Analysis
-
max time kernel
91s -
max time network
95s -
platform
windows10_x64 -
resource
win10 -
submitted
21-08-2020 01:12
Static task
static1
Behavioral task
behavioral1
Sample
57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe
Resource
win10
General
-
Target
57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe
-
Size
6.0MB
-
MD5
ce305d1041a5d6068660ea08df86bedd
-
SHA1
3a233709f22db2e63f41c9f095bc1bc3e1e6932d
-
SHA256
57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd
-
SHA512
7221c97f14f5c25f7f2a04b2538c74d43f545ee1d422f1001ff70fc0e25d9942582a8f8884cfac40e5147c9c93b89842d1899c3a497290f37e33e4cb432de229
Malware Config
Extracted
C:\756EBE-Readme.txt
mailto_hamlampampom
Extracted
C:\Users\Admin\Desktop\756EBE-Readme.txt
mailto_hamlampampom
Extracted
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\756EBE-Readme.txt
mailto_hamlampampom
Extracted
C:\Program Files\756EBE-Readme.txt
mailto_hamlampampom
Extracted
C:\Program Files\Java\jdk1.8.0_66\756EBE-Readme.txt
mailto_hamlampampom
Signatures
-
MailTo (Hamlampampom Variant)
Ransomware family discovered in late 2019 with variants named based on contact emails.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exedescription ioc process File renamed C:\Users\Admin\Pictures\EnterUnblock.tiff => C:\Users\Admin\Pictures\EnterUnblock.tiff.756ebe 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File renamed C:\Users\Admin\Pictures\OutExport.tif => C:\Users\Admin\Pictures\OutExport.tif.756ebe 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Users\Admin\Pictures\EnterUnblock.tiff 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File renamed C:\Users\Admin\Pictures\UnprotectCompress.tif => C:\Users\Admin\Pictures\UnprotectCompress.tif.756ebe 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File renamed C:\Users\Admin\Pictures\SwitchProtect.tif => C:\Users\Admin\Pictures\SwitchProtect.tif.756ebe 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exepid process 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe -
Drops file in Program Files directory 17084 IoCs
Processes:
57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\ECLIPSE.ELM 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-60.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Microsoft.Apps.Messaging.Base.winmd 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-20.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\ui-strings.js 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File created C:\Program Files (x86)\Google\Chrome\Application\SetupMetrics\756EBE-Readme.txt 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\jscripts\winrthost.js 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Bark.dxt 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\PREVIEW.GIF 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\WideTile.scale-200.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\vi.pak 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Xaml.Toolkit\Assets\CardsLoadingSpritesheet.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7260_32x32x32.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\WideTile.scale-125.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\4px.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\ui-strings.js 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerMedTile.contrast-black_scale-125.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\6536_24x24x32.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-32.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-unplated_contrast-white.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main-selector.css 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\12.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\models\de-DE.mail.config 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\FreeCell\Goal_5.jpg 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\en_GB.dic 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\CoreEngine\Data\3DBrush\round.mtl 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\dz_60x42.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\WorldClockSmallTile.contrast-white_scale-200.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\ui-strings.js 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\756EBE-Readme.txt 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\756EBE-Readme.txt 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.dualsim1.smile.small.scale-200.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\ui-strings.js 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\crying.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\756EBE-Readme.txt 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchLargeTile.scale-125.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1250_72x72x32.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\756EBE-Readme.txt 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\40.jpg 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\PlaneCutKeepBoth.scale-140.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ck_60x42.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteWideTile.scale-150.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_altform-unplated_contrast-high.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\LargeTile.scale-100_contrast-black.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\added.txt 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1251_20x20x32.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Livetiles\MicrosoftSolitaireAppList.targetsize-24_altform-unplated.png 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\ui-strings.js 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\AppStore_icon.svg 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3852 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4784 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 17799 IoCs
Processes:
57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exepid process 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe Token: SeImpersonatePrivilege 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe Token: SeBackupPrivilege 3744 vssvc.exe Token: SeRestorePrivilege 3744 vssvc.exe Token: SeAuditPrivilege 3744 vssvc.exe Token: SeDebugPrivilege 4784 taskkill.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.execmd.exedescription pid process target process PID 4016 wrote to memory of 3852 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe vssadmin.exe PID 4016 wrote to memory of 3852 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe vssadmin.exe PID 4016 wrote to memory of 4368 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe notepad.exe PID 4016 wrote to memory of 4368 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe notepad.exe PID 4016 wrote to memory of 4368 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe notepad.exe PID 4016 wrote to memory of 8420 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe cmd.exe PID 4016 wrote to memory of 8420 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe cmd.exe PID 4016 wrote to memory of 8420 4016 57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe cmd.exe PID 8420 wrote to memory of 4784 8420 cmd.exe taskkill.exe PID 8420 wrote to memory of 4784 8420 cmd.exe taskkill.exe PID 8420 wrote to memory of 4784 8420 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe"C:\Users\Admin\AppData\Local\Temp\57cf4470348e3b5da0fa3152be84a81a5e2ce5d794976387be290f528fa419fd.bin.exe"1⤵
- Modifies extensions of user files
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3852
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\756EBE-Readme.txt"2⤵PID:4368
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24B4.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:8420 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 40163⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4784
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:3744