Analysis
-
max time kernel
127s -
max time network
129s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
17-09-2020 23:40
Static task
static1
Behavioral task
behavioral1
Sample
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
Resource
win10v200722
General
-
Target
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
-
Size
65KB
-
MD5
eaef25ab1f59492ffc735a386294b69f
-
SHA1
76cc795c39cc19465c24825dc5ebafd7f944ea7e
-
SHA256
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60
-
SHA512
a812186ff05baa0c194abc2b4becc145f312b885068773f994658ecac2bfd8e1c85acdfe3774728541ed966f46a872d19fee17a53cc07f3f8e2e94be0cdef1c4
Malware Config
Extracted
C:\80AE42-Readme.txt
mailto_hamlampampom
Extracted
C:\Program Files\80AE42-Readme.txt
mailto_hamlampampom
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\80AE42-Readme.txt
mailto_hamlampampom
Extracted
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\80AE42-Readme.txt
mailto_hamlampampom
Signatures
-
MailTo (Hamlampampom Variant)
Ransomware family discovered in late 2019 with variants named based on contact emails.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exedescription ioc process File renamed C:\Users\Admin\Pictures\ConvertFromExpand.tif => C:\Users\Admin\Pictures\ConvertFromExpand.tif.80ae42 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File renamed C:\Users\Admin\Pictures\MoveStop.tiff => C:\Users\Admin\Pictures\MoveStop.tiff.80ae42 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Users\Admin\Pictures\MoveStop.tiff 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File renamed C:\Users\Admin\Pictures\DisconnectOut.png => C:\Users\Admin\Pictures\DisconnectOut.png.80ae42 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File renamed C:\Users\Admin\Pictures\ResumeSkip.tif => C:\Users\Admin\Pictures\ResumeSkip.tif.80ae42 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File renamed C:\Users\Admin\Pictures\RepairSuspend.raw => C:\Users\Admin\Pictures\RepairSuspend.raw.80ae42 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 17083 IoCs
Processes:
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\vc_16x11.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\80AE42-Readme.txt 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2708_40x40x32.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_SplashScreen.scale-200.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-100.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\80AE42-Readme.txt 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\80AE42-Readme.txt 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\rename.svg 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-200.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\80AE42-Readme.txt 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.0.2.jar 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.contrast-white_scale-100.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\en_CA.aff 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1938_20x20x32.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OneConnectAppList.targetsize-40.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\rain.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\ui-strings.js 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sk_get.svg 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tournament\StrikeBackground.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\LargeTile.scale-100.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\cy_16x11.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\ui-strings.js 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\SplashScreen\PaintSplashScreen.scale-150.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-48.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OneConnectAppList.targetsize-60.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSmallTile.scale-100.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-white_scale-125.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\hi.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Livetiles\MicrosoftSolitaireAppList.scale-200.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\80AE42-Readme.txt 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\80AE42-Readme.txt 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\80AE42-Readme.txt 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxMediumTile.scale-200.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small2x.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses.svg 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\freecell\Get_Out_Of_Jail_Free_.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\sr-cyrl-cs\mso.acl 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_duplicate_18.svg 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\EmbossBitmaps\Cloud.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\om_16x11.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\PREVIEW.GIF 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\80AE42-Readme.txt 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\ui-strings.js 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.ViewModel.winmd 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchWideTile.contrast-white_scale-100.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\py_60x42.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\share.svg 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\sa_16x11.png 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\80AE42-Readme.txt 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 9004 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 20503 IoCs
Processes:
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exepid process 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe Token: SeImpersonatePrivilege 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe Token: SeDebugPrivilege 9004 taskkill.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.execmd.exedescription pid process target process PID 3684 wrote to memory of 8732 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe notepad.exe PID 3684 wrote to memory of 8732 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe notepad.exe PID 3684 wrote to memory of 8732 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe notepad.exe PID 3684 wrote to memory of 6572 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe cmd.exe PID 3684 wrote to memory of 6572 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe cmd.exe PID 3684 wrote to memory of 6572 3684 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe cmd.exe PID 6572 wrote to memory of 9004 6572 cmd.exe taskkill.exe PID 6572 wrote to memory of 9004 6572 cmd.exe taskkill.exe PID 6572 wrote to memory of 9004 6572 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe"C:\Users\Admin\AppData\Local\Temp\4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\80AE42-Readme.txt"2⤵PID:8732
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\693A.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:6572 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 36843⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:9004
-
-