SodinokibiRansomware (19.05.01)

Jerry.Lin

#Fileless #LowAVDetection

1. 3E974B7347D347AE31C1B11C05A667E2  __________mac.js
   

复制代码

Nocria

1. Suspicious access to your file system has been detected that indicate an encryption Trojan.
   
2. 
   
3. The following processes were therefore interrupted by G DATA for security reasons:
   
4.         ----------------------------------------------------------------
   
5.         C:\Windows\System32\svchost.exe (PID 1076)
   
6.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 1436)
   
7.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 2856)
   
8.         C:\Windows\System32\taskhostex.exe (PID 2320)
   
9.         C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe (PID 1004)
   
10.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 2544)
    
11.         C:\Program Files\VMware\VMware Tools\VMware CAF\pme\bin\ManagementAgentHost.exe (PID 2184)
    
12.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 2836)
    
13.         C:\Program Files (x86)\Huorong\Sysdiag\bin\HipsDaemon.exe (PID 836)
    
14.         C:\Windows\System32\dllhost.exe (PID 3484)
    
15.         C:\Windows\System32\svchost.exe (PID 1136)
    
16.         C:\Program Files (x86)\Huorong\Sysdiag\bin\HipsDaemon.exe (PID 2404)
    
17.         C:\Windows\System32\InputMethod\CHS\ChsIME.exe (PID 3876)
    
18.         C:\Windows\System32\InputMethod\CHS\ChsIME.exe (PID 2596)
    
19.         C:\Program Files (x86)\Huorong\Sysdiag\bin\HRUpdate.exe (PID 4788)
    
20.         C:\Program Files (x86)\Huorong\Sysdiag\bin\HipsTray.exe (PID 3572)
    
21.         C:\Windows\explorer.exe (PID 2412)
    
22.         C:\Windows\System32\msdtc.exe (PID 3956)
    
23.         C:\Windows\System32\SearchIndexer.exe (PID 3372)
    
24.         C:\Windows\System32\sppsvc.exe (PID 2876)
    
25.         C:\Program Files (x86)\Huorong\Sysdiag\bin\HipsMain.exe (PID 2932)
    
26.         C:\Program Files (x86)\Huorong\Sysdiag\bin\HRUpdate.exe (PID 5032)
    
27.         C:\Program Files (x86)\Huorong\Sysdiag\bin\BugReport.exe (PID 604)
    
28.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 908)
    
29.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 5436)
    
30.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 2700)
    
31.         C:\Windows\System32\svchost.exe (PID 1276)
    
32.         C:\Users\promi\AppData\Roaming\Maxthon5\Public\MxUp\MxUp.exe (PID 2548)
    
33.         C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFwAdmin.exe (PID 5332)
    
34.         C:\Windows\System32\svchost.exe (PID 1672)
    
35.         ----------------------------------------------------------------
    
36. 
    
37. Detected suspicious activities:
    
38.         ----------------------------------------------------------------
    
39.         Deleted: Volume Shadow Copies
    
40.         Created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Maxthon5\Users\guest\Config\config.dat.tmp
    
41.         Created: C:\Windows\System32\ma-log4cpp.log
    
42.         Created: C:\Windows\System32\ma-log4cpp_rolling.log
    
43.         Created: C:\ProgramData\VMware\VMware CAF\pme\data\output\log\log4cpp_config_tmp
    
44.         Created: C:\ProgramData\VMware\VMware CAF\pme\data\output\log\ma-log4cpp.log
    
45.         Created: C:\Users\promi\AppData\Local\Microsoft\Windows\WebCacheLock.dat
    
46.         Created: C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat
    
47.         Created: C:\Users\promi\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_IPX Assertion_55e38e62829448d056e446c33c4a5f1c6eb7566f_00000000_cab_0a246011\Report.wer
    
48.         Created: C:\ProgramData\Huorong\Sysdiag\hips.db-wal
    
49.         Created: C:\ProgramData\Huorong\Sysdiag\hips.db-shm
    
50.         Created: C:\ProgramData\Huorong\Sysdiag\user.db-wal
    
51.         ----------------------------------------------------------------
    
52. 
    
53. The user blocked access.
    

复制代码

a233

Avast

静影沉璧

SEP：Downloader
BD：Malicious behavior blocked

vm001

操作进程：C:\Windows\System32\WScript.exe
病毒路径：C:\Users\Admin\Desktop\__________mac\__________mac.js
病毒名称：HEUR:Trojan/JS.PowerLoader.a
病毒ID：FB89AED261206053
操作结果：已处理

jdsh

WD扫描miss  运行报毒

c/mm

Dr.web  已上报

日期：
2019/5/1/周三 12:09组件：
防火墙代码：
201事件：
已允许连接详细信息：
规则名称： 规则不存在
PID: 324
进程： C:\Windows\System32\wscript.exe
端点： 未知
方向： 出站

调用Windows PowerShell 等半天无反应

con16

CIS VirusScope

761773275

飞碟1234

趋势miss