologies.com
stemenstilte.nl
123vrachi.ru
lmtprovisions.com
jameskibbie.com
wari.com.pe
opatrovanie-ako.sk
verifort-capital.de
webcodingstudio.com
hotelsolbh.com.br
tomoiyuma.com
cranleighscoutgroup.org
satyayoga.de
prochain-voyage.net
people-biz.com
lebellevue.fr
morawe-krueger.de
projetlyonturin.fr
dw-css.de
cwsitservices.co.uk
cafemattmeera.com
nakupunafoundation.org
sobreholanda.com
blgr.be
waveneyrivercentre.co.uk
senson.fi
sabel-bf.com
retroearthstudio.com
nataschawessels.com
rostoncastings.co.uk
teczowadolina.bytom.pl
birnam-wood.com
seproc.hn
huehnerauge-entfernen.de
phantastyk.com
fatfreezingmachines.com
notmissingout.com
carriagehousesalonvt.com
conasmanagement.de
datacenters-in-europe.com
wolf-glas-und-kunst.de
chaotrang.com
lillegrandpalais.com
asteriag.com
falcou.fr
pay4essays.net
odiclinic.org
shiresresidential.com
simoneblum.de
gaiam.nl
kamienny-dywan24.pl
pcp-nc.com
mytechnoway.com
degroenetunnel.com
newyou.at
lichencafe.com
camsadviser.com
burkert-ideenreich.de
greenfieldoptimaldentalcare.com
centrospgolega.com
rafaut.com
farhaani.com
tradiematepro.com.au
bodyfulls.com
softsproductkey.com
forskolorna.org
argos.wityu.fund
cityorchardhtx.com
xn--singlebrsen-vergleich-nec.com
symphonyenvironmental.com
smogathon.com
tenacitytenfold.com
fransespiegels.nl
tux-espacios.com
kafu.ch
ivfminiua.com
marietteaernoudts.nl
garage-lecompte-rouen.fr
jacquin-maquettes.com
anteniti.com
noixdecocom.fr
arteservicefabbro.com
c-a.co.in
knowledgemuseumbd.com
hexcreatives.co
testcoreprohealthuk.com
wellplast.se
humanityplus.org
extensionmaison.info
dr-pipi.de
real-estate-experts.com
dezatec.es
airconditioning-waalwijk.nl
luxurytv.jp
mbfagency.com
moveonnews.com
associationanalytics.com
notsilentmd.org
kojinsaisei.info
catholicmusicfest.com
torgbodenbollnas.se
nacktfalter.de
latestmodsapks.com
artotelamsterdam.com
aprepol.com
spinheal.ru
patrickfoundation.net
vibethink.net
vesinhnha.com.vn
chefdays.de
strategicstatements.com
carrybrands.nl
verbisonline.com
autofolierung-lu.de
geoffreymeuli.com
narcert.com
pubweb.carnet.hr
boldcitydowntown.com
katiekerr.co.uk
johnsonfamilyfarmblog.wordpress.com
maratonaclubedeportugal.com
schutting-info.nl
first-2-aid-u.com
happyeasterimages.org
fizzl.ru
ki-lowroermond.nl
deltacleta.cat
mank.de
miriamgrimm.de
humancondition.com
kath-kirche-gera.de
gonzalezfornes.es
jsfg.com
readberserk.com
embracinghiscall.com
ravensnesthomegoods.com
fitovitaforum.com
oldschoolfun.net
dutchbrewingcoffee.com
travelffeine.com
profectis.de
aarvorg.com
hardinggroup.com
pomodori-pizzeria.de
peterstrobos.com
homesdollar.com
zieglerbrothers.de
space.ua
suncrestcabinets.ca
sandd.nl
autodujos.lt
videomarketing.pro
rozemondcoaching.nl
destinationclients.fr
wacochamber.com
xn--fn-kka.no
botanicinnovations.com
trapiantofue.it
spd-ehningen.de
actecfoundation.org
loprus.pl
sauschneider.info
naswrrg.org
panelsandwichmadrid.es
devstyle.org
greenko.pl
makeitcount.at
katketytaanet.fi
bierensgebakkramen.nl
devok.info
imadarchid.com
aselbermachen.com
aakritpatel.com
philippedebroca.com
takeflat.com
rhinosfootballacademy.com
lefumetdesdombes.com
employeesurveys.com
allure-cosmetics.at
cuppacap.com
caribbeansunpoker.com
pierrehale.com
seevilla-dr-sturm.at
lloydconstruction.com
zzyjtsgls.com
accountancywijchen.nl
stoeferlehalle.de
epwritescom.wordpress.com
midmohandyman.com
kaotikkustomz.com
crowd-patch.co.uk
urist-bogatyr.ru
boisehosting.net
macabaneaupaysflechois.com
rebeccarisher.com
101gowrie.com
syndikat-asphaltfieber.de
igorbarbosa.com
campusoutreach.org
thomas-hospital.de
darrenkeslerministries.com
surespark.org.uk
facettenreich27.de
thedresserie.com
plotlinecreative.com
olejack.ru
alfa-stroy72.com
jakekozmor.com
portoesdofarrobo.com
theduke.de
basisschooldezonnewijzer.nl
huesges-gruppe.de
andersongilmour.co.uk
nuzech.com
milltimber.aberdeen.sch.uk
praxis-management-plus.de
mirjamholleman.nl
ohidesign.com
austinlchurch.com
bafuncs.org
vloeren-nu.nl
spylista.com
comparatif-lave-linge.fr
fibrofolliculoma.info
tanzschule-kieber.de
durganews.com
ceid.info.tr
maineemploymentlawyerblog.com
extraordinaryoutdoors.com
bigler-hrconsulting.ch
vorotauu.ru
schraven.de
kaminscy.com
mymoneyforex.com
tsklogistik.eu
freie-baugutachterpraxis.de
denifl-consulting.at
xn--vrftet-pua.biz
dirittosanitario.biz
behavioralmedicinespecialists.com
smokeysstoves.com
asiluxury.com
bee4win.com
thaysa.com
digi-talents.com
triactis.com
effortlesspromo.com
blood-sports.net
tanciu.com
candyhouseusa.com
kidbucketlist.com.au
crediacces.com
twohourswithlena.wordpress.com
body-guards.it
ymca-cw.org.uk
gmto.fr
linnankellari.fi
systemate.dk
2ekeus.nl
promesapuertorico.com
sanyue119.com
mir-na-iznanku.com
lynsayshepherd.co.uk
controldekk.com
braffinjurylawfirm.com
lightair.com
selfoutlet.com
faronics.com
mrxermon.de
beaconhealthsystem.org
servicegsm.net
courteney-cox.net
12starhd.online
hushavefritid.dk
danholzmann.com
ateliergamila.com
dsl-ip.de
polymedia.dk
waynela.com
fax-payday-loans.com
makeurvoiceheard.com
tanzprojekt.com
launchhubl.com
myzk.site
stormwall.se
physiofischer.de
restaurantesszimmer.de
pmcimpact.com
hiddencitysecrets.com.au
whyinterestingly.ru
platformier.com
webmaster-peloton.com
talentwunder.com
themadbotter.com
radaradvies.nl
saarland-thermen-resort.com
wasmachtmeinfonds.at
xlarge.at
xn--thucmctc-13a1357egba.com
waermetauscher-berechnen.de
commonground-stories.com
appsformacpc.com
educar.org
augenta.com
vox-surveys.com
asgestion.com
iyahayki.nl
shhealthlaw.com
dpo-as-a-service.com
wraithco.com
minipara.com
bowengroup.com.au
ussmontanacommittee.us
insidegarage.pl
monark.com
cursosgratuitosnainternet.com
apolomarcas.com
lionware.de
wien-mitte.co.at
artige.com
oneplusresource.org
ra-staudte.de
freie-gewerkschaften.de
slwgs.org
onlyresultsmarketing.com
filmvideoweb.com
tophumanservicescourses.com
manifestinglab.com
entopic.com
chrissieperry.com
associacioesportivapolitg.cat
offroadbeasts.com
ampisolabergeggi.it
transportesycementoshidalgo.es
agence-chocolat-noir.com
skiltogprint.no
balticdermatology.lt
highlinesouthasc.com
fensterbau-ziegler.de
no-plans.com
lukeshepley.wordpress.com
toreria.es
klimt2012.info
pawsuppetlovers.com
solerluethi-allart.ch
todocaracoles.com
oslomf.no
upplandsspar.se
modamilyon.com
citymax-cr.com
sairaku.net
officehymy.com
scenepublique.net
thewellnessmimi.com
parebrise-tla.fr
madinblack.com
digivod.de
webhostingsrbija.rs
pelorus.group
podsosnami.ru
ianaswanson.com
bricotienda.com
edelman.jp
bouquet-de-roses.com
stemplusacademy.com
jyzdesign.com
bunburyfreightservices.com.au
puertamatic.es
vetapharma.fr
amerikansktgodis.se
c2e-poitiers.com
vitalyscenter.es
delchacay.com.ar
lescomtesdemean.be
simpkinsedwards.co.uk
victoriousfestival.co.uk
friendsandbrgrs.com
tstaffing.nl
westdeptfordbuyrite.com
americafirstcommittee.org
triggi.de
deepsouthclothingcompany.com
executiveairllc.com
bloggyboulga.net
qualitaetstag.de
visiativ-industry.fr
ecpmedia.vn
eaglemeetstiger.de
anybookreader.de
psa-sec.de
kingfamily.construction
eglectonk.online
iphoneszervizbudapest.hu
plv.media
baustb.de
sw1m.ru
blog.solutionsarchitect.guru
zonamovie21.net
ziegler-praezisionsteile.de
stampagrafica.es
urmasiimariiuniri.ro
parking.netgateway.eu
samnewbyjax.com
vibehouse.rw
nachhilfe-unterricht.com
mikeramirezcpa.com
xn--fnsterputssollentuna-39b.se
villa-marrakesch.de
starsarecircular.org
allfortheloveofyou.com
evergreen-fishing.com
mediaclan.info
kaliber.co.jp
esope-formation.fr
figura.team
kunze-immobilien.de
insigniapmg.com
songunceliptv.com
iwr.nl
roygolden.com
teknoz.net
penco.ie
heurigen-bauer.at
walter-lemm.de
juneauopioidworkgroup.org
ecoledansemulhouse.fr
analiticapublica.es
higadograsoweb.com
mercantedifiori.com
centromarysalud.com
8449nohate.org
cerebralforce.net
simplyblessedbykeepingitreal.com
charlesreger.com
oemands.dk
licor43.de
tandartspraktijkhartjegroningen.nl
dnepr-beskid.com.ua
lubetkinmediacompanies.com
mariposapropaneaz.com
shsthepapercut.com
bimnapratica.com
hvccfloorcare.com
groupe-cets.com
enovos.de
theletter.company
sanaia.com
abitur-undwieweiter.de
centuryrs.com
vancouver-print.ca
slimani.net
denovofoodsgroup.com
coursio.com
krlosdavid.com
flexicloud.hk
pogypneu.sk
danubecloud.com
ftlc.es
cite4me.org
lascuola.nl
anthonystreetrimming.com
otsu-bon.com
herbstfeststaefa.ch
nestor-swiss.ch
ontrailsandboulevards.com
body-armour.online
yamalevents.com
rocketccw.com
jbbjw.com
ledmes.ru
fundaciongregal.org
limassoldriving.com
allamatberedare.se
deko4you.at
securityfmm.com
edrcreditservices.nl
pferdebiester.de
pt-arnold.de
campus2day.de
nokesvilledentistry.com
alysonhoward.com
balticdentists.com
bbsmobler.se
ausair.com.au
dramagickcom.wordpress.com
cuspdental.com
levdittliv.se
seitzdruck.com
ventti.com.ar
xn--logopdie-leverkusen-kwb.de
socstrp.org
irinaverwer.com
xn--rumung-bua.online
werkkring.nl
christinarebuffetcourses.com
noskierrenteria.com
aodaichandung.com
aglend.com.au
leda-ukraine.com.ua
365questions.org
jorgobe.at
easytrans.com.au
kirkepartner.dk
corelifenutrition.com
finediningweek.pl
firstpaymentservices.com
kedak.de
hairnetty.wordpress.com
harpershologram.wordpress.com
sterlingessay.com
-
net
true
-
pid
$2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu
-
prc
mysql
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
51
-
svc
backup
sql
svc$
mepocs
vss
memtas
sophos
veeam
Extracted
C:\Users\hoc5p0yrb-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/99AC7F55857D1B6A
http://decryptor.cc/99AC7F55857D1B6A
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\S: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\X: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\Y: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\A: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\B: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\H: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\I: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\V: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\T: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\U: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\W: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\E: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\G: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\N: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\R: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\P: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\Q: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\Z: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\D: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\J: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\K: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\L: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\O: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened (read-only) \??\F: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\56u5ii.bmp" 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe -
Drops file in Program Files directory 33 IoCs
description ioc Process File opened for modification \??\c:\program files\SetSkip.wmv 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\InvokeRemove.search-ms 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\MeasureProtect.mp3 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\OutWait.pptm 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\CompressUnprotect.html 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\SaveSwitch.gif 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\SkipSend.iso 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\UnlockLock.vsd 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\WatchStep.avi 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\RegisterStart.i64 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\ResolveSave.scf 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\SelectMeasure.wm 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\CopyResolve.zip 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File created \??\c:\program files (x86)\hoc5p0yrb-readme.txt 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\AssertUnblock.ini 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\AssertUnprotect.midi 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\EnterUnregister.xml 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\SuspendInitialize.wvx 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\UninstallGet.dib 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File created \??\c:\program files\hoc5p0yrb-readme.txt 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\ClearConfirm.3gp2 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\SyncJoin.dwfx 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\CopyConvertTo.M2TS 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\UninstallExpand.ttc 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\hoc5p0yrb-readme.txt 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\FormatRemove.dib 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\MergeBackup.7z 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\StartConvertTo.jpe 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\hoc5p0yrb-readme.txt 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\hoc5p0yrb-readme.txt 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\CloseCheckpoint.vbe 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\EnterProtect.rle 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe File opened for modification \??\c:\program files\FindSet.m4a 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1600 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe 2940 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1600 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe Token: SeDebugPrivilege 2940 powershell.exe Token: SeBackupPrivilege 888 vssvc.exe Token: SeRestorePrivilege 888 vssvc.exe Token: SeAuditPrivilege 888 vssvc.exe Token: SeTakeOwnershipPrivilege 1600 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2940 1600 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe 30 PID 1600 wrote to memory of 2940 1600 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe 30 PID 1600 wrote to memory of 2940 1600 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe 30 PID 1600 wrote to memory of 2940 1600 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe 30 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe"C:\Users\Admin\AppData\Local\Temp\735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3008
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
6KB
MD5f0b831ac96514a4f2bcbf0a9f01af675
SHA1e7a630da9ee1d8963435208f534bf52c93f86601
SHA256962a8428138b6056cfa56fd917287332a95495c8dabfd048c475a582b1f09c19
SHA5124f37c052db6f67781f6804512331fd3c728c32f258f94c82f321ee591c6c631d74b36291b9178ea7fad0958ab7d581e68fd942b8c7936ee61f4a7c433082c62f
-
Filesize
194KB
MD5ea33b6d8114f9afda771d14f7e83b842
SHA1386b8a909eee9310c2d0508c8c27aa7f4a14a1d9
SHA256d5a85e43659ee0e018a6e264485c31d6ad838089ad598093f1a146528a1d98bf
SHA5126a209aa565e1ac779e86e4ede21288207a0d2c471ea8d41c3888e42ed34611f35dd35622b7a58fbd0ced3eb89ee42da2e627eb9d66f57c04e534e930f4f13e8b