Analysis
-
max time kernel
134s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 18:11
Static task
static1
Behavioral task
behavioral1
Sample
b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe
Resource
win10v2004-20241007-en
General
-
Target
b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe
-
Size
122KB
-
MD5
f2ad75f1f945cf18e2f903fa645d62b0
-
SHA1
c99f6b459e4bfe77a0c37def0d6bc933fc4a1447
-
SHA256
b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205
-
SHA512
0416aed927e99600059548d5e7b9b2f02cb1ec69cf692833da8851f8f03e4ef6fa06772b0798d483461ea8c05a5adeae355fc624b17cf74041b9e700a88eb6be
-
SSDEEP
1536:RxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6Udoah5Dta66GDReUUz:RMhQNDEtb3AioaheW8NR
Malware Config
Extracted
sodinokibi
$2a$12$wsDKYj/FlqR3lZ6H4K2Qmenp6QLHkWTltAhlc0fUr6S4AfxkJrEhy
7029
cuspdental.com
humanityplus.org
sportsmassoren.com
adoptioperheet.fi
kafu.ch
innote.fi
polychromelabs.com
milanonotai.it
logopaedie-blomberg.de
theletter.company
conexa4papers.trade
tampaallen.com
patrickfoundation.net
visiativ-industry.fr
idemblogs.com
copystar.co.uk
paulisdogshop.de
atozdistribution.co.uk
sinal.org
purposeadvisorsolutions.com
crediacces.com
girlillamarketing.com
lachofikschiet.nl
nurturingwisdom.com
smessier.com
team-montage.dk
lbcframingelectrical.com
artotelamsterdam.com
maineemploymentlawyerblog.com
vyhino-zhulebino-24.ru
jameskibbie.com
associacioesportivapolitg.cat
eglectonk.online
diversiapsicologia.es
lefumetdesdombes.com
atmos-show.com
international-sound-awards.com
sachnendoc.com
iyengaryogacharlotte.com
people-biz.com
brigitte-erler.com
denovofoodsgroup.com
maureenbreezedancetheater.org
biortaggivaldelsa.com
ikads.org
qualitus.com
whyinterestingly.ru
kevinjodea.com
enovos.de
DupontSellsHomes.com
kirkepartner.dk
despedidascostablanca.es
lucidinvestbank.com
steampluscarpetandfloors.com
katiekerr.co.uk
plv.media
bigbaguettes.eu
bauertree.com
stefanpasch.me
mountsoul.de
carriagehousesalonvt.com
mooreslawngarden.com
compliancesolutionsstrategies.com
theshungiteexperience.com.au
makeitcount.at
shadebarandgrillorlando.com
x-ray.ca
marietteaernoudts.nl
romeguidedvisit.com
extensionmaison.info
veybachcenter.de
commercialboatbuilding.com
aarvorg.com
zonamovie21.net
havecamerawilltravel2017.wordpress.com
pridoxmaterieel.nl
csgospeltips.se
bierensgebakkramen.nl
mbfagency.com
xlarge.at
blossombeyond50.com
spd-ehningen.de
ilive.lt
yousay.site
buroludo.nl
jyzdesign.com
insigniapmg.com
vancouver-print.ca
gaiam.nl
pasvenska.se
moveonnews.com
nestor-swiss.ch
noskierrenteria.com
sairaku.net
rostoncastings.co.uk
winrace.no
kedak.de
fax-payday-loans.com
nacktfalter.de
uranus.nl
aniblinova.wordpress.com
pcp-nc.com
1team.es
fairfriends18.de
evergreen-fishing.com
tarotdeseidel.com
justinvieira.com
rehabilitationcentersinhouston.net
spylista.com
vannesteconstruct.be
candyhouseusa.com
live-con-arte.de
aodaichandung.com
freie-gewerkschaften.de
kosterra.com
jusibe.com
zimmerei-deboer.de
cranleighscoutgroup.org
cwsitservices.co.uk
assurancesalextrespaille.fr
ventti.com.ar
slupetzky.at
outcomeisincome.com
kadesignandbuild.co.uk
berlin-bamboo-bikes.org
polymedia.dk
plotlinecreative.com
kisplanning.com.au
nosuchthingasgovernment.com
partnertaxi.sk
marcuswhitten.site
kariokids.com
burkert-ideenreich.de
c2e-poitiers.com
smale-opticiens.nl
answerstest.ru
the-virtualizer.com
blog.solutionsarchitect.guru
philippedebroca.com
backstreetpub.com
fotoscondron.com
zenderthelender.com
lecantou-coworking.com
hannah-fink.de
interactcenter.org
dontpassthepepper.com
thenewrejuveme.com
kaminscy.com
nuzech.com
sexandfessenjoon.wordpress.com
pivoineetc.fr
transliminaltribe.wordpress.com
petnest.ir
sipstroysochi.ru
alten-mebel63.ru
navyfederalautooverseas.com
kao.at
run4study.com
chefdays.de
schmalhorst.de
datacenters-in-europe.com
hushavefritid.dk
trapiantofue.it
meusharklinithome.wordpress.com
gmto.fr
effortlesspromo.com
pier40forall.org
plastidip.com.ar
airconditioning-waalwijk.nl
corelifenutrition.com
euro-trend.pl
gadgetedges.com
thomasvicino.com
uimaan.fi
vickiegrayimages.com
architekturbuero-wagner.net
filmstreamingvfcomplet.be
bbsmobler.se
ianaswanson.com
siluet-decor.ru
admos-gleitlager.de
limassoldriving.com
kingfamily.construction
dw-css.de
themadbotter.com
aselbermachen.com
ecpmedia.vn
xn--thucmctc-13a1357egba.com
seevilla-dr-sturm.at
bigasgrup.com
kikedeoliveira.com
bsaship.com
mooshine.com
foryourhealth.live
pomodori-pizzeria.de
manijaipur.com
southeasternacademyofprosthodontics.org
norovirus-ratgeber.de
dnepr-beskid.com.ua
triggi.de
ampisolabergeggi.it
upmrkt.co
sobreholanda.com
kampotpepper.gives
kaotikkustomz.com
dezatec.es
argos.wityu.fund
stemplusacademy.com
embracinghiscall.com
vibethink.net
mytechnoway.com
cityorchardhtx.com
anteniti.com
webcodingstudio.com
galserwis.pl
schutting-info.nl
poultrypartners.nl
executiveairllc.com
luckypatcher-apkz.com
kenhnoithatgo.com
schoellhammer.com
bricotienda.com
chandlerpd.com
vanswigchemdesign.com
theclubms.com
whittier5k.com
pointos.com
oldschoolfun.net
figura.team
tuuliautio.fi
101gowrie.com
nicoleaeschbachorg.wordpress.com
coastalbridgeadvisors.com
julis-lsa.de
brawnmediany.com
sauschneider.info
jolly-events.com
kojinsaisei.info
kostenlose-webcams.com
zzyjtsgls.com
body-guards.it
transportesycementoshidalgo.es
ussmontanacommittee.us
noesis.tech
alhashem.net
goodgirlrecovery.com
rollingrockcolumbia.com
comarenterprises.com
babcockchurch.org
myhostcloud.com
stingraybeach.com
pelorus.group
marchand-sloboda.com
nhadatcanho247.com
grelot-home.com
jenniferandersonwriter.com
cheminpsy.fr
bowengroup.com.au
bafuncs.org
creamery201.com
profectis.de
urmasiimariiuniri.ro
tsklogistik.eu
blacksirius.de
paymybill.guru
tennisclubetten.nl
porno-gringo.com
andersongilmour.co.uk
celularity.com
charlesreger.com
quickyfunds.com
radaradvies.nl
mrtour.site
buymedical.biz
iqbalscientific.com
remcakram.com
wsoil.com.sg
parking.netgateway.eu
colorofhorses.com
smartypractice.com
rhinosfootballacademy.com
gasbarre.com
videomarketing.pro
bookspeopleplaces.com
stupbratt.no
caffeinternet.it
miraclediet.fun
antenanavi.com
smalltownideamill.wordpress.com
stampagrafica.es
bordercollie-nim.nl
aakritpatel.com
liikelataamo.fi
lascuola.nl
edv-live.de
campus2day.de
testzandbakmetmening.online
trystana.com
alysonhoward.com
handi-jack-llc.com
vetapharma.fr
helenekowalsky.com
pay4essays.net
vietlawconsultancy.com
christ-michael.net
ulyssemarketing.com
dr-seleznev.com
stormwall.se
abogadosadomicilio.es
liveottelut.com
teknoz.net
xn--singlebrsen-vergleich-nec.com
botanicinnovations.com
abogadoengijon.es
leoben.at
brandl-blumen.de
naturalrapids.com
xltyu.com
darrenkeslerministries.com
acomprarseguidores.com
cirugiauretra.es
thee.network
smhydro.com.pl
art2gointerieurprojecten.nl
jbbjw.com
ecopro-kanto.com
berliner-versicherungsvergleich.de
icpcnj.org
plantag.de
bimnapratica.com
space.ua
otto-bollmann.de
crowcanyon.com
bockamp.com
new.devon.gov.uk
instatron.net
triactis.com
smogathon.com
roygolden.com
mymoneyforex.com
heurigen-bauer.at
cursosgratuitosnainternet.com
stoneys.ch
simoneblum.de
sevenadvertising.com
first-2-aid-u.com
igorbarbosa.com
deltacleta.cat
delawarecorporatelaw.com
fitnessingbyjessica.com
boldcitydowntown.com
fitnessbazaar.com
greenko.pl
charlottepoudroux-photographie.fr
highlinesouthasc.com
mirjamholleman.nl
podsosnami.ru
mountaintoptinyhomes.com
onlybacklink.com
galleryartfair.com
crosspointefellowship.church
thefixhut.com
verytycs.com
dr-pipi.de
tastewilliamsburg.com
oslomf.no
id-et-d.fr
global-kids.info
mapawood.com
supportsumba.nl
noixdecocom.fr
elpa.se
unim.su
xtptrack.com
johnsonfamilyfarmblog.wordpress.com
makeflowers.ru
iviaggisonciliegie.it
controldekk.com
quizzingbee.com
gasolspecialisten.se
evangelische-pfarrgemeinde-tuniberg.de
longislandelderlaw.com
braffinjurylawfirm.com
maasreusel.nl
twohourswithlena.wordpress.com
filmvideoweb.com
operaslovakia.sk
fransespiegels.nl
cafemattmeera.com
houseofplus.com
echtveilig.nl
behavioralmedicinespecialists.com
freie-baugutachterpraxis.de
schoolofpassivewealth.com
i-arslan.de
anybookreader.de
irishmachineryauctions.com
darnallwellbeing.org.uk
markelbroch.com
mariposapropaneaz.com
syndikat-asphaltfieber.de
drnice.de
micro-automation.de
mepavex.nl
myhealth.net.au
blumenhof-wegleitner.at
hrabritelefon.hr
kidbucketlist.com.au
juneauopioidworkgroup.org
kojima-shihou.com
d1franchise.com
fundaciongregal.org
mooglee.com
narcert.com
hairnetty.wordpress.com
gamesboard.info
fitovitaforum.com
newyou.at
beyondmarcomdotcom.wordpress.com
onlyresultsmarketing.com
roadwarrior.app
facettenreich27.de
teresianmedia.org
makeurvoiceheard.com
hokagestore.com
ziegler-praezisionsteile.de
wasmachtmeinfonds.at
drfoyle.com
rozemondcoaching.nl
seminoc.com
caribbeansunpoker.com
gymnasedumanagement.com
autopfand24.de
allamatberedare.se
sotsioloogia.ee
epwritescom.wordpress.com
refluxreducer.com
asiluxury.com
associationanalytics.com
phantastyk.com
anthonystreetrimming.com
spinheal.ru
autodemontagenijmegen.nl
4net.guru
advizewealth.com
planchaavapor.net
hotelzentral.at
oemands.dk
mediaclan.info
faroairporttransfers.net
kaliber.co.jp
all-turtles.com
mylolis.com
mylovelybluesky.com
better.town
leda-ukraine.com.ua
psnacademy.in
gporf.fr
thomas-hospital.de
tomaso.gr
danskretursystem.dk
crowd-patch.co.uk
importardechina.info
victoriousfestival.co.uk
ora-it.de
evologic-technologies.com
aminaboutique247.com
durganews.com
huissier-creteil.com
tinkoff-mobayl.ru
memaag.com
hugoversichert.de
solinegraphic.com
geekwork.pl
teczowadolina.bytom.pl
mdk-mediadesign.de
resortmtn.com
cyntox.com
iwelt.de
you-bysia.com.au
pickanose.com
ahouseforlease.com
bouncingbonanza.com
rieed.de
prochain-voyage.net
artige.com
kamienny-dywan24.pl
ledmes.ru
devstyle.org
camsadviser.com
4youbeautysalon.com
xn--logopdie-leverkusen-kwb.de
neuschelectrical.co.za
thaysa.com
insidegarage.pl
lorenacarnero.com
rksbusiness.com
lykkeliv.net
ausair.com.au
knowledgemuseumbd.com
hoteledenpadova.it
milestoneshows.com
corola.es
precisionbevel.com
imperfectstore.com
renergysolution.com
parebrise-tla.fr
simulatebrain.com
offroadbeasts.com
degroenetunnel.com
boisehosting.net
dekkinngay.com
vesinhnha.com.vn
pierrehale.com
pinkexcel.com
blgr.be
midmohandyman.com
gw2guilds.org
wacochamber.com
lichencafe.com
slimidealherbal.com
lapinvihreat.fi
macabaneaupaysflechois.com
deprobatehelp.com
atalent.fi
katketytaanet.fi
classycurtainsltd.co.uk
bouldercafe-wuppertal.de
schraven.de
thailandholic.com
firstpaymentservices.com
agence-chocolat-noir.com
verifort-capital.de
pmc-services.de
personalenhancementcenter.com
physiofischer.de
danielblum.info
argenblogs.com.ar
musictreehouse.net
asgestion.com
bargningavesta.se
carolinepenn.com
parkstreetauto.net
ravensnesthomegoods.com
chrissieperry.com
hashkasolutindo.com
siliconbeach-realestate.com
d2marketing.co.uk
highimpactoutdoors.net
ncuccr.org
journeybacktolife.com
ecoledansemulhouse.fr
ftlc.es
dlc.berlin
abuelos.com
jakekozmor.com
westdeptfordbuyrite.com
ontrailsandboulevards.com
tradiematepro.com.au
smokeysstoves.com
huesges-gruppe.de
www1.proresult.no
shiftinspiration.com
schlafsack-test.net
retroearthstudio.com
norpol-yachting.com
ctrler.cn
insp.bi
drinkseed.com
abogadosaccidentetraficosevilla.es
greenfieldoptimaldentalcare.com
walter-lemm.de
sw1m.ru
mir-na-iznanku.com
ccpbroadband.com
iwr.nl
chaotrang.com
izzi360.com
mezhdu-delom.ru
zimmerei-fl.de
heidelbergartstudio.gallery
restaurantesszimmer.de
hexcreatives.co
praxis-management-plus.de
homecomingstudio.com
pt-arnold.de
waveneyrivercentre.co.uk
gemeentehetkompas.nl
tulsawaterheaterinstallation.com
edelman.jp
lusak.at
milsing.hr
mousepad-direkt.de
fotoideaymedia.es
toreria.es
abitur-undwieweiter.de
htchorst.nl
gratispresent.se
xn--vrftet-pua.biz
richard-felix.co.uk
n1-headache.com
centromarysalud.com
tonelektro.nl
waynela.com
notmissingout.com
vitalyscenter.es
summitmarketingstrategies.com
eadsmurraypugh.com
herbstfeststaefa.ch
notsilentmd.org
tanzprojekt.com
spsshomeworkhelp.com
finde-deine-marke.de
praxis-foerderdiagnostik.de
puertamatic.es
cursoporcelanatoliquido.online
nativeformulas.com
austinlchurch.com
tanzschule-kieber.de
analiticapublica.es
smart-light.co.uk
birnam-wood.com
synlab.lt
bastutunnan.se
strandcampingdoonbeg.com
jandaonline.com
wychowanieprzedszkolne.pl
entopic.com
c-a.co.in
lange.host
cuppacap.com
yourobgyn.net
leather-factory.co.jp
architecturalfiberglass.org
calabasasdigest.com
polzine.net
socialonemedia.com
gastsicht.de
lubetkinmediacompanies.com
platformier.com
bundabergeyeclinic.com.au
heliomotion.com
modelmaking.nl
garage-lecompte-rouen.fr
mirkoreisser.de
rerekatu.com
groupe-cets.com
saarland-thermen-resort.com
courteney-cox.net
iphoneszervizbudapest.hu
systemate.dk
erstatningsadvokaterne.dk
lynsayshepherd.co.uk
craigvalentineacademy.com
coffreo.biz
paradicepacks.com
web.ion.ag
comparatif-lave-linge.fr
forskolorna.org
digi-talents.com
peterstrobos.com
ai-spt.jp
surespark.org.uk
8449nohate.org
henricekupper.com
pogypneu.sk
merzi.info
ncid.bc.ca
pmcimpact.com
jerling.de
shiresresidential.com
tecnojobsnet.com
faizanullah.com
eco-southafrica.com
carlosja.com
bestbet.com
manifestinglab.com
skiltogprint.no
vox-surveys.com
1kbk.com.ua
reddysbakery.com
bigler-hrconsulting.ch
365questions.org
zervicethai.co.th
nandistribution.nl
bunburyfreightservices.com.au
helikoptervluchtnewyork.nl
corendonhotels.com
harveybp.com
hebkft.hu
autofolierung-lu.de
malychanieruchomoscipremium.com
newstap.com.ng
ateliergamila.com
jadwalbolanet.info
asteriag.com
aunexis.ch
withahmed.com
baronloan.org
rosavalamedahr.com
stoeberstuuv.de
funjose.org.gt
vdberg-autoimport.nl
healthyyworkout.com
latribuessentielle.com
em-gmbh.ch
appsformacpc.com
extraordinaryoutdoors.com
levihotelspa.fi
clos-galant.com
vibehouse.rw
lenreactiv-shop.ru
ostheimer.at
completeweddingkansas.com
songunceliptv.com
spargel-kochen.de
tigsltd.com
modestmanagement.com
xn--fnsterputssollentuna-39b.se
starsarecircular.org
marathonerpaolo.com
dushka.ua
quemargrasa.net
haar-spange.com
panelsandwichmadrid.es
castillobalduz.es
ftf.or.at
connectedace.com
pocket-opera.de
suncrestcabinets.ca
bouquet-de-roses.com
work2live.de
talentwunder.com
homesdollar.com
blogdecachorros.com
35-40konkatsu.net
krlosdavid.com
broseller.com
wellplast.se
latestmodsapks.com
accountancywijchen.nl
stemenstilte.nl
sahalstore.com
osterberg.fi
rebeccarisher.com
americafirstcommittee.org
rushhourappliances.com
kamahouse.net
zieglerbrothers.de
love30-chanko.com
nijaplay.com
greenpark.ch
nokesvilledentistry.com
nakupunafoundation.org
shsthepapercut.com
oneplusresource.org
abogados-en-alicante.es
adultgamezone.com
zso-mannheim.de
daklesa.de
villa-marrakesch.de
cerebralforce.net
gantungankunciakrilikbandung.com
sojamindbody.com
rafaut.com
campusoutreach.org
psc.de
friendsandbrgrs.com
sportiomsportfondsen.nl
ilso.net
frontierweldingllc.com
mrxermon.de
jacquin-maquettes.com
dsl-ip.de
allfortheloveofyou.com
hihaho.com
unetica.fr
lebellevue.fr
agence-referencement-naturel-geneve.net
solerluethi-allart.ch
wurmpower.at
augenta.com
perbudget.com
sabel-bf.com
falcou.fr
hardinggroup.com
satyayoga.de
sweering.fr
ralister.co.uk
skanah.com
simplyblessedbykeepingitreal.com
christinarebuffetcourses.com
ihr-news.jp
dublikator.com
danholzmann.com
12starhd.online
chavesdoareeiro.com
dinslips.se
shhealthlaw.com
rumahminangberdaya.com
commonground-stories.com
cactusthebrand.com
corona-handles.com
pixelarttees.com
citymax-cr.com
hvccfloorcare.com
promalaga.es
centuryrs.com
vorotauu.ru
iyahayki.nl
troegs.com
labobit.it
kissit.ca
tophumanservicescourses.com
imaginado.de
bodyfulls.com
balticdermatology.lt
sportverein-tambach.de
theapifactory.com
edrcreditservices.nl
mindpackstudios.com
321play.com.hk
vermoote.de
kunze-immobilien.de
nmiec.com
toponlinecasinosuk.co.uk
cimanchesterescorts.co.uk
koken-voor-baby.nl
jobmap.at
lapmangfpt.info.vn
mdacares.com
cleliaekiko.online
verbisonline.com
blewback.com
catholicmusicfest.com
oneheartwarriors.at
lillegrandpalais.com
aglend.com.au
bhwlawfirm.com
zewatchers.com
devlaur.com
mediaplayertest.net
tenacitytenfold.com
alvinschwartz.wordpress.com
homng.net
kmbshipping.co.uk
travelffeine.com
microcirc.net
bptdmaluku.com
ausbeverage.com.au
2ekeus.nl
y-archive.com
bodyforwife.com
denifl-consulting.at
eaglemeetstiger.de
lescomtesdemean.be
flexicloud.hk
besttechie.com
ki-lowroermond.nl
punchbaby.com
edgewoodestates.org
lloydconstruction.com
mikeramirezcpa.com
wolf-glas-und-kunst.de
montrium.com
tetinfo.in
webmaster-peloton.com
takeflat.com
hkr-reise.de
lukeshepley.wordpress.com
socstrp.org
itelagen.com
devok.info
amerikansktgodis.se
baustb.de
boulderwelt-muenchen-west.de
sandd.nl
marketingsulweb.com
artallnightdc.com
kath-kirche-gera.de
basisschooldezonnewijzer.nl
thewellnessmimi.com
antiaginghealthbenefits.com
mediaacademy-iraq.org
financescorecard.com
xn--rumung-bua.online
simpliza.com
madinblack.com
softsproductkey.com
werkkring.nl
deko4you.at
stoeferlehalle.de
sofavietxinh.com
jsfg.com
familypark40.com
faronics.com
higadograsoweb.com
caribdoctor.org
projetlyonturin.fr
modamilyon.com
baumkuchenexpo.jp
hypozentrum.com
dirittosanitario.biz
ceid.info.tr
sterlingessay.com
fibrofolliculoma.info
sporthamper.com
no-plans.com
licor43.de
grupocarvalhoerodrigues.com.br
koko-nora.dk
scenepublique.net
myteamgenius.com
tandartspraktijkheesch.nl
allentownpapershow.com
theadventureedge.com
123vrachi.ru
balticdentists.com
tips.technology
liliesandbeauties.org
id-vet.com
ladelirante.fr
klusbeter.nl
bogdanpeptine.ro
stopilhan.com
manutouchmassage.com
wraithco.com
hotelsolbh.com.br
hmsdanmark.dk
strategicstatements.com
rota-installations.co.uk
minipara.com
easytrans.com.au
i-trust.dk
ditog.fr
sloverse.com
maryloutaylor.com
imadarchid.com
humancondition.com
glennroberts.co.nz
jvanvlietdichter.nl
tomoiyuma.com
arteservicefabbro.com
hiddencitysecrets.com.au
truenyc.co
eraorastudio.com
foretprivee.ca
tux-espacios.com
drugdevice.org
pasivect.co.uk
esope-formation.fr
autodujos.lt
psa-sec.de
portoesdofarrobo.com
parkcf.nl
officehymy.com
raschlosser.de
thedad.com
wmiadmin.com
mank.de
digivod.de
calxplus.eu
webhostingsrbija.rs
seagatesthreecharters.com
hhcourier.com
ra-staudte.de
hairstylesnow.site
alsace-first.com
globedivers.wordpress.com
miriamgrimm.de
gonzalezfornes.es
jasonbaileystudio.com
maxadams.london
allure-cosmetics.at
todocaracoles.com
craftleathermnl.com
tongdaifpthaiphong.net
wari.com.pe
nataschawessels.com
presseclub-magdeburg.de
geoffreymeuli.com
leeuwardenstudentcity.nl
michaelsmeriglioracing.com
naturstein-hotte.de
layrshift.eu
maratonaclubedeportugal.com
ouryoungminds.wordpress.com
dramagickcom.wordpress.com
body-armour.online
bildungsunderlebnis.haus
coding-marking.com
bxdf.info
conasmanagement.de
coding-machine.com
seproc.hn
lightair.com
monark.com
delchacay.com.ar
vitavia.lt
deepsouthclothingcompany.com
farhaani.com
ohidesign.com
mastertechengineering.com
trackyourconstruction.com
ivivo.es
bee4win.com
pv-design.de
kuntokeskusrok.fi
directwindowco.com
cite4me.org
herbayupro.com
littlebird.salon
worldhealthbasicinfo.com
bridgeloanslenders.com
rocketccw.com
smejump.co.th
qlog.de
saxtec.com
qualitaetstag.de
slashdb.com
aprepol.com
theduke.de
gopackapp.com
sanaia.com
ncs-graphic-studio.com
ilcdover.com
almosthomedogrescue.dog
vihannesporssi.fi
div-vertriebsforschung.de
binder-buerotechnik.at
senson.fi
olejack.ru
bristolaeroclub.co.uk
karacaoglu.nl
pawsuppetlovers.com
mercantedifiori.com
judithjansen.com
upplandsspar.se
abl1.net
bingonearme.org
dutchcoder.nl
pubweb.carnet.hr
myzk.site
fatfreezingmachines.com
slwgs.org
slimani.net
promesapuertorico.com
haremnick.com
dutchbrewingcoffee.com
ogdenvision.com
stallbyggen.se
beautychance.se
groupe-frayssinet.fr
igfap.com
oncarrot.com
destinationclients.fr
danubecloud.com
ungsvenskarna.se
antonmack.de
blood-sports.net
nsec.se
ymca-cw.org.uk
lapinlviasennus.fi
launchhubl.com
mardenherefordshire-pc.gov.uk
yamalevents.com
saka.gr
baylegacy.com
symphonyenvironmental.com
femxarxa.cat
bloggyboulga.net
cortec-neuro.com
jeanlouissibomana.com
stacyloeb.com
centrospgolega.com
levdittliv.se
amylendscrestview.com
pferdebiester.de
chatizel-paysage.fr
sanyue119.com
naturavetal.hr
milltimber.aberdeen.sch.uk
celeclub.org
naswrrg.org
proudground.org
the-domain-trader.com
lionware.de
igrealestate.com
torgbodenbollnas.se
advokathuset.dk
expandet.dk
oceanastudios.com
mrsplans.net
piajeppesen.dk
bradynursery.com
huehnerauge-entfernen.de
actecfoundation.org
morawe-krueger.de
collaborativeclassroom.org
deoudedorpskernnoordwijk.nl
vloeren-nu.nl
happyeasterimages.org
apprendrelaudit.com
opatrovanie-ako.sk
ceres.org.au
daniel-akermann-architektur-und-planung.ch
dareckleyministries.com
desert-trails.com
jiloc.com
irinaverwer.com
urist-bogatyr.ru
rimborsobancario.net
readberserk.com
geisterradler.de
revezlimage.com
deschl.net
aco-media.nl
xn--fn-kka.no
lmtprovisions.com
wien-mitte.co.at
securityfmm.com
waywithwords.net
craigmccabe.fun
elimchan.com
samnewbyjax.com
alfa-stroy72.com
fiscalsort.com
dr-tremel-rednitzhembach.de
streamerzradio1.site
coursio.com
smithmediastrategies.com
live-your-life.jp
ruralarcoiris.com
ino-professional.ru
consultaractadenacimiento.com
serce.info.pl
woodleyacademy.org
kalkulator-oszczednosci.pl
ivfminiua.com
hellohope.com
croftprecision.co.uk
joseconstela.com
thedresserie.com
linnankellari.fi
nvwoodwerks.com
spacecitysisters.org
educar.org
muamuadolls.com
fizzl.ru
odiclinic.org
mrsfieldskc.com
mmgdouai.fr
tinyagency.com
biapi-coaching.fr
jobcenterkenya.com
exenberger.at
harpershologram.wordpress.com
kindersitze-vergleich.de
solhaug.tk
otsu-bon.com
dubscollective.com
sarbatkhalsafoundation.org
bayoga.co.uk
woodworkersolution.com
waermetauscher-berechnen.de
sla-paris.com
selfoutlet.com
servicegsm.net
baptisttabernacle.com
mbxvii.com
beaconhealthsystem.org
loprus.pl
xoabigail.com
fannmedias.com
apolomarcas.com
real-estate-experts.com
urclan.net
shonacox.com
aurum-juweliere.de
ligiercenter-sachsen.de
hatech.io
dpo-as-a-service.com
turkcaparbariatrics.com
boosthybrid.com.au
fensterbau-ziegler.de
jorgobe.at
micahkoleoso.de
penco.ie
creative-waves.co.uk
finediningweek.pl
brevitempore.net
pcprofessor.com
seitzdruck.com
simpkinsedwards.co.uk
tstaffing.nl
krcove-zily.eu
nachhilfe-unterricht.com
bargningharnosand.se
trulynolen.co.uk
yassir.pro
walkingdeadnj.com
cnoia.org
zflas.com
intecwi.com
zweerscreatives.nl
testcoreprohealthuk.com
klimt2012.info
carrybrands.nl
tanciu.com
employeesurveys.com
nancy-informatique.fr
parks-nuernberg.de
luxurytv.jp
spectrmash.ru
sagadc.com
tandartspraktijkhartjegroningen.nl
boompinoy.com
dubnew.com
fayrecreations.com
joyeriaorindia.com
forestlakeuca.org.au
-
net
true
-
pid
$2a$12$wsDKYj/FlqR3lZ6H4K2Qmenp6QLHkWTltAhlc0fUr6S4AfxkJrEhy
-
prc
oracle
synctime
mspub
sql
outlook
sqbcoreservice
thebat
agntsvc
isqlplussvc
mydesktopservice
tbirdconfig
ocomm
visio
powerpnt
dbsnmp
encsvc
onenote
firefox
excel
ocautoupds
mydesktopqos
wordpad
steam
ocssd
winword
xfssvccon
dbeng50
thunderbird
msaccess
infopath
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7029
-
svc
mepocs
vss
sql
sophos
svc$
veeam
backup
memtas
Extracted
C:\Users\67ny35-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9457AD543F88C7FA
http://decoder.re/9457AD543F88C7FA
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2828 netsh.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\t32mMaunsR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe" b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\O: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\R: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\Z: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\B: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\E: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\J: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\L: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\N: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\V: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\X: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\A: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\I: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\S: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\T: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\W: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\D: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\F: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\G: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\H: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\K: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\P: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\Q: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\U: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened (read-only) \??\Y: b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\j8sa584s8r8ba.bmp" b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe -
Drops file in Program Files directory 36 IoCs
description ioc Process File opened for modification \??\c:\program files\SubmitRedo.xht b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\WaitPublish.aiff b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\CheckpointSuspend.ppt b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\ConvertAdd.pot b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\MoveSync.odt b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\OpenSplit.wmv b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\SplitInvoke.xltm b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\UndoUnpublish.mpv2 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\UpdateFind.wmf b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\tmp b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\AddClear.emf b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\FindInitialize.mp4v b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\SendComplete.mp2 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\SendSet.search-ms b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File created \??\c:\program files (x86)\tmp b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\GetUnlock.mp3 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\SearchConfirm.m4v b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\67ny35-readme.txt b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\ConvertToReset.xsl b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\tmp b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\tmp b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\67ny35-readme.txt b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File created \??\c:\program files\tmp b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File created \??\c:\program files (x86)\67ny35-readme.txt b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\GrantSync.docx b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\RenameRegister.xlsm b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\RestartGroup.pptm b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\WaitStart.csv b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File created \??\c:\program files\67ny35-readme.txt b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\EnableDeny.vst b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\InvokePop.WTV b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\NewCheckpoint.wps b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\HideUndo.xhtml b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\PublishResume.m4v b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File opened for modification \??\c:\program files\RenameUnprotect.vstx b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\67ny35-readme.txt b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2496 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe 2496 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe 2496 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe 2496 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe 2496 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 2496 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe Token: SeTakeOwnershipPrivilege 2496 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe Token: SeBackupPrivilege 768 vssvc.exe Token: SeRestorePrivilege 768 vssvc.exe Token: SeAuditPrivilege 768 vssvc.exe Token: SeBackupPrivilege 3024 vssvc.exe Token: SeRestorePrivilege 3024 vssvc.exe Token: SeAuditPrivilege 3024 vssvc.exe Token: SeBackupPrivilege 796 vssvc.exe Token: SeRestorePrivilege 796 vssvc.exe Token: SeAuditPrivilege 796 vssvc.exe Token: SeBackupPrivilege 704 vssvc.exe Token: SeRestorePrivilege 704 vssvc.exe Token: SeAuditPrivilege 704 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2828 2496 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe 29 PID 2496 wrote to memory of 2828 2496 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe 29 PID 2496 wrote to memory of 2828 2496 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe 29 PID 2496 wrote to memory of 2828 2496 b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe 29 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe"C:\Users\Admin\AppData\Local\Temp\b4015b2abf100140691ff5f32de9e7b903a82ae49af5bf5e1ea9b6d84e4f3205.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule group="Network Discovery" new enable=Yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2828
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1184
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:768
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:796
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:704
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD560939ce5d16926d93289f3118430cd10
SHA188163a2a654d6f8d5e5cb728abf8d6fa718f0a0e
SHA2563b49c2505a2644f840019e41d51647988765250bf055e0c0c96938030fa7d6b9
SHA512c41f15d40c4ccbc004ec505646b8bf922555e539bacd9009de27952f13ab45dba8635c6d7d8342cb490e8ab60ef4ba9877b678d248235eb5a96b8a7baf983c0d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b