Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows10_x64 -
resource
win10 -
submitted
18-06-2020 23:20
Static task
static1
Behavioral task
behavioral1
Sample
cfd2d6f189b04d42618007fc9c540352.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
cfd2d6f189b04d42618007fc9c540352.exe
Resource
win10
General
-
Target
cfd2d6f189b04d42618007fc9c540352.exe
-
Size
252KB
-
MD5
cfd2d6f189b04d42618007fc9c540352
-
SHA1
f8413a21c4179378b2c23a3302ba33505e273430
-
SHA256
408fd7edadfbdaab161e04afcfc115c464916e99aaba8b036f52c57c3ade49c5
-
SHA512
5a1917dd23aa02e273ba0fc381961ed7fab4dc70202f62a581b6361c4d34b7ce51b3f3adf61d9dec8ab49b4667573f7755f2a968a836d10d1afbadab598a6cc0
Malware Config
Extracted
\??\c:\_R_E_A_D___T_H_I_S___GMBN0QUJ_.txt
cerber
http://xpcx6erilkjced3j.onion/7D55-E5DE-1676-0446-A3F4
http://xpcx6erilkjced3j.18ey8e.top/7D55-E5DE-1676-0446-A3F4
http://xpcx6erilkjced3j.17gcun.top/7D55-E5DE-1676-0446-A3F4
http://xpcx6erilkjced3j.1ebjjq.top/7D55-E5DE-1676-0446-A3F4
http://xpcx6erilkjced3j.15ezkm.top/7D55-E5DE-1676-0446-A3F4
http://xpcx6erilkjced3j.1mfmkz.top/7D55-E5DE-1676-0446-A3F4
Signatures
-
Blacklisted process makes network request 8 IoCs
flow pid Process 2180 3840 mshta.exe 2183 3840 mshta.exe 2185 3840 mshta.exe 2187 3840 mshta.exe 2189 3840 mshta.exe 2191 3840 mshta.exe 2193 3840 mshta.exe 2195 3840 mshta.exe -
Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings cfd2d6f189b04d42618007fc9c540352.exe -
Enumerates connected drives 3 TTPs
-
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files\ cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\ cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\word cfd2d6f189b04d42618007fc9c540352.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ cfd2d6f189b04d42618007fc9c540352.exe -
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpB522.bmp" cfd2d6f189b04d42618007fc9c540352.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1308 PING.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3920 wrote to memory of 3972 3920 cfd2d6f189b04d42618007fc9c540352.exe 67 PID 3920 wrote to memory of 3972 3920 cfd2d6f189b04d42618007fc9c540352.exe 67 PID 3920 wrote to memory of 3972 3920 cfd2d6f189b04d42618007fc9c540352.exe 67 PID 3920 wrote to memory of 4048 3920 cfd2d6f189b04d42618007fc9c540352.exe 69 PID 3920 wrote to memory of 4048 3920 cfd2d6f189b04d42618007fc9c540352.exe 69 PID 3920 wrote to memory of 4048 3920 cfd2d6f189b04d42618007fc9c540352.exe 69 PID 3920 wrote to memory of 3840 3920 cfd2d6f189b04d42618007fc9c540352.exe 72 PID 3920 wrote to memory of 3840 3920 cfd2d6f189b04d42618007fc9c540352.exe 72 PID 3920 wrote to memory of 3840 3920 cfd2d6f189b04d42618007fc9c540352.exe 72 PID 3920 wrote to memory of 2068 3920 cfd2d6f189b04d42618007fc9c540352.exe 73 PID 3920 wrote to memory of 2068 3920 cfd2d6f189b04d42618007fc9c540352.exe 73 PID 3920 wrote to memory of 2068 3920 cfd2d6f189b04d42618007fc9c540352.exe 73 PID 3920 wrote to memory of 3516 3920 cfd2d6f189b04d42618007fc9c540352.exe 74 PID 3920 wrote to memory of 3516 3920 cfd2d6f189b04d42618007fc9c540352.exe 74 PID 3920 wrote to memory of 3516 3920 cfd2d6f189b04d42618007fc9c540352.exe 74 PID 3516 wrote to memory of 3376 3516 cmd.exe 76 PID 3516 wrote to memory of 3376 3516 cmd.exe 76 PID 3516 wrote to memory of 3376 3516 cmd.exe 76 PID 3516 wrote to memory of 1308 3516 cmd.exe 78 PID 3516 wrote to memory of 1308 3516 cmd.exe 78 PID 3516 wrote to memory of 1308 3516 cmd.exe 78 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 3920 cfd2d6f189b04d42618007fc9c540352.exe Token: SeCreatePagefilePrivilege 3920 cfd2d6f189b04d42618007fc9c540352.exe Token: SeDebugPrivilege 3376 taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 3376 taskkill.exe -
Modifies Windows Firewall 1 TTPs
-
Drops file in Windows directory 77 IoCs
description ioc Process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\ cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel cfd2d6f189b04d42618007fc9c540352.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2068 NOTEPAD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfd2d6f189b04d42618007fc9c540352.exe"C:\Users\Admin\AppData\Local\Temp\cfd2d6f189b04d42618007fc9c540352.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Drops file in Program Files directory
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Drops file in Windows directory
PID:3920 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵PID:3972
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵PID:4048
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___J0LBLG_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Blacklisted process makes network request
PID:3840
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___OJ3YZ_.txt2⤵
- Opens file in notepad (likely ransom note)
PID:2068
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "c" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "c"3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:3376
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:1308
-
-