ouroboros | 7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319

General

Target

7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
Size

997KB
MD5

5425c30ebba4f84d1874a2c783932646
SHA1

80db4a06b57e61695389c354f155c26bb125bd71
SHA256

7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319
SHA512

457b1539296379bd93adfbc8c3a172405f9c341d9d8aa1c6a8c1dbb0ff52ae564911b1a1218ec5613a5e9e2bcca0c00001d118fb36868391ee93f8155b304f1f

Score

10^/10

evasion persistence ransomware ouroboros

Malware Config

Signatures

Suspicious use of WriteProcessMemory 124 IoCs

Processes:

7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	process	target process
PID 868 wrote to memory of 1096	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1096	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1096	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1096	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 1096 wrote to memory of 1064	1096	cmd.exe	net.exe
PID 1096 wrote to memory of 1064	1096	cmd.exe	net.exe
PID 1096 wrote to memory of 1064	1096	cmd.exe	net.exe
PID 1096 wrote to memory of 1064	1096	cmd.exe	net.exe
PID 1064 wrote to memory of 1532	1064	net.exe	net1.exe
PID 1064 wrote to memory of 1532	1064	net.exe	net1.exe
PID 1064 wrote to memory of 1532	1064	net.exe	net1.exe
PID 1064 wrote to memory of 1532	1064	net.exe	net1.exe
PID 868 wrote to memory of 1520	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1520	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1520	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1520	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 1520 wrote to memory of 1360	1520	cmd.exe	net.exe
PID 1520 wrote to memory of 1360	1520	cmd.exe	net.exe
PID 1520 wrote to memory of 1360	1520	cmd.exe	net.exe
PID 1520 wrote to memory of 1360	1520	cmd.exe	net.exe
PID 1360 wrote to memory of 1372	1360	net.exe	net1.exe
PID 1360 wrote to memory of 1372	1360	net.exe	net1.exe
PID 1360 wrote to memory of 1372	1360	net.exe	net1.exe
PID 1360 wrote to memory of 1372	1360	net.exe	net1.exe
PID 868 wrote to memory of 1228	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1228	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1228	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1228	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 1228 wrote to memory of 1804	1228	cmd.exe	net.exe
PID 1228 wrote to memory of 1804	1228	cmd.exe	net.exe
PID 1228 wrote to memory of 1804	1228	cmd.exe	net.exe
PID 1228 wrote to memory of 1804	1228	cmd.exe	net.exe
PID 1804 wrote to memory of 1796	1804	net.exe	net1.exe
PID 1804 wrote to memory of 1796	1804	net.exe	net1.exe
PID 1804 wrote to memory of 1796	1804	net.exe	net1.exe
PID 1804 wrote to memory of 1796	1804	net.exe	net1.exe
PID 868 wrote to memory of 1824	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1824	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1824	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1824	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 1824 wrote to memory of 1832	1824	cmd.exe	net.exe
PID 1824 wrote to memory of 1832	1824	cmd.exe	net.exe
PID 1824 wrote to memory of 1832	1824	cmd.exe	net.exe
PID 1824 wrote to memory of 1832	1824	cmd.exe	net.exe
PID 1832 wrote to memory of 1848	1832	net.exe	net1.exe
PID 1832 wrote to memory of 1848	1832	net.exe	net1.exe
PID 1832 wrote to memory of 1848	1832	net.exe	net1.exe
PID 1832 wrote to memory of 1848	1832	net.exe	net1.exe
PID 868 wrote to memory of 1864	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1864	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1864	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1864	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 1864 wrote to memory of 1872	1864	cmd.exe	net.exe
PID 1864 wrote to memory of 1872	1864	cmd.exe	net.exe
PID 1864 wrote to memory of 1872	1864	cmd.exe	net.exe
PID 1864 wrote to memory of 1872	1864	cmd.exe	net.exe
PID 1872 wrote to memory of 1888	1872	net.exe	net1.exe
PID 1872 wrote to memory of 1888	1872	net.exe	net1.exe
PID 1872 wrote to memory of 1888	1872	net.exe	net1.exe
PID 1872 wrote to memory of 1888	1872	net.exe	net1.exe
PID 868 wrote to memory of 1884	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1884	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1884	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe
PID 868 wrote to memory of 1884	868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe

pid	process
868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
868	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe

NTFS ADS 6 IoCs

Processes:

7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe

description	ioc	process
File opened for modification	C:\ProgramData\Application Data\Updater6\ꞔ痳"쀀\ꞔ痳:쀀\ꞔ痳:쀀	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Desktop\Updater6\ꞔ痳"쀀\ꞔ痳:쀀\ꞔ痳:쀀	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Documents\Updater6\ꞔ痳"쀀\ꞔ痳:쀀\ꞔ痳:쀀	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Favorites\Updater6\ꞔ痳"쀀\ꞔ痳:쀀\ꞔ痳:쀀	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Application Data\Updater6\"쀀椀<椀<ꨚ痳\:쀀踘8踘8ꨚ痳\:쀀踸8踸8ꨚ痳\3쀀ꡰ;ꡰ;ꨚ痳\3쀀꠰;꠰;ꨚ痳\3쀀11ꨚ痳\3쀀11ꨚ痳\3쀀11ꨚ痳\3쀀11ꨚ痳\3쀀輸8輸8ꨚ痳\3쀀轘8轘8ꨚ痳\3쀀11ꨚ痳\3쀀11ꨚ痳\3쀀11ꨚ痳\3쀀11ꨚ痳\3쀀掐9	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Documents and Settings\S-1-5-21-910373003-3952921535-3480519689-1000\ꞔ痳"쀀\ꞔ痳:쀀	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 3 http://www.sfml-dev.org/ip-provider.php

description	flow	ioc
HTTP URL	3	http://www.sfml-dev.org/ip-provider.php

Drops file in Program Files directory 17841 IoCs

Processes:

7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0302953.JPG	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter.png	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid_over.gif	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\Notebook03.onepkg	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Trek.xml	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\en-US\msdaremr.dll.mui	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Java\jre7\bin\jp2ssv.dll.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\GR8GALRY.GRA.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-3.png	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\OUTLLIBR.REST.IDX_DLL	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\messageboxinfo.ico	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Amman.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\DEEPBLUE.ELM.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107500.WMF	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME04.CSS	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGMASTHD.DPV.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\POWERPNT.HXS.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382967.JPG	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PROOF\1033\MSGR3EN.DLL.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02024_.WMF	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\info.png	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\jsprofilerui.dll	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCHDRESN.CFG	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SAVE.GIF	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIcons.jpg	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\42.png	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099164.WMF	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382969.JPG	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR36F.GIF	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\LABEL.DPV.[Hichkasam@protonmail.com][ID-Y5FWCETUN4OP8GI].Void	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe

Runs net.exe

Modifies service 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

netsh.exenetsh.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig	netsh.exe

Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
ransomware ouroboros

Drops desktop.ini file(s) 21 IoCs

Processes:

7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-910373003-3952921535-3480519689-1000\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\$Recycle.Bin\S-1-5-21-910373003-3952921535-3480519689-1000\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File created	C:\Program Files\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe

C:\Users\Admin\AppData\Local\Temp\7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
"C:\Users\Admin\AppData\Local\Temp\7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- NTFS ADS
- Drops file in Program Files directory
- Drops desktop.ini file(s)
PID:868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop SQLWriter
2⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\net.exe
net stop SQLWriter
3⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter
4⤵
PID:1532

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop SQLBrowser
2⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser
3⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser
4⤵
PID:1372

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
2⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER
3⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER
4⤵
PID:1796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
2⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\net.exe
net stop MSSQL$CONTOSO1
3⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$CONTOSO1
4⤵
PID:1848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop MSDTC
2⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\net.exe
net stop MSDTC
3⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSDTC
4⤵
PID:1888

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
2⤵
PID:1884

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
2⤵
PID:1764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
2⤵
PID:756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
2⤵
PID:1200

C:\Windows\SysWOW64\net.exe
net stop SQLSERVERAGENT
3⤵
PID:564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT
4⤵
PID:1516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
2⤵
PID:1324

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER
3⤵
PID:812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER
4⤵
PID:1740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop vds
2⤵
PID:1620

C:\Windows\SysWOW64\net.exe
net stop vds
3⤵
PID:1600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop vds
4⤵
PID:1592

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
2⤵
PID:1632

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall set currentprofile state off
3⤵
- Modifies service
PID:1560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
2⤵
PID:1932

C:\Windows\SysWOW64\netsh.exe
netsh firewall set opmode mode=disable
3⤵
- Modifies service
PID:1924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-0-0x0000000000BF0000-0x0000000000C01000-memory.dmp

Filesize
68KB

Download
memory/868-1-0x00000000011C0000-0x00000000011D1000-memory.dmp

Filesize
68KB

Download
memory/868-2-0x0000000000BF0000-0x0000000000C01000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads