Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 17:15
Static task
static1
Behavioral task
behavioral1
Sample
6a1s0ssssd7da.exe
Resource
win7
Behavioral task
behavioral2
Sample
6a1s0ssssd7da.exe
Resource
win10
General
-
Target
6a1s0ssssd7da.exe
-
Size
717KB
-
MD5
ae1941234e5d7a3402e5f10432b2cf44
-
SHA1
7b817fa8a163e3450d7122c6fc7ad92e93000986
-
SHA256
d4d432c94d69e9a57f473c042f53abc181aa8919981206a3714201f429c19b44
-
SHA512
2a19cfc3a6d8c612bcb90c95bc21ee9dea18f4d3d9e66c89cff342d377107e44263a63c074a2e418a2ea617518f74f3a09f6a971b8126777fce30bbc68d52be7
Malware Config
Extracted
\??\M:\Boot\cs-CZ\Read_Me.txt
http://7rzpyw3hflwe2c7h.onion/?VVVVVVVV
http://helpqvrg3cc5mvb3.onion/
Signatures
-
Drops startup file 1 IoCs
Processes:
6a1s0ssssd7da.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Read_Me.txt 6a1s0ssssd7da.exe -
Modifies registry class 20 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Drops file in Program Files directory 12071 IoCs
Processes:
6a1s0ssssd7da.exedescription ioc process File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\WidevineCdm\_platform_specific\Read_Me.txt 6a1s0ssssd7da.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 6a1s0ssssd7da.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01931J.JPG 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPrintTemplate.html 6a1s0ssssd7da.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AUDIOSEARCHMAIN.DLL 6a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo 6a1s0ssssd7da.exe File created C:\Program Files (x86)\Google\Temp\Read_Me.txt 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 6a1s0ssssd7da.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF 6a1s0ssssd7da.exe File created C:\Program Files\Windows Journal\Templates\Read_Me.txt 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\default_apps\drive.crx 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL.DEV_K_COL.HXK 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_VelvetRose.gif 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mscss7es.dll 6a1s0ssssd7da.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png 6a1s0ssssd7da.exe File created C:\Program Files\Java\jre7\bin\server\Read_Me.txt 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105240.WMF 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN048.XML 6a1s0ssssd7da.exe File created C:\Program Files\Windows Media Player\Network Sharing\Read_Me.txt 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\mip.exe.mui 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png 6a1s0ssssd7da.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate.css 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEB11.POC 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar 6a1s0ssssd7da.exe File created C:\Program Files\Java\jre7\lib\images\Read_Me.txt 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pt-PT.dll 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)greenStateIcon.png 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\33.png 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01293_.GIF 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Mozilla Firefox\AccessibleHandler.dll 6a1s0ssssd7da.exe File created C:\Program Files (x86)\Google\Update\Install\Read_Me.txt 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\en-US\msadcor.dll.mui 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Chita 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152876.WMF 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\REMOTES.ICO 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGCOUPON.XML 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PNCTUATE.POC 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLWVW.DLL 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Style\APA.XSL 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter_partly-cloudy.png 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ReviewRouting_Init.xsn 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\SectionHeading.jpg 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous.png 6a1s0ssssd7da.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png 6a1s0ssssd7da.exe File created C:\Program Files\Java\jre7\lib\jfr\Read_Me.txt 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SAFRI_01.MID 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_thunderstorm.png 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_de.dll 6a1s0ssssd7da.exe -
Modifies service 2 TTPs 4 IoCs
Processes:
explorer.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exedescription pid process Token: SeShutdownPrivilege 1688 explorer.exe Token: SeShutdownPrivilege 1688 explorer.exe Token: SeShutdownPrivilege 1688 explorer.exe Token: SeShutdownPrivilege 1688 explorer.exe Token: SeShutdownPrivilege 1688 explorer.exe Token: SeShutdownPrivilege 1688 explorer.exe Token: SeShutdownPrivilege 1688 explorer.exe Token: SeShutdownPrivilege 1688 explorer.exe Token: SeShutdownPrivilege 1688 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 756 explorer.exe Token: SeShutdownPrivilege 756 explorer.exe Token: SeShutdownPrivilege 756 explorer.exe Token: SeShutdownPrivilege 756 explorer.exe Token: SeShutdownPrivilege 756 explorer.exe Token: SeShutdownPrivilege 756 explorer.exe Token: SeShutdownPrivilege 756 explorer.exe Token: SeShutdownPrivilege 756 explorer.exe Token: SeShutdownPrivilege 756 explorer.exe Token: SeShutdownPrivilege 756 explorer.exe Token: SeShutdownPrivilege 1328 explorer.exe Token: SeShutdownPrivilege 1328 explorer.exe Token: SeShutdownPrivilege 1328 explorer.exe Token: SeShutdownPrivilege 1328 explorer.exe Token: SeShutdownPrivilege 1328 explorer.exe Token: SeShutdownPrivilege 1328 explorer.exe Token: SeShutdownPrivilege 1328 explorer.exe Token: SeShutdownPrivilege 1328 explorer.exe Token: SeShutdownPrivilege 1328 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exepid process 1688 explorer.exe 756 explorer.exe 1328 explorer.exe -
Drops desktop.ini file(s) 41 IoCs
Processes:
6a1s0ssssd7da.exeexplorer.exedescription ioc process File opened for modification C:\Users\Public\Libraries\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\Videos\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 6a1s0ssssd7da.exe File opened for modification \??\M:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini explorer.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\Music\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Links\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Program Files\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\Documents\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 6a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Music\desktop.ini 6a1s0ssssd7da.exe -
Enumerates connected drives 3 TTPs
-
Suspicious behavior: EnumeratesProcesses 4528 IoCs
Processes:
6a1s0ssssd7da.exepid process 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe 1464 6a1s0ssssd7da.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Suspicious use of FindShellTrayWindow 83 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exepid process 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 1328 explorer.exe 1328 explorer.exe 1328 explorer.exe 1328 explorer.exe 1328 explorer.exe 1328 explorer.exe -
Suspicious use of SendNotifyMessage 98 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exepid process 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 1688 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe 756 explorer.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
6a1s0ssssd7da.exedescription pid process target process PID 1124 wrote to memory of 1464 1124 6a1s0ssssd7da.exe 6a1s0ssssd7da.exe PID 1124 wrote to memory of 1464 1124 6a1s0ssssd7da.exe 6a1s0ssssd7da.exe PID 1124 wrote to memory of 1464 1124 6a1s0ssssd7da.exe 6a1s0ssssd7da.exe PID 1124 wrote to memory of 1464 1124 6a1s0ssssd7da.exe 6a1s0ssssd7da.exe PID 1124 wrote to memory of 1464 1124 6a1s0ssssd7da.exe 6a1s0ssssd7da.exe PID 1124 wrote to memory of 1464 1124 6a1s0ssssd7da.exe 6a1s0ssssd7da.exe PID 1124 wrote to memory of 1464 1124 6a1s0ssssd7da.exe 6a1s0ssssd7da.exe PID 1124 wrote to memory of 1464 1124 6a1s0ssssd7da.exe 6a1s0ssssd7da.exe PID 1124 wrote to memory of 1464 1124 6a1s0ssssd7da.exe 6a1s0ssssd7da.exe PID 1124 wrote to memory of 1464 1124 6a1s0ssssd7da.exe 6a1s0ssssd7da.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6a1s0ssssd7da.exedescription pid process target process PID 1124 set thread context of 1464 1124 6a1s0ssssd7da.exe 6a1s0ssssd7da.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a1s0ssssd7da.exe"C:\Users\Admin\AppData\Local\Temp\6a1s0ssssd7da.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\6a1s0ssssd7da.exe"{path}"2⤵
- Drops startup file
- Drops file in Program Files directory
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Modifies service
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: GetForegroundWindowSpam
- Drops desktop.ini file(s)
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: GetForegroundWindowSpam
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Modifies service
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: GetForegroundWindowSpam
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\Read_Me.txt
-
C:\Users\Admin\Desktop\AddClose.pot.readme
-
C:\Users\Admin\Desktop\CloseSkip.eps.readme
-
C:\Users\Admin\Desktop\CompleteAdd.kix.readme
-
C:\Users\Admin\Desktop\ConvertLock.bat.readme
-
C:\Users\Admin\Desktop\DebugEnable.rtf.readme
-
C:\Users\Admin\Desktop\DisableUnprotect.pub.readme
-
C:\Users\Admin\Desktop\EnterRemove.midi.readme
-
C:\Users\Admin\Desktop\ExportCheckpoint.wma.readme
-
C:\Users\Admin\Desktop\ExportRestart.dib.readme
-
C:\Users\Admin\Desktop\ExportWait.docx.readme
-
C:\Users\Admin\Desktop\FindRedo.au.readme
-
C:\Users\Admin\Desktop\FormatComplete.php.readme
-
C:\Users\Admin\Desktop\FormatPing.jpeg.readme
-
C:\Users\Admin\Desktop\MergeGet.pptx.readme
-
C:\Users\Admin\Desktop\MountNew.cfg.readme
-
C:\Users\Admin\Desktop\OutDisable.7z.readme
-
C:\Users\Admin\Desktop\PushStop.midi.readme
-
C:\Users\Admin\Desktop\Read_Me.txt
-
C:\Users\Admin\Desktop\RedoUnprotect.docx.readme
-
C:\Users\Admin\Desktop\RemoveUnblock.zip.readme
-
C:\Users\Admin\Desktop\RenameAssert.3gpp.readme
-
C:\Users\Admin\Desktop\RenameSync.3gp2.readme
-
C:\Users\Admin\Desktop\RevokeOptimize.i64.readme
-
C:\Users\Admin\Desktop\SendUnprotect.asx.readme
-
C:\Users\Admin\Desktop\TestRepair.gif.readme
-
C:\Users\Admin\Desktop\UndoProtect.mpeg2.readme
-
C:\Users\Admin\Desktop\UnregisterStep.snd.readme
-
C:\Users\Admin\Desktop\UpdateEnter.jtx.readme
-
C:\Users\Admin\Desktop\UseTest.potx.readme
-
C:\Users\Admin\Desktop\desktop.ini.readme
-
C:\Users\Public\Desktop\Adobe Reader 9.lnk.readme
-
C:\Users\Public\Desktop\Firefox.lnk.readme
-
C:\Users\Public\Desktop\Google Chrome.lnk.readme
-
C:\Users\Public\Desktop\Read_Me.txt
-
C:\Users\Public\Desktop\VLC media player.lnk.readme
-
C:\Users\Public\Desktop\desktop.ini.readme
-
\??\M:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini
-
memory/756-9-0x00000000037D0000-0x00000000037D1000-memory.dmpFilesize
4KB
-
memory/1464-2-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1464-0-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1464-1-0x0000000000407CA0-mapping.dmp
-
memory/1688-3-0x00000000042A0000-0x00000000042A1000-memory.dmpFilesize
4KB