ouroboros | a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461

General

Target

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
Size

994KB
MD5

62ae12ef05bb6ad38cf30d8c35efd416
SHA1

90049acd442225de16124a89835eed61f4202a8b
SHA256

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461
SHA512

0114ca7c03291783732a2cbcbbbc4f6a2250c3ad41aaa415be6e85aa28daad85b668f4f0177357c3fdf1c861830bb8b24d378390de7736a57660182ac3c3709a

Score

10^/10

ouroboros evasion ransomware

Malware Config

Signatures

Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
ransomware ouroboros
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops desktop.ini file(s) 8 IoCs

Processes:

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

description	ioc	process
File created	C:\$Recycle.Bin\S-1-5-21-1400429095-533421673-2598934218-1000\desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1400429095-533421673-2598934218-1000\desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description flow ioc

HTTP URL 9 http://www.sfml-dev.org/ip-provider.php

description	flow	ioc
HTTP URL	9	http://www.sfml-dev.org/ip-provider.php

Drops file in Program Files directory 64 IoCs

Processes:

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_filter_18.svg	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-white.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\XMLOffKeys\Keys_OffVerOOBE.xml	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\punch.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-30_altform-unplated.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\XMLOffKeys\Keys_OffVer365.xml	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-200.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated_contrast-black.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleLargeTile.scale-125.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\spider\Itsy_Bitsy_Spider_.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyLetter.dotx.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\StarClub\new_collection_available.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-48_altform-unplated.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\TXP_Package.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\Icon.targetsize-32.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\hm_60x42.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeWideTile.scale-400.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\Popup_shadow_3_2bp.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tournament\Awards.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Internet Explorer\sqmapi.dll	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_k_col.hxk	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\156.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\169.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-125.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msolui.dll	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\2.jpg	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\selector.js	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-black_scale-125.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\Attribution\holiday_weather.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\jdwp.dll.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right.gif	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSUIGHUB.TTF.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-text.jar.[VoidDeceryptor@tutanota.com][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

NTFS ADS 1 IoCs

Processes:

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

description	ioc	process
File opened for modification	C:\Documents and Settings\zh-TW\"쀀隚瘟\:쀀隚瘟\:쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\߿	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

pid	process
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	process	target process
PID 584 wrote to memory of 3836	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3836	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3836	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 3836 wrote to memory of 3492	3836	cmd.exe	net.exe
PID 3836 wrote to memory of 3492	3836	cmd.exe	net.exe
PID 3836 wrote to memory of 3492	3836	cmd.exe	net.exe
PID 3492 wrote to memory of 3332	3492	net.exe	net1.exe
PID 3492 wrote to memory of 3332	3492	net.exe	net1.exe
PID 3492 wrote to memory of 3332	3492	net.exe	net1.exe
PID 584 wrote to memory of 4056	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 4056	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 4056	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 4056 wrote to memory of 4012	4056	cmd.exe	net.exe
PID 4056 wrote to memory of 4012	4056	cmd.exe	net.exe
PID 4056 wrote to memory of 4012	4056	cmd.exe	net.exe
PID 4012 wrote to memory of 3720	4012	net.exe	net1.exe
PID 4012 wrote to memory of 3720	4012	net.exe	net1.exe
PID 4012 wrote to memory of 3720	4012	net.exe	net1.exe
PID 584 wrote to memory of 3904	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3904	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3904	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 3904 wrote to memory of 2512	3904	cmd.exe	net.exe
PID 3904 wrote to memory of 2512	3904	cmd.exe	net.exe
PID 3904 wrote to memory of 2512	3904	cmd.exe	net.exe
PID 2512 wrote to memory of 3932	2512	net.exe	net1.exe
PID 2512 wrote to memory of 3932	2512	net.exe	net1.exe
PID 2512 wrote to memory of 3932	2512	net.exe	net1.exe
PID 584 wrote to memory of 220	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 220	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 220	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 220 wrote to memory of 3956	220	cmd.exe	net.exe
PID 220 wrote to memory of 3956	220	cmd.exe	net.exe
PID 220 wrote to memory of 3956	220	cmd.exe	net.exe
PID 3956 wrote to memory of 944	3956	net.exe	net1.exe
PID 3956 wrote to memory of 944	3956	net.exe	net1.exe
PID 3956 wrote to memory of 944	3956	net.exe	net1.exe
PID 584 wrote to memory of 2416	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2416	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2416	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 2416 wrote to memory of 512	2416	cmd.exe	net.exe
PID 2416 wrote to memory of 512	2416	cmd.exe	net.exe
PID 2416 wrote to memory of 512	2416	cmd.exe	net.exe
PID 512 wrote to memory of 964	512	net.exe	net1.exe
PID 512 wrote to memory of 964	512	net.exe	net1.exe
PID 512 wrote to memory of 964	512	net.exe	net1.exe
PID 584 wrote to memory of 3396	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3396	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3396	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2224	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2224	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2224	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 856	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 856	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 856	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2080	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2080	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2080	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 2080 wrote to memory of 3772	2080	cmd.exe	net.exe
PID 2080 wrote to memory of 3772	2080	cmd.exe	net.exe
PID 2080 wrote to memory of 3772	2080	cmd.exe	net.exe
PID 3772 wrote to memory of 1664	3772	net.exe	net1.exe
PID 3772 wrote to memory of 1664	3772	net.exe	net1.exe
PID 3772 wrote to memory of 1664	3772	net.exe	net1.exe
PID 584 wrote to memory of 2576	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
"C:\Users\Admin\AppData\Local\Temp\a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop SQLWriter
2⤵
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\SysWOW64\net.exe
net stop SQLWriter
3⤵
- Suspicious use of WriteProcessMemory
PID:3492

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter
4⤵
PID:3332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop SQLBrowser
2⤵
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser
3⤵
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser
4⤵
PID:3720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
2⤵
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER
3⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER
4⤵
PID:3932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
2⤵
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\SysWOW64\net.exe
net stop MSSQL$CONTOSO1
3⤵
- Suspicious use of WriteProcessMemory
PID:3956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$CONTOSO1
4⤵
PID:944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop MSDTC
2⤵
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\net.exe
net stop MSDTC
3⤵
- Suspicious use of WriteProcessMemory
PID:512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSDTC
4⤵
PID:964

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
2⤵
PID:3396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
2⤵
PID:2224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
2⤵
PID:856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
2⤵
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\net.exe
net stop SQLSERVERAGENT
3⤵
- Suspicious use of WriteProcessMemory
PID:3772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT
4⤵
PID:1664

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
2⤵
PID:2576

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER
3⤵
PID:3800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER
4⤵
PID:3968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop vds
2⤵
PID:3036

C:\Windows\SysWOW64\net.exe
net stop vds
3⤵
PID:3028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop vds
4⤵
PID:3132

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
2⤵
PID:3992

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall set currentprofile state off
3⤵
PID:2688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
2⤵
PID:740

C:\Windows\SysWOW64\netsh.exe
netsh firewall set opmode mode=disable
3⤵
PID:1912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-9-0x0000000000000000-mapping.dmp

Download
memory/512-13-0x0000000000000000-mapping.dmp

Download
memory/584-40-0x0000000001930000-0x0000000001931000-memory.dmp

Filesize
4KB

Download
memory/584-37-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/584-33-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/584-32-0x0000000001930000-0x0000000001931000-memory.dmp

Filesize
4KB

Download
memory/584-31-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/584-41-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/584-48-0x0000000001930000-0x0000000001931000-memory.dmp

Filesize
4KB

Download
memory/740-29-0x0000000000000000-mapping.dmp

Download
memory/856-17-0x0000000000000000-mapping.dmp

Download
memory/944-11-0x0000000000000000-mapping.dmp

Download
memory/964-14-0x0000000000000000-mapping.dmp

Download
memory/1664-20-0x0000000000000000-mapping.dmp

Download
memory/1912-30-0x0000000000000000-mapping.dmp

Download
memory/2080-18-0x0000000000000000-mapping.dmp

Download
memory/2224-16-0x0000000000000000-mapping.dmp

Download
memory/2416-12-0x0000000000000000-mapping.dmp

Download
memory/2512-7-0x0000000000000000-mapping.dmp

Download
memory/2576-21-0x0000000000000000-mapping.dmp

Download
memory/2688-28-0x0000000000000000-mapping.dmp

Download
memory/3028-25-0x0000000000000000-mapping.dmp

Download
memory/3036-24-0x0000000000000000-mapping.dmp

Download
memory/3132-26-0x0000000000000000-mapping.dmp

Download
memory/3332-2-0x0000000000000000-mapping.dmp

Download
memory/3396-15-0x0000000000000000-mapping.dmp

Download
memory/3492-1-0x0000000000000000-mapping.dmp

Download
memory/3720-5-0x0000000000000000-mapping.dmp

Download
memory/3772-19-0x0000000000000000-mapping.dmp

Download
memory/3800-22-0x0000000000000000-mapping.dmp

Download
memory/3836-0-0x0000000000000000-mapping.dmp

Download
memory/3904-6-0x0000000000000000-mapping.dmp

Download
memory/3932-8-0x0000000000000000-mapping.dmp

Download
memory/3956-10-0x0000000000000000-mapping.dmp

Download
memory/3968-23-0x0000000000000000-mapping.dmp

Download
memory/3992-27-0x0000000000000000-mapping.dmp

Download
memory/4012-4-0x0000000000000000-mapping.dmp

Download
memory/4056-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads