ouroboros | a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461

Analysis

max time kernel
40s
max time network
144s
platform
windows10_x64
resource
win10v200722
submitted
11-09-2020 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
Size

994KB
MD5

62ae12ef05bb6ad38cf30d8c35efd416
SHA1

90049acd442225de16124a89835eed61f4202a8b
SHA256

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461
SHA512

0114ca7c03291783732a2cbcbbbc4f6a2250c3ad41aaa415be6e85aa28daad85b668f4f0177357c3fdf1c861830bb8b24d378390de7736a57660182ac3c3709a

Score

10^/10

ouroboros evasion ransomware

Malware Config

Signatures

Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
ransomware ouroboros
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops desktop.ini file(s) 8 IoCs

Processes:

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

description	ioc	process
File created	C:\$Recycle.Bin\S-1-5-21-1400429095-533421673-2598934218-1000\desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1400429095-533421673-2598934218-1000\desktop.ini	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description flow ioc

HTTP URL 9 http://www.sfml-dev.org/ip-provider.php

description	flow	ioc
HTTP URL	9	http://www.sfml-dev.org/ip-provider.php

Drops file in Program Files directory 64 IoCs

Processes:

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_filter_18.svg	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-white.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\XMLOffKeys\Keys_OffVerOOBE.xml	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\punch.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-30_altform-unplated.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\XMLOffKeys\Keys_OffVer365.xml	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-200.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated_contrast-black.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleLargeTile.scale-125.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\spider\Itsy_Bitsy_Spider_.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyLetter.dotx.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\StarClub\new_collection_available.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-48_altform-unplated.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\TXP_Package.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\Icon.targetsize-32.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\hm_60x42.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeWideTile.scale-400.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\Popup_shadow_3_2bp.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tournament\Awards.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Internet Explorer\sqmapi.dll	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_k_col.hxk	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\156.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\169.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-125.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msolui.dll	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\2.jpg	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\selector.js	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-black_scale-125.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\Attribution\holiday_weather.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\jdwp.dll.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right.gif	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSUIGHUB.TTF.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-text.jar.[[email protected]][VPY5J9N0721MAEH].Spade	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

NTFS ADS 1 IoCs

Processes:

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

description	ioc	process
File opened for modification	C:\Documents and Settings\zh-TW\"쀀隚瘟\:쀀隚瘟\:쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\3쀀隚瘟\߿	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

pid	process
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	process	target process
PID 584 wrote to memory of 3836	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3836	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3836	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 3836 wrote to memory of 3492	3836	cmd.exe	net.exe
PID 3836 wrote to memory of 3492	3836	cmd.exe	net.exe
PID 3836 wrote to memory of 3492	3836	cmd.exe	net.exe
PID 3492 wrote to memory of 3332	3492	net.exe	net1.exe
PID 3492 wrote to memory of 3332	3492	net.exe	net1.exe
PID 3492 wrote to memory of 3332	3492	net.exe	net1.exe
PID 584 wrote to memory of 4056	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 4056	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 4056	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 4056 wrote to memory of 4012	4056	cmd.exe	net.exe
PID 4056 wrote to memory of 4012	4056	cmd.exe	net.exe
PID 4056 wrote to memory of 4012	4056	cmd.exe	net.exe
PID 4012 wrote to memory of 3720	4012	net.exe	net1.exe
PID 4012 wrote to memory of 3720	4012	net.exe	net1.exe
PID 4012 wrote to memory of 3720	4012	net.exe	net1.exe
PID 584 wrote to memory of 3904	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3904	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3904	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 3904 wrote to memory of 2512	3904	cmd.exe	net.exe
PID 3904 wrote to memory of 2512	3904	cmd.exe	net.exe
PID 3904 wrote to memory of 2512	3904	cmd.exe	net.exe
PID 2512 wrote to memory of 3932	2512	net.exe	net1.exe
PID 2512 wrote to memory of 3932	2512	net.exe	net1.exe
PID 2512 wrote to memory of 3932	2512	net.exe	net1.exe
PID 584 wrote to memory of 220	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 220	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 220	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 220 wrote to memory of 3956	220	cmd.exe	net.exe
PID 220 wrote to memory of 3956	220	cmd.exe	net.exe
PID 220 wrote to memory of 3956	220	cmd.exe	net.exe
PID 3956 wrote to memory of 944	3956	net.exe	net1.exe
PID 3956 wrote to memory of 944	3956	net.exe	net1.exe
PID 3956 wrote to memory of 944	3956	net.exe	net1.exe
PID 584 wrote to memory of 2416	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2416	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2416	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 2416 wrote to memory of 512	2416	cmd.exe	net.exe
PID 2416 wrote to memory of 512	2416	cmd.exe	net.exe
PID 2416 wrote to memory of 512	2416	cmd.exe	net.exe
PID 512 wrote to memory of 964	512	net.exe	net1.exe
PID 512 wrote to memory of 964	512	net.exe	net1.exe
PID 512 wrote to memory of 964	512	net.exe	net1.exe
PID 584 wrote to memory of 3396	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3396	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 3396	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2224	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2224	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2224	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 856	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 856	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 856	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2080	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2080	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 584 wrote to memory of 2080	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe
PID 2080 wrote to memory of 3772	2080	cmd.exe	net.exe
PID 2080 wrote to memory of 3772	2080	cmd.exe	net.exe
PID 2080 wrote to memory of 3772	2080	cmd.exe	net.exe
PID 3772 wrote to memory of 1664	3772	net.exe	net1.exe
PID 3772 wrote to memory of 1664	3772	net.exe	net1.exe
PID 3772 wrote to memory of 1664	3772	net.exe	net1.exe
PID 584 wrote to memory of 2576	584	a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe
"C:\Users\Admin\AppData\Local\Temp\a6f33427a356dca0420466bcc3283592e87caf4c8224c7d50819f69c71edd461.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLWriter
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\SysWOW64\net.exe
    net stop SQLWriter
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLWriter
      4⤵
      PID:3332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLBrowser
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\net.exe
    net stop SQLBrowser
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLBrowser
      4⤵
      PID:3720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLSERVER
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLSERVER
      4⤵
      PID:3932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$CONTOSO1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$CONTOSO1
      4⤵
      PID:944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSDTC
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\net.exe
    net stop MSDTC
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSDTC
      4⤵
      PID:964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:3396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
  2⤵
  PID:2224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
  2⤵
  PID:856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\net.exe
    net stop SQLSERVERAGENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLSERVERAGENT
      4⤵
      PID:1664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLSERVER
    3⤵
    PID:3800
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLSERVER
      4⤵
      PID:3968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop vds
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\net.exe
    net stop vds
    3⤵
    PID:3028
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop vds
      4⤵
      PID:3132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
  2⤵
  PID:3992
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    PID:2688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
  2⤵
  PID:740
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    PID:1912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-9-0x0000000000000000-mapping.dmp

Download
memory/512-13-0x0000000000000000-mapping.dmp

Download
memory/584-40-0x0000000001930000-0x0000000001931000-memory.dmp

Filesize
4KB

Download
memory/584-37-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/584-33-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/584-32-0x0000000001930000-0x0000000001931000-memory.dmp

Filesize
4KB

Download
memory/584-31-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/584-41-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/584-48-0x0000000001930000-0x0000000001931000-memory.dmp

Filesize
4KB

Download
memory/740-29-0x0000000000000000-mapping.dmp

Download
memory/856-17-0x0000000000000000-mapping.dmp

Download
memory/944-11-0x0000000000000000-mapping.dmp

Download
memory/964-14-0x0000000000000000-mapping.dmp

Download
memory/1664-20-0x0000000000000000-mapping.dmp

Download
memory/1912-30-0x0000000000000000-mapping.dmp

Download
memory/2080-18-0x0000000000000000-mapping.dmp

Download
memory/2224-16-0x0000000000000000-mapping.dmp

Download
memory/2416-12-0x0000000000000000-mapping.dmp

Download
memory/2512-7-0x0000000000000000-mapping.dmp

Download
memory/2576-21-0x0000000000000000-mapping.dmp

Download
memory/2688-28-0x0000000000000000-mapping.dmp

Download
memory/3028-25-0x0000000000000000-mapping.dmp

Download
memory/3036-24-0x0000000000000000-mapping.dmp

Download
memory/3132-26-0x0000000000000000-mapping.dmp

Download
memory/3332-2-0x0000000000000000-mapping.dmp

Download
memory/3396-15-0x0000000000000000-mapping.dmp

Download
memory/3492-1-0x0000000000000000-mapping.dmp

Download
memory/3720-5-0x0000000000000000-mapping.dmp

Download
memory/3772-19-0x0000000000000000-mapping.dmp

Download
memory/3800-22-0x0000000000000000-mapping.dmp

Download
memory/3836-0-0x0000000000000000-mapping.dmp

Download
memory/3904-6-0x0000000000000000-mapping.dmp

Download
memory/3932-8-0x0000000000000000-mapping.dmp

Download
memory/3956-10-0x0000000000000000-mapping.dmp

Download
memory/3968-23-0x0000000000000000-mapping.dmp

Download
memory/3992-27-0x0000000000000000-mapping.dmp

Download
memory/4012-4-0x0000000000000000-mapping.dmp

Download
memory/4056-3-0x0000000000000000-mapping.dmp

Download