95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e

General
Target

95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

Filesize

986KB

Completed

11-02-2020 13:56

Score
10 /10
MD5

934984b11e6690c10e7ad5bf1f0cf274

SHA1

5c826f0bca1460508b0a3db4b0e5f9fbd7c2104f

SHA256

95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e

Malware Config
Signatures 9

Filter: none

Persistence
  • Ouroboros/Zeropadypt

    Description

    Ransomware family based on open-source CryptoWire.

  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Drops desktop.ini file(s)
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\$Recycle.Bin\S-1-5-21-634046074-2673730973-2644684987-1000\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\$Recycle.Bin\S-1-5-21-634046074-2673730973-2644684987-1000\desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    descriptionflowioc
    HTTP URL3http://www.sfml-dev.org/ip-provider.php
  • Drops file in Program Files directory
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\es\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Windows Media Player\wmplayer.exe95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\HelpIcon_contrast-white.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\ui-strings.js95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\10px.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\SkypeAppList.targetsize-32_altform-unplated.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Flattener\AppVManifest.dll.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-64.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.ViewerPlugin\ReliveSurfaces\Preview\RelivePreviewControl.xaml95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\org-openide-modules.jar.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\sr-cyrl-cs\mso.acl95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\THMBNAIL.PNG95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256_altform-unplated_contrast-white.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\7-Zip\Lang\io.txt95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\bin\jmc.ini95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-200.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\69_32x32x32.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEES.DLL95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\uk\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\DW\DBGHELP.DLL95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Backgrounds\Background1.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\cloud_icon.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Help\3082\hxdsui.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\HeroHelp\Scenario2.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-36_altform-unplated_contrast-black.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\complete.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1066\PowerPivotExcelClientAddIn.rll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Grid.Base.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\YellowAbstractNote.scale-200.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\6449_32x32x32.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\zh-CHT\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-32_altform-fullcolor.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\ui-strings.js95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-file-l1-2-0.dll.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-125_contrast-high.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.News\Assets\news_button.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Planet.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\resources.pri95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLikeExactly.ps195a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info2x.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunmscapi.jar95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\en-US.PhoneNumber.SMS.ot95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\fake_logo.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File createdC:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\ar\PowerViewRes.ar.xap.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.Email=[lilmoonhack6677@protonmail.com]ID=[3HQ04VIO16MA5DR].odveta95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteReplay_white.png95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
  • NTFS ADS
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Documents and Settings\zh-TW\8:袠Ȫt95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    File opened for modificationC:\Documents and Settings\zh-TW\8:꧰džt.ex95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe

    Reported IOCs

    pidprocess
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
  • Suspicious use of WriteProcessMemory
    95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4892 wrote to memory of 4940489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 4940489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 4940489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4940 wrote to memory of 49804940cmd.exenet.exe
    PID 4940 wrote to memory of 49804940cmd.exenet.exe
    PID 4940 wrote to memory of 49804940cmd.exenet.exe
    PID 4980 wrote to memory of 50004980net.exenet1.exe
    PID 4980 wrote to memory of 50004980net.exenet1.exe
    PID 4980 wrote to memory of 50004980net.exenet1.exe
    PID 4892 wrote to memory of 5020489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 5020489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 5020489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 5020 wrote to memory of 50805020cmd.exenet.exe
    PID 5020 wrote to memory of 50805020cmd.exenet.exe
    PID 5020 wrote to memory of 50805020cmd.exenet.exe
    PID 5080 wrote to memory of 50965080net.exenet1.exe
    PID 5080 wrote to memory of 50965080net.exenet1.exe
    PID 5080 wrote to memory of 50965080net.exenet1.exe
    PID 4892 wrote to memory of 5112489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 5112489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 5112489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 5112 wrote to memory of 19365112cmd.exenet.exe
    PID 5112 wrote to memory of 19365112cmd.exenet.exe
    PID 5112 wrote to memory of 19365112cmd.exenet.exe
    PID 1936 wrote to memory of 17361936net.exenet1.exe
    PID 1936 wrote to memory of 17361936net.exenet1.exe
    PID 1936 wrote to memory of 17361936net.exenet1.exe
    PID 4892 wrote to memory of 4252489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 4252489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 4252489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4252 wrote to memory of 10204252cmd.exenet.exe
    PID 4252 wrote to memory of 10204252cmd.exenet.exe
    PID 4252 wrote to memory of 10204252cmd.exenet.exe
    PID 1020 wrote to memory of 42841020net.exenet1.exe
    PID 1020 wrote to memory of 42841020net.exenet1.exe
    PID 1020 wrote to memory of 42841020net.exenet1.exe
    PID 4892 wrote to memory of 3000489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 3000489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 3000489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 3000 wrote to memory of 41563000cmd.exenet.exe
    PID 3000 wrote to memory of 41563000cmd.exenet.exe
    PID 3000 wrote to memory of 41563000cmd.exenet.exe
    PID 4156 wrote to memory of 29604156net.exenet1.exe
    PID 4156 wrote to memory of 29604156net.exenet1.exe
    PID 4156 wrote to memory of 29604156net.exenet1.exe
    PID 4892 wrote to memory of 3672489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 3672489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 3672489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 4420489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 4420489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 4420489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 3180489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 3180489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 3180489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 4628489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 4628489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4892 wrote to memory of 4628489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
    PID 4628 wrote to memory of 16724628cmd.exenet.exe
    PID 4628 wrote to memory of 16724628cmd.exenet.exe
    PID 4628 wrote to memory of 16724628cmd.exenet.exe
    PID 1672 wrote to memory of 46761672net.exenet1.exe
    PID 1672 wrote to memory of 46761672net.exenet1.exe
    PID 1672 wrote to memory of 46761672net.exenet1.exe
    PID 4892 wrote to memory of 4652489295a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.execmd.exe
Processes 32
  • C:\Users\Admin\AppData\Local\Temp\95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe
    "C:\Users\Admin\AppData\Local\Temp\95a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e.exe"
    Drops desktop.ini file(s)
    Drops file in Program Files directory
    NTFS ADS
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop SQLWriter
      Suspicious use of WriteProcessMemory
      PID:4940
      • C:\Windows\SysWOW64\net.exe
        net stop SQLWriter
        Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SQLWriter
          PID:5000
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop SQLBrowser
      Suspicious use of WriteProcessMemory
      PID:5020
      • C:\Windows\SysWOW64\net.exe
        net stop SQLBrowser
        Suspicious use of WriteProcessMemory
        PID:5080
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SQLBrowser
          PID:5096
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
      Suspicious use of WriteProcessMemory
      PID:5112
      • C:\Windows\SysWOW64\net.exe
        net stop MSSQLSERVER
        Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSSQLSERVER
          PID:1736
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
      Suspicious use of WriteProcessMemory
      PID:4252
      • C:\Windows\SysWOW64\net.exe
        net stop MSSQL$CONTOSO1
        Suspicious use of WriteProcessMemory
        PID:1020
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSSQL$CONTOSO1
          PID:4284
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSDTC
      Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Windows\SysWOW64\net.exe
        net stop MSDTC
        Suspicious use of WriteProcessMemory
        PID:4156
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSDTC
          PID:2960
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      PID:3672
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
      PID:4420
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
      PID:3180
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
      Suspicious use of WriteProcessMemory
      PID:4628
      • C:\Windows\SysWOW64\net.exe
        net stop SQLSERVERAGENT
        Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SQLSERVERAGENT
          PID:4676
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
      PID:4652
      • C:\Windows\SysWOW64\net.exe
        net stop MSSQLSERVER
        PID:4336
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSSQLSERVER
          PID:4332
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop vds
      PID:3780
      • C:\Windows\SysWOW64\net.exe
        net stop vds
        PID:4104
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop vds
          PID:3860
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
      PID:3884
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall set currentprofile state off
        PID:3680
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
      PID:4768
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall set opmode mode=disable
        PID:2408
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/4892-0-0x00000000012F0000-0x00000000012F1000-memory.dmp

                        • memory/4892-1-0x0000000001AF0000-0x0000000001AF1000-memory.dmp

                        • memory/4892-2-0x00000000012F0000-0x00000000012F1000-memory.dmp

                        • memory/4892-3-0x0000000001AF0000-0x0000000001AF1000-memory.dmp

                        • memory/4892-4-0x00000000012F0000-0x00000000012F1000-memory.dmp

                        • memory/4892-8-0x00000000012F0000-0x00000000012F1000-memory.dmp

                        • memory/4892-16-0x00000000012F0000-0x00000000012F1000-memory.dmp

                        • memory/4892-17-0x0000000001AF0000-0x0000000001AF1000-memory.dmp