sodinokibi | e620368c0e4424f2207bd1b045c72af6a45ab9f70cb904a9b87eb098150203d5

Resubmissions

14-01-2025 05:40

250114-gc3syaykcv 10

14-01-2025 05:39

250114-gcgwgazqek 3

30-12-2024 20:05

241230-ytyc8ayqgy 10

Analysis

max time kernel
890s
max time network
894s
platform
windows10-2004_x64
resource
win10v2004-20241007-es
resource tags

arch:x64arch:x86image:win10v2004-20241007-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
14-01-2025 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL __.pdf(5).exe
Size

555KB
MD5

6b0b4b91770ed2c332a13e78ac56af6d
SHA1

b96e951b5ee4617c6d6e3c1fd23c5d0ef8b3c11d
SHA256

8161225680dbb5c52e0192230c0d1b9b87120d92b289e14f93479e38024be17d
SHA512

b3e8354ca9a80d63a78eb90a74b29c4ce44d461cf9c11846e6232b382b5f95720cc5f6876179b99f42649441b5f0993fada5e470dff057b227cea961d62a8f2d
SSDEEP

6144:thTFzbi0i83BJ5NrRUGTRQrFc67uSCLc9aDYU07XbUAWAVf:DJq0i83B3lR7GYDVaXDVf

Score

10^/10

sodinokibi 30 97 discovery ransomware spyware stealer

Malware Config

Extracted

Family

sodinokibi

Botnet

Campaign

Decoy

sytzedevries.com

druktemakersheerenveen.nl

energosbit-rp.ru

business-basic.de

acibademmobil.com.tr

leansupremegarcinia.net

worldproskitour.com

shortsalemap.com

pansionatblago.ru

humanviruses.org

ya-elka.ru

block-optic.com

silkeight.com

carmel-york.com

unexplored.gr

hotjapaneselesbian.com

forextimes.ru

avisioninthedesert.com

agenceassemble.fr

keyboardjournal.com

Attributes

net
true
pid
30
prc
mysqld_nt.exe

dbsnmp.exe

ocssd.exe

sqlwriter.exe

winword.exe

oracle.exe

thunderbird.exe

mysqld_opt.exe

agntsvc.exe

excel.exe

ocautoupds.exe

encsvc.exe

infopath.exe

mspub.exe

msaccess.exe

steam.exe

sqlservr.exe

dbeng50.exe

sqlbrowser.exe

onenote.exe

firefoxconfig.exe

mydesktopqos.exe

thebat64.exe

xfssvccon.exe

synctime.exe

ocomm.exe

powerpnt.exe

tbirdconfig.exe

sqbcoreservice.exe

mysqld.exe

visio.exe

wordpad.exe

mydesktopservice.exe

isqlplussvc.exe

sqlagent.exe

thebat.exe

outlook.exe

msftesql.exe
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
97

Extracted

Path

C:\Users\289m7u7-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 289m7u7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7F1B72B21A40FCE0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7F1B72B21A40FCE0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: QawudxVyeZrJHWgTr27ZhTbD4BxuioZdqLQXWnUWYPumFpoVQCX1tFhVG2WoYwr8 GGBBu+dia/mwe9uz6su6AUUW3S+T40PIIJhoPhIt6tZjjqYYsZrcJBknmrAIUL3J GSTyj6irwWmGyC8ACxvcArpNvLmNb4OoDuEQBpeYInfXsM6tFcQNPKcCanxTeqbz iJs27odRSrRbC+xFsDeusYUh4cD/F8MEc8J7Qepld+yWE5bPJ3tiZZ657LS37IbY SDQc46MyMzVkFwIVlz1OatOTYwQ1NriAfyxKKXJg+Jw4cK1ky3y2Ap4LFLjTqRwa A5MX9+Tntl8MvvelDy/wq17A1mlLPidCEJJrlrIqEAPPg+eZDv2qBlnRJivw35IZ vmumyqXsBInrFU6xrkqYtyXZE0I5z0hJWtpQooRHaxPfCi9K8Z66GXiXWpLvm/qc ZwrH22a6i5KcZuQU2Z0cdrOFn6EB9t/5R8/wXm7jkA++J4rOKHCv/2AZPmVaC6DB E5N1RbFaiIZZ1froia/04eI7ixz31e9Jr+TfyqopliFhHSf44SWC9EoX1+/ljKl0 cwnSYbr5+E3JPqetPrdWByzvp1bic8OKSdPDtet01R+Uxdeigf/YI09ha1A27uM/ TwTrolTtdaNUklyYKsDhlUei32RAEYpQOoZcY7Piy7TKRUinYiTHHVs0MN8RlTT+ mNphVjSx7Cit9kEpRnyqufCCOlAyqqlSeA6+mrgIAlyiZnBj5gLFHCwXpWvKy6Up Y5ANlkq49KFXnTi6Sf24DCC0YrZ8K6RchlIZ0y2n4caHj4l/i3pJ7sNKqnsZARO6 u0CgNOkflGI/eKKL6cQo254sExYV1MtoSsKTdIyKm8SnOkU3Oj+TUEKnj1cqaG9f C3cR/jSGr9ixpuY+uoN+5BBYI1/3uF1ZlHKBAZgfT+S3/B3zyZ3d2AJ6S3Rb58rn pCnKC8Hh4V4XydGR2wUAS9ia52PIP0Erscy77i8HVuMpGLeCKFekMSKYphpZMfW2 TEELwO3GYuylieGJoZvM4ocKXOj8AZAwb/8FLIm0UjkVPtmOmTAHiCLRCmzttTgR zRXXbYq6/A9lgAemIi+ZWbObEQ6CKNxDA4rIrc/I9nFY4wQvAOD+DlRjepcAHurx LunUHCDk3iAWs/7ZqwsUPRZQeIp389v2VFyP5LBPxJxthYydIQzXfJ3uXxScTuov 5m6Lqx2WWEGrxwulFy9Rdg== Extension name: 289m7u7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7F1B72B21A40FCE0

http://decryptor.top/7F1B72B21A40FCE0

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	DHL __.pdf(5).exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	DHL __.pdf(5).exe
File opened (read-only)	\??\I:	DHL __.pdf(5).exe
File opened (read-only)	\??\J:	DHL __.pdf(5).exe
File opened (read-only)	\??\Z:	DHL __.pdf(5).exe
File opened (read-only)	\??\D:	DHL __.pdf(5).exe
File opened (read-only)	\??\X:	DHL __.pdf(5).exe
File opened (read-only)	\??\H:	DHL __.pdf(5).exe
File opened (read-only)	\??\L:	DHL __.pdf(5).exe
File opened (read-only)	\??\M:	DHL __.pdf(5).exe
File opened (read-only)	\??\N:	DHL __.pdf(5).exe
File opened (read-only)	\??\S:	DHL __.pdf(5).exe
File opened (read-only)	\??\W:	DHL __.pdf(5).exe
File opened (read-only)	\??\Y:	DHL __.pdf(5).exe
File opened (read-only)	\??\F:	DHL __.pdf(5).exe
File opened (read-only)	\??\K:	DHL __.pdf(5).exe
File opened (read-only)	\??\O:	DHL __.pdf(5).exe
File opened (read-only)	\??\Q:	DHL __.pdf(5).exe
File opened (read-only)	\??\U:	DHL __.pdf(5).exe
File opened (read-only)	\??\V:	DHL __.pdf(5).exe
File opened (read-only)	\??\T:	DHL __.pdf(5).exe
File opened (read-only)	\??\A:	DHL __.pdf(5).exe
File opened (read-only)	\??\B:	DHL __.pdf(5).exe
File opened (read-only)	\??\G:	DHL __.pdf(5).exe
File opened (read-only)	\??\P:	DHL __.pdf(5).exe
File opened (read-only)	\??\R:	DHL __.pdf(5).exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6bz1.bmp"	DHL __.pdf(5).exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\ProtectInitialize.pptm	DHL __.pdf(5).exe
File opened for modification	\??\c:\program files\ProtectMerge.jpeg	DHL __.pdf(5).exe
File created	\??\c:\program files\a73a6b0b.lock	DHL __.pdf(5).exe
File created	\??\c:\program files (x86)\289m7u7-readme.txt	DHL __.pdf(5).exe
File opened for modification	\??\c:\program files\ApproveReceive.tiff	DHL __.pdf(5).exe
File opened for modification	\??\c:\program files\ConvertFromConvert.bmp	DHL __.pdf(5).exe
File opened for modification	\??\c:\program files\ConvertFromSync.gif	DHL __.pdf(5).exe
File opened for modification	\??\c:\program files\ExitSelect.xml	DHL __.pdf(5).exe
File opened for modification	\??\c:\program files\SkipRegister.mov	DHL __.pdf(5).exe
File opened for modification	\??\c:\program files\WatchCheckpoint.mp4	DHL __.pdf(5).exe
File created	\??\c:\program files\289m7u7-readme.txt	DHL __.pdf(5).exe
File created	\??\c:\program files (x86)\a73a6b0b.lock	DHL __.pdf(5).exe
File opened for modification	\??\c:\program files\GrantConvertFrom.vssm	DHL __.pdf(5).exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c68aa74741937c24_userdeviceregistration.ngc.dll.mui_d2c6ca95	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_nl-nl_de526fb546773452.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-sens-service.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6db5c466b45bc552_sens.dll.mui_64739194	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-onecore-pnp-umpnpmgr_31bf3856ad364e35_10.0.19041.1_none_dd36884c20ffb627.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1023_ja-jp_ed3ea94a706110ba.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.19041.1_es-es_ebe6f36b4c5f3ce9.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_ab83828872bfa667_gpapi.dll.mui_ef0a9748	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.19041.1_none_9ab96313e8d638bb_iscsied.dll_e933fb0e	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.19041.1_es-es_fe0f0c83ff027428.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.systemcompatible_6595b64144ccf1df_6.0.19041.1_none_049f5dd81797f4f9.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua-onecore.resources_31bf3856ad364e35_10.0.19041.1_de-de_848402175f135dad.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.19041.1_en-us_9eaa18c3f00b3175.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_nb-no_862dd322fb07020b.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..onmanager.resources_31bf3856ad364e35_10.0.19041.1_de-de_0b2bfd2dfb25cc08_partmgr.sys.mui_b800c491	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..geservice.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_4fe0218d9d982801.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.19041.1_none_55d16b95f6e3e25c.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.19041.1_it-it_09805d42c133e875_wudfplatform.dll.mui_d815d31a	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-fileinfominifilter_31bf3856ad364e35_10.0.19041.1_none_8ca608a8d0ab598e.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1023_el-gr_be13b8adb3526e23.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_hu-hu_0f39d18194c80f6e_msimsg.dll.mui_72e8994f	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..gc-kspsvc.resources_31bf3856ad364e35_10.0.19041.1_es-es_4f298dd28b5b80db_ngcsvc.dll.mui_96312421	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_10.0.19041.264_none_f0131a4775eba512.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-duser_31bf3856ad364e35_10.0.19041.1_none_1065bbcc9bd80874.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.19041.1_none_ca60666860ba12d7_cga40737.fon_2c4b9363	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_ro-ro_c00d07e45f7b48b1_bootmgr.exe.mui_c434701f	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..istration.resources_31bf3856ad364e35_10.0.19041.1_en-us_9f803ef667071665_deviceregistration.dll.mui_5b79527a	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1023_zh-cn_eebdbe6a380cfa05.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.19041.1202_en-us_e2d6f3ca6473453d_dsreg.dll.mui_5d9efc7e	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.264_none_4a12028313046a9e.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_hu-hu_b554802d4a83e6fc.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_pl-pl_1256afb9f5d1a29a.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_1aebdebe097e4aa4.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.19041.1_en-us_2c89c78983615cee_winload.efi.mui_35ee487d	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-c..r-library.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_2c6bf3e8c0668005.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-network-security_31bf3856ad364e35_10.0.19041.1266_none_41ea436edfbc2e32.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..geservice.resources_31bf3856ad364e35_10.0.19041.1_es-es_25a24f5a6fa3eb67_storagesense.adml_0fc60f43	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.19041.1288_none_a254f4e433806f5f.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.84_none_ae156ee654cf8c31.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-time-service.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_ab79ad39267430a2.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.19041.1_it-it_09805d42c133e875_wudfhost.exe.mui_1fc689ff	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shsvcs.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_7cada8433cebe7e4_shsvcs.dll.mui_b69fccab	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-windowsuiimmersive_31bf3856ad364e35_10.0.19041.264_none_0fb1740332ea9706.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_hu-hu_fd01b7045f001002_comctl32.dll.mui_0da4e682	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directory-services-sam_31bf3856ad364e35_10.0.19041.1202_none_26ae8647562ae5ff_offlinesam.dll_5e21eef0	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.19041.1_none_3500efd1cdfd0fad_h8514fix.fon_9a1c84fa	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_412ceba6e304397c.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_fr-fr_6de3ffe5662417e0.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.1_nl-nl_b61eeef08725eb7e.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_10.0.19041.1_none_3c0e438aa4ca8107.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_10.0.19041.1_en-us_f24223ac7f30b8f8_nsisvc.dll.mui_237a741f	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.19041.1_es-es_a9823ca2bdf0059f_scarddlg.dll.mui_300ae9df	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.19041.1_none_ce261fb74e2d8d8f.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directcomposition_31bf3856ad364e35_10.0.19041.264_none_7b56429da0a47c9b.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_cb612d02732b0fd9_comctl32.dll.mui_0da4e682	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_hid-user.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_be1670627d88fc7f.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore.resources_31bf3856ad364e35_10.0.19041.1_it-it_9bf49926b22e3d9a_applockercsp.dll.mui_d2a0df70	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_46feaa68fea5a157.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-time-service.resources_31bf3856ad364e35_10.0.19041.1_de-de_6006045d449d1cd6_w32time.dll.mui_b382d4b4	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-eventlog-api_31bf3856ad364e35_10.0.19041.1_none_6c76b9f239087add.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-commonlog_31bf3856ad364e35_10.0.19041.1288_none_f34a4136dcbbc20e_clfs.sys_04dfdff9	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_uk-ua_4f4fad6deb8a668a.manifest	DHL __.pdf(5).exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.19041.1_es-es_ca3ca8d6defbef0d_samsrv.dll.mui_32250491	DHL __.pdf(5).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DHL __.pdf(5).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 5c000000010000000400000000080000040000000100000010000000410352dc0ff7501b16f0028eba6f45c5030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	DHL __.pdf(5).exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1B511ABEAD59C6CE207077C0BF0E0043B1382612	DHL __.pdf(5).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1B511ABEAD59C6CE207077C0BF0E0043B1382612\Blob = 0300000001000000140000001b511abead59c6ce207077c0bf0e0043b1382612140000000100000014000000748580c066c7df37decfbd2937aa031dbeedcd170400000001000000100000002114c6bf5be15efddd3cf6a5f943ee8a0f0000000100000020000000084440583bb98ad9c8aa908659d92200b66a41500a8abfe115c8fe5e622433d3190000000100000010000000b0d68e08e9f9b8d739eaf5c3a25ab51f5c00000001000000040000000008000018000000010000001000000014c3bd3549ee225aece13734ad8ca0b82000000001000000cc040000308204c8308203b0a00302010202100cf5bd062b5602f47ab8502c23ccf066300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3231303333303030303030305a170d3331303332393233353935395a3059310b300906035504061302555331153013060355040a130c446967694365727420496e63313330310603550403132a446967694365727420476c6f62616c20473220544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100ccf710624fa6bb636fed905256c56d277b7a12568af1f4f9d6e7e18fbd95abf260411570db1200fa270ab557385b7db2519371950e6a41945b351bfa7bfabbc5be2430fe56efc4f37d97e314f5144dcba710f216eaab22f031221161699026ba78d9971fe37d66ab75449573c8acffef5d0a8a5943e1acb23a0ff348fcd76b37c163dcde46d6db45fe7d23fd90e851071e51a35fed4946547f2c88c5f4139c97153c03e8a139dc690c32c1af16574c9447427ca2c89c7de6d44d54af4299a8c104c2779cd648e4ce11e02a8099f04370cf3f766bd14c49ab245ec20d82fd46a8ab6c93cc6252427592f89afa5e5eb2b061e51f1fb97f0998e83dfa837f4769a10203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414748580c066c7df37decfbd2937aa031dbeedcd17301f0603551d230418301680144e2254201895e6e36ee60ffafab912ed06178f39300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7447322e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7447322e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b0500038201010090f170cb289769977c74fdc0fa267b53abadcd65fdba9c069c8ad75a4387ed4d4c565fadc1c5b505202e59d1ff4af5a02ad8b095adc92e4a3bd7a7f66f8829fc303f2484bbc3b77b93072caf876b7633ed005552b2599ee4b9d0f3dfe70ffeddf8c4b910728109045fcf979e2e32758ecf9a58d257317e370181b2666d291ab166096dd16e90f4b9fa2f0114c55c566401d97d87a838539f8b5d466d5cc6278481d47e8c8ca39b52e7c688ec377c2afbf0555a387210d80013cf4c73dbaa3735a82981699c76bcde187b90d4cacfef6703fd045a2116b1ffea3fdfdc82f5ebf45992230d242a95254ccaa191e6d4b7ac8774b3f16da399dbf9d5bd84409f0798	DHL __.pdf(5).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	DHL __.pdf(5).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	DHL __.pdf(5).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c5030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	DHL __.pdf(5).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef4240f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c13040000000100000010000000410352dc0ff7501b16f0028eba6f45c520000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	DHL __.pdf(5).exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	DHL __.pdf(5).exe
2416	DHL __.pdf(5).exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1672	2416	DHL __.pdf(5).exe	91
PID 2416 wrote to memory of 1672	2416	DHL __.pdf(5).exe	91
PID 2416 wrote to memory of 1672	2416	DHL __.pdf(5).exe	91

C:\Users\Admin\AppData\Local\Temp\DHL __.pdf(5).exe
"C:\Users\Admin\AppData\Local\Temp\DHL __.pdf(5).exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\289m7u7-readme.txt

Filesize
6KB

MD5
186cb78ae042cd38bf263ee9a5988989

SHA1
818bb73b2113ef0b4bb0292daf0c18f3079bb5f6

SHA256
6946fdd451e2e3462fa8bed9f326b9a9cb9998d626edaf089ba1703bb1457382

SHA512
3a8ed28fe2c6f7110476bc7f448f311d8ddc2f7f3544f9b267a187805b5425ea06a13887fc9e2b78ab3b6f0d53cd188b667354898727b60ed99667c6d2721d4b

Download Submit
memory/2416-421-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-458-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-4-0x00000000007F0000-0x00000000008F0000-memory.dmp

Filesize
1024KB

Download
memory/2416-422-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2416-396-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-398-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-399-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-401-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-404-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-405-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-407-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-408-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-409-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-410-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-412-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-413-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-424-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-417-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-419-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-420-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-1-0x00000000007F0000-0x00000000008F0000-memory.dmp

Filesize
1024KB

Download
memory/2416-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2416-3-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-415-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-428-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-430-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-431-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-432-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-433-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-434-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-435-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-437-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-440-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-444-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-445-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-447-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-448-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-449-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-451-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-452-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-454-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-456-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-423-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2416-459-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download