Resubmissions
13-04-2021 15:20
210413-erpdk5746n 1007-04-2021 20:23
210407-3w1xnp3sxx 1030-03-2021 12:44
210330-rxae2gpzkn 1015-03-2021 03:56
210315-v77jkyypdj 1012-03-2021 14:39
210312-v91t4rfeva 1009-03-2021 16:31
210309-jarv33yz26 1008-03-2021 18:16
210308-nb95m4v9c6 1004-03-2021 16:33
210304-wah1ytdaa6 1004-03-2021 15:26
210304-v2jw3mqwkj 1003-03-2021 02:26
210303-eg4g1z4wd2 10Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows10_x64 -
resource
win10 -
submitted
18-06-2020 14:22
Static task
static1
Behavioral task
behavioral1
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10
General
-
Target
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
-
Size
3.4MB
-
MD5
84c82835a5d21bbcf75a61706d8ab549
-
SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
-
SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Signatures
-
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
vssvc.exeWMIC.exetaskse.exetaskse.exetaskse.exetaskse.exedescription pid process Token: SeBackupPrivilege 3896 vssvc.exe Token: SeRestorePrivilege 3896 vssvc.exe Token: SeAuditPrivilege 3896 vssvc.exe Token: SeIncreaseQuotaPrivilege 580 WMIC.exe Token: SeSecurityPrivilege 580 WMIC.exe Token: SeTakeOwnershipPrivilege 580 WMIC.exe Token: SeLoadDriverPrivilege 580 WMIC.exe Token: SeSystemProfilePrivilege 580 WMIC.exe Token: SeSystemtimePrivilege 580 WMIC.exe Token: SeProfSingleProcessPrivilege 580 WMIC.exe Token: SeIncBasePriorityPrivilege 580 WMIC.exe Token: SeCreatePagefilePrivilege 580 WMIC.exe Token: SeBackupPrivilege 580 WMIC.exe Token: SeRestorePrivilege 580 WMIC.exe Token: SeShutdownPrivilege 580 WMIC.exe Token: SeDebugPrivilege 580 WMIC.exe Token: SeSystemEnvironmentPrivilege 580 WMIC.exe Token: SeRemoteShutdownPrivilege 580 WMIC.exe Token: SeUndockPrivilege 580 WMIC.exe Token: SeManageVolumePrivilege 580 WMIC.exe Token: 33 580 WMIC.exe Token: 34 580 WMIC.exe Token: 35 580 WMIC.exe Token: 36 580 WMIC.exe Token: SeIncreaseQuotaPrivilege 580 WMIC.exe Token: SeSecurityPrivilege 580 WMIC.exe Token: SeTakeOwnershipPrivilege 580 WMIC.exe Token: SeLoadDriverPrivilege 580 WMIC.exe Token: SeSystemProfilePrivilege 580 WMIC.exe Token: SeSystemtimePrivilege 580 WMIC.exe Token: SeProfSingleProcessPrivilege 580 WMIC.exe Token: SeIncBasePriorityPrivilege 580 WMIC.exe Token: SeCreatePagefilePrivilege 580 WMIC.exe Token: SeBackupPrivilege 580 WMIC.exe Token: SeRestorePrivilege 580 WMIC.exe Token: SeShutdownPrivilege 580 WMIC.exe Token: SeDebugPrivilege 580 WMIC.exe Token: SeSystemEnvironmentPrivilege 580 WMIC.exe Token: SeRemoteShutdownPrivilege 580 WMIC.exe Token: SeUndockPrivilege 580 WMIC.exe Token: SeManageVolumePrivilege 580 WMIC.exe Token: 33 580 WMIC.exe Token: 34 580 WMIC.exe Token: 35 580 WMIC.exe Token: 36 580 WMIC.exe Token: SeTcbPrivilege 1864 taskse.exe Token: SeTcbPrivilege 1864 taskse.exe Token: SeTcbPrivilege 1632 taskse.exe Token: SeTcbPrivilege 1632 taskse.exe Token: SeTcbPrivilege 1392 taskse.exe Token: SeTcbPrivilege 1392 taskse.exe Token: SeTcbPrivilege 1012 taskse.exe Token: SeTcbPrivilege 1012 taskse.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Modifies registry class 57 IoCs
Processes:
notepad.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80922b16d365937a46956b92703aca08af0000 notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff notepad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000b2917fe1d243d601892e23e3d243d6014ea519e3d243d60114000000 notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 notepad.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 notepad.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
taskhsvc.exepid process 3844 taskhsvc.exe 3844 taskhsvc.exe 3844 taskhsvc.exe 3844 taskhsvc.exe 3844 taskhsvc.exe 3844 taskhsvc.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe@[email protected]description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] -
Loads dropped DLL 7 IoCs
Processes:
taskhsvc.exepid process 3844 taskhsvc.exe 3844 taskhsvc.exe 3844 taskhsvc.exe 3844 taskhsvc.exe 3844 taskhsvc.exe 3844 taskhsvc.exe 3844 taskhsvc.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies service 2 TTPs 4 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Executes dropped EXE 16 IoCs
Processes:
taskdl.exe@[email protected]@[email protected]taskhsvc.exetaskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskse.exe@[email protected]taskdl.exepid process 3416 taskdl.exe 3868 @[email protected] 424 @[email protected] 3844 taskhsvc.exe 1152 taskdl.exe 1864 taskse.exe 1196 @[email protected] 1404 taskdl.exe 1632 taskse.exe 1488 @[email protected] 1972 taskdl.exe 1392 taskse.exe 2544 @[email protected] 1012 taskse.exe 2600 @[email protected] 3056 taskdl.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
pid process 3868 @[email protected] 424 @[email protected] 424 @[email protected] 3868 @[email protected] 1196 @[email protected] 1196 @[email protected] 1488 @[email protected] 3888 notepad.exe 2544 @[email protected] 2600 @[email protected] -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops startup file 2 IoCs
Processes:
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD61C.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD623.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3816 vssadmin.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pajxwiyyl178 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" reg.exe -
Suspicious use of WriteProcessMemory 78 IoCs
Processes:
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.execmd.execmd.exe@[email protected]@[email protected]cmd.execmd.exedescription pid process target process PID 3588 wrote to memory of 3028 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe attrib.exe PID 3588 wrote to memory of 3028 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe attrib.exe PID 3588 wrote to memory of 3028 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe attrib.exe PID 3588 wrote to memory of 3828 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe icacls.exe PID 3588 wrote to memory of 3828 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe icacls.exe PID 3588 wrote to memory of 3828 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe icacls.exe PID 3588 wrote to memory of 3416 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 3416 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 3416 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 3980 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 3588 wrote to memory of 3980 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 3588 wrote to memory of 3980 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 3980 wrote to memory of 3012 3980 cmd.exe cscript.exe PID 3980 wrote to memory of 3012 3980 cmd.exe cscript.exe PID 3980 wrote to memory of 3012 3980 cmd.exe cscript.exe PID 3588 wrote to memory of 3868 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @[email protected] PID 3588 wrote to memory of 3868 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @[email protected] PID 3588 wrote to memory of 3868 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @[email protected] PID 3588 wrote to memory of 3816 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 3588 wrote to memory of 3816 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 3588 wrote to memory of 3816 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 3816 wrote to memory of 424 3816 cmd.exe @[email protected] PID 3816 wrote to memory of 424 3816 cmd.exe @[email protected] PID 3816 wrote to memory of 424 3816 cmd.exe @[email protected] PID 3868 wrote to memory of 3844 3868 @[email protected] taskhsvc.exe PID 3868 wrote to memory of 3844 3868 @[email protected] taskhsvc.exe PID 3868 wrote to memory of 3844 3868 @[email protected] taskhsvc.exe PID 424 wrote to memory of 4084 424 @[email protected] cmd.exe PID 424 wrote to memory of 4084 424 @[email protected] cmd.exe PID 424 wrote to memory of 4084 424 @[email protected] cmd.exe PID 4084 wrote to memory of 3816 4084 cmd.exe vssadmin.exe PID 4084 wrote to memory of 3816 4084 cmd.exe vssadmin.exe PID 4084 wrote to memory of 3816 4084 cmd.exe vssadmin.exe PID 4084 wrote to memory of 580 4084 cmd.exe WMIC.exe PID 4084 wrote to memory of 580 4084 cmd.exe WMIC.exe PID 4084 wrote to memory of 580 4084 cmd.exe WMIC.exe PID 3588 wrote to memory of 1152 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 1152 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 1152 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 1864 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 3588 wrote to memory of 1864 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 3588 wrote to memory of 1864 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 3588 wrote to memory of 1196 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @[email protected] PID 3588 wrote to memory of 1196 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @[email protected] PID 3588 wrote to memory of 1196 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @[email protected] PID 3588 wrote to memory of 4036 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 3588 wrote to memory of 4036 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 3588 wrote to memory of 4036 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 4036 wrote to memory of 1632 4036 cmd.exe reg.exe PID 4036 wrote to memory of 1632 4036 cmd.exe reg.exe PID 4036 wrote to memory of 1632 4036 cmd.exe reg.exe PID 3588 wrote to memory of 1404 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 1404 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 1404 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 1632 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 3588 wrote to memory of 1632 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 3588 wrote to memory of 1632 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 3588 wrote to memory of 1488 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @[email protected] PID 3588 wrote to memory of 1488 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @[email protected] PID 3588 wrote to memory of 1488 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @[email protected] PID 3588 wrote to memory of 1972 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 1972 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 1972 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 3588 wrote to memory of 1392 3588 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"1⤵
- Sets desktop wallpaper using registry
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
PID:3028 -
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 104351592490150.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Executes dropped EXE
PID:3844 -
C:\Windows\SysWOW64\cmd.exePID:3816
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:3816 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:580 -
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Sets desktop wallpaper using registry
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1196 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "pajxwiyyl178" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "pajxwiyyl178" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Modifies registry key
- Adds Run entry to start application
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1488
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2544
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2600
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3056
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:3896
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3888
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
-
C:\Users\Admin\Desktop\@[email protected]