IRSdeclarationcod.exe
IRSdeclarationcod.exe
282KB
15-10-2020 14:02
fe3fd53ddc7c229b1150d970a05947c0
3abeddbbbd29310290955cc7c1a895550c92ab96
c414bbb789af8e3fb93b33344b31f1991582ec0f06558b29a3178d2b02465c72
Extracted
Path | C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\FD6F5D-Readme.txt |
Family | netwalker |
Ransom Note |
Hi!
Your files are encrypted by Netwalker.
All encrypted files for this computer has extension: .fd6f5d
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised.
Rebooting/shutdown will cause you to lose files without the possibility of recovery.
--
Our encryption algorithms are very strong and your files are very well protected,
the only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.
For us this is just business and to prove to you our seriousness, we will decrypt you one file for free.
Just open our website, upload the encrypted file and get the decrypted file for free.
--
Steps to get access on our website:
1.Download and install tor-browser: https://torproject.org/
2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
3.Put your personal code in the input form:
{code_fd6f5d:
l/Fk05gcV+GUCD0bIg74onLdc73bTB+ghYzoOM0ZflBrMzLu5v
kpJgWgMRHgrxJjbeMMAeLd5IOLqdZsGGy8UhMYDlQFiNVv41Zj
AnXAqEjZ8Oh8YjoNP8jnZUX15sWv5bzR1agHdKgTgy2ewzcErN
bj3a1GUySmish9GBUpQrFNit8yElCXlv3BAf1Gl/qP4hIzZByi
IXxk+WIarjMQXdGJEoolV2MtDSCl4e2QD68L7o74z05Z6qD4Gu
+MUXV+mvfVfOpwNM3QsgkN/hJ2SvaatSnhQVteXA==}
|
URLs |
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion |
Extracted
Path | C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\FD6F5D-Readme.txt |
Family | netwalker |
Ransom Note |
Hi!
Your files are encrypted by Netwalker.
All encrypted files for this computer has extension: .fd6f5d
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised.
Rebooting/shutdown will cause you to lose files without the possibility of recovery.
--
Our encryption algorithms are very strong and your files are very well protected,
the only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.
For us this is just business and to prove to you our seriousness, we will decrypt you one file for free.
Just open our website, upload the encrypted file and get the decrypted file for free.
--
Steps to get access on our website:
1.Download and install tor-browser: https://torproject.org/
2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
3.Put your personal code in the input form:
{code_fd6f5d:
l/Fk05gcV+GUCD0bIg74onLdc73bTB+ghYzoOM0ZflBrMzLu5v
kpJgWgMRHgrxJjbeMMAeLd5IOLqdZsGGy8UhMYDlQFiNVv41Zj
AnXAqEjZ8Oh8YjoNP8jnZUX15sWv5bzR1agHdKgTgy2ewzcErN
bj3a1GUySmish9GBUpQrFNit8yElCXlv3BAf1Gl/qP4hIzZByi
IXxk+WIarjMQXdGJEoolV2MtDSCl4e2QD68L7o74z05Z6qD4Gu
+MUXV+mvfVfOpwNM3QsgkN/hJ2SvaatSnhQVteXA==}Hi!
Your files are encrypted by Netwalker.
All encrypted files for this computer has extension: .fd6f5d
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised.
Rebooting/shutdown will cause you to lose files without the possibility of recovery.
--
Our encryption algorithms are very strong and your files are very well protected,
the only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.
For us this is just business and to prove to you our seriousness, we will decrypt you one file for free.
Just open our website, upload the encrypted file and get the decrypted file for free.
--
Steps to get access on our website:
1.Download and install tor-browser: https://torproject.org/
2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
3.Put your personal code in the input form:
{code_fd6f5d:
l/Fk05gcV+GUCD0bIg74onLdc73bTB+ghYzoOM0ZflBrMzLu5v
kpJgWgMRHgrxJjbeMMAeLd5IOLqdZsGGy8UhMYDlQFiNVv41Zj
AnXAqEjZ8Oh8YjoNP8jnZUX15sWv5bzR1agHdKgTgy2ewzcErN
bj3a1GUySmish9GBUpQrFNit8yElCXlv3BAf1Gl/qP4hIzZByi
IXxk+WIarjMQXdGJEoolV2MtDSCl4e2QD68L7o74z05Z6qD4Gu
+MUXV+mvfVfOpwNM3QsgkN/hJ2SvaatSnhQVteXA==}Hi!
Your files are encrypted by Netwalker.
All encrypted files for this computer has extension: .fd6f5d
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised.
Rebooting/shutdown will cause you to lose files without the possibility of recovery.
--
Our encryption algorithms are very strong and your files are very well protected,
the only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.
For us this is just business and to prove to you our seriousness, we will decrypt you one file for free.
Just open our website, upload the encrypted file and get the decrypted file for free.
--
Steps to get access on our website:
1.Download and install tor-browser: https://torproject.org/
2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
3.Put your personal code in the input form:
{code_fd6f5d:
l/Fk05gcV+GUCD0bIg74onLdc73bTB+ghYzoOM0ZflBrMzLu5v
kpJgWgMRHgrxJjbeMMAeLd5IOLqdZsGGy8UhMYDlQFiNVv41Zj
AnXAqEjZ8Oh8YjoNP8jnZUX15sWv5bzR1agHdKgTgy2ewzcErN
bj3a1GUySmish9GBUpQrFNit8yElCXlv3BAf1Gl/qP4hIzZByi
IXxk+WIarjMQXdGJEoolV2MtDSCl4e2QD68L7o74z05Z6qD4Gu
+MUXV+mvfVfOpwNM3QsgkN/hJ2SvaatSnhQVteXA==}
|
URLs |
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion |
Extracted
Path | C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\FD6F5D-Readme.txt |
Family | netwalker |
Ransom Note |
Hi!
Your files are encrypted by Netwalker.
All encrypted files for this computer has extension: .fd6f5d
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised.
Rebooting/shutdown will cause you to lose files without the possibility of recovery.
--
Our encryption algorithms are very strong and your files are very well protected,
the only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.
For us this is just business and to prove to you our seriousness, we will decrypt you one file for free.
Just open our website, upload the encrypted file and get the decrypted file for free.
--
Steps to get access on our website:
1.Download and install tor-browser: https://torproject.org/
2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
3.Put your personal code in the input form:
{code_fd6f5d:
l/Fk05gcV+GUCD0bIg74onLdc73bTB+ghYzoOM0ZflBrMzLu5v
kpJgWgMRHgrxJjbeMMAeLd5IOLqdZsGGy8UhMYDlQFiNVv41Zj
AnXAqEjZ8Oh8YjoNP8jnZUX15sWv5bzR1agHdKgTgy2ewzcErN
bj3a1GUySmish9GBUpQrFNit8yElCXlv3BAf1Gl/qP4hIzZByi
IXxk+WIarjMQXdGJEoolV2MtDSCl4e2QD68L7o74z05Z6qD4Gu
+MUXV+mvfVfOpwNM3QsgkN/hJ2SvaatSnhQVteXA==}Hi!
Your files are encrypted by Netwalker.
All encrypted files for this computer has extension: .fd6f5d
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised.
Rebooting/shutdown will cause you to lose files without the possibility of recovery.
--
Our encryption algorithms are very strong and your files are very well protected,
the only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.
For us this is just business and to prove to you our seriousness, we will decrypt you one file for free.
Just open our website, upload the encrypted file and get the decrypted file for free.
--
Steps to get access on our website:
1.Download and install tor-browser: https://torproject.org/
2.Open our website: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
3.Put your personal code in the input form:
{code_fd6f5d:
l/Fk05gcV+GUCD0bIg74onLdc73bTB+ghYzoOM0ZflBrMzLu5v
kpJgWgMRHgrxJjbeMMAeLd5IOLqdZsGGy8UhMYDlQFiNVv41Zj
AnXAqEjZ8Oh8YjoNP8jnZUX15sWv5bzR1agHdKgTgy2ewzcErN
bj3a1GUySmish9GBUpQrFNit8yElCXlv3BAf1Gl/qP4hIzZByi
IXxk+WIarjMQXdGJEoolV2MtDSCl4e2QD68L7o74z05Z6qD4Gu
+MUXV+mvfVfOpwNM3QsgkN/hJ2SvaatSnhQVteXA==}
|
URLs |
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion |
Filter: none
-
Netwalker Ransomware
Description
Ransomware family with multiple versions. Also known as MailTo.
Tags
-
Deletes shadow copies
Description
Ransomware often targets backup files to inhibit system recovery.
Tags
TTPs
-
Modifies extensions of user filesIRSdeclarationcod.exe
Description
Ransomware generally changes the extension on encrypted files.
Tags
Reported IOCs
description ioc process File renamed C:\Users\Admin\Pictures\ResetRepair.raw => C:\Users\Admin\Pictures\ResetRepair.raw.fd6f5d IRSdeclarationcod.exe File renamed C:\Users\Admin\Pictures\PublishUnblock.crw => C:\Users\Admin\Pictures\PublishUnblock.crw.fd6f5d IRSdeclarationcod.exe File renamed C:\Users\Admin\Pictures\DisableExpand.tiff => C:\Users\Admin\Pictures\DisableExpand.tiff.fd6f5d IRSdeclarationcod.exe File renamed C:\Users\Admin\Pictures\LimitInvoke.tif => C:\Users\Admin\Pictures\LimitInvoke.tif.fd6f5d IRSdeclarationcod.exe File opened for modification C:\Users\Admin\Pictures\DisableExpand.tiff IRSdeclarationcod.exe File opened for modification C:\Users\Admin\Pictures\StopGroup.tiff IRSdeclarationcod.exe File renamed C:\Users\Admin\Pictures\EnterStop.raw => C:\Users\Admin\Pictures\EnterStop.raw.fd6f5d IRSdeclarationcod.exe File renamed C:\Users\Admin\Pictures\WatchEnter.raw => C:\Users\Admin\Pictures\WatchEnter.raw.fd6f5d IRSdeclarationcod.exe File renamed C:\Users\Admin\Pictures\StopGroup.tiff => C:\Users\Admin\Pictures\StopGroup.tiff.fd6f5d IRSdeclarationcod.exe File opened for modification C:\Users\Admin\Pictures\HidePing.tiff IRSdeclarationcod.exe File renamed C:\Users\Admin\Pictures\HidePing.tiff => C:\Users\Admin\Pictures\HidePing.tiff.fd6f5d IRSdeclarationcod.exe File renamed C:\Users\Admin\Pictures\EditRepair.png => C:\Users\Admin\Pictures\EditRepair.png.fd6f5d IRSdeclarationcod.exe -
Deletes itselfcmd.exe
Reported IOCs
pid process 4152 cmd.exe -
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Modifies servicevssvc.exe
Tags
TTPs
Reported IOCs
description ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directoryIRSdeclarationcod.exe
Reported IOCs
description ioc process File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01629_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02312_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107708.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107288.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18252_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GreenTea.css IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00512_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART10.BDR IRSdeclarationcod.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099202.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_ON.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\SmallLogo.png IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN01165_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01152_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupiconsmask.bmp IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Apia IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01141_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00117_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGZIP.DPV IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SPACE_01.MID IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02426_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MY.XML IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR15F.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01242_.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285782.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Clarity.xml IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\OriginMergeFax.Dotx IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\TAB_ON.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PULLQUOTEBB.POC IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18217_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZMAIN.ACCDE IRSdeclarationcod.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\FD6F5D-Readme.txt IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21323_.GIF IRSdeclarationcod.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME05.CSS IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18242_.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6 IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105638.WMF IRSdeclarationcod.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar IRSdeclarationcod.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9 IRSdeclarationcod.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107742.WMF IRSdeclarationcod.exe -
Interacts with shadow copiesvssadmin.exe
Description
Shadow copies are often targeted by ransomware to inhibit system recovery.
Tags
TTPs
Reported IOCs
pid process 1540 vssadmin.exe -
Kills process with taskkilltaskkill.exe
Tags
Reported IOCs
pid process 4324 taskkill.exe -
Suspicious behavior: EnumeratesProcessesIRSdeclarationcod.exe
Reported IOCs
pid process 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe 1332 IRSdeclarationcod.exe -
Suspicious use of AdjustPrivilegeTokenIRSdeclarationcod.exevssvc.exetaskkill.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 1332 IRSdeclarationcod.exe Token: SeImpersonatePrivilege 1332 IRSdeclarationcod.exe Token: SeBackupPrivilege 452 vssvc.exe Token: SeRestorePrivilege 452 vssvc.exe Token: SeAuditPrivilege 452 vssvc.exe Token: SeDebugPrivilege 4324 taskkill.exe -
Suspicious use of WriteProcessMemoryIRSdeclarationcod.execmd.exe
Reported IOCs
description pid process target process PID 1332 wrote to memory of 1540 1332 IRSdeclarationcod.exe vssadmin.exe PID 1332 wrote to memory of 1540 1332 IRSdeclarationcod.exe vssadmin.exe PID 1332 wrote to memory of 1540 1332 IRSdeclarationcod.exe vssadmin.exe PID 1332 wrote to memory of 1540 1332 IRSdeclarationcod.exe vssadmin.exe PID 1332 wrote to memory of 6048 1332 IRSdeclarationcod.exe notepad.exe PID 1332 wrote to memory of 6048 1332 IRSdeclarationcod.exe notepad.exe PID 1332 wrote to memory of 6048 1332 IRSdeclarationcod.exe notepad.exe PID 1332 wrote to memory of 6048 1332 IRSdeclarationcod.exe notepad.exe PID 1332 wrote to memory of 4152 1332 IRSdeclarationcod.exe cmd.exe PID 1332 wrote to memory of 4152 1332 IRSdeclarationcod.exe cmd.exe PID 1332 wrote to memory of 4152 1332 IRSdeclarationcod.exe cmd.exe PID 1332 wrote to memory of 4152 1332 IRSdeclarationcod.exe cmd.exe PID 4152 wrote to memory of 4324 4152 cmd.exe taskkill.exe PID 4152 wrote to memory of 4324 4152 cmd.exe taskkill.exe PID 4152 wrote to memory of 4324 4152 cmd.exe taskkill.exe PID 4152 wrote to memory of 4324 4152 cmd.exe taskkill.exe
-
C:\Users\Admin\AppData\Local\Temp\IRSdeclarationcod.exe"C:\Users\Admin\AppData\Local\Temp\IRSdeclarationcod.exe"Modifies extensions of user filesDrops file in Program Files directorySuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quietInteracts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\FD6F5D-Readme.txt"
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\DF57.tmp.bat"Deletes itselfSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 1332Kills process with taskkillSuspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exeModifies serviceSuspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DF57.tmp.bat
MD5b4cdc3fe80e2be5da61eaf31badfec28
SHA1549722144b82a36ef8459b02fbf139101c7e6722
SHA25662b3565461719040a093eee2ee67db8c1b8eab4f12b5c49e46e2319d7ff92708
SHA5125de9259c8b74a108441c66f4ad78610c082d1d867e9a5ca0756f96f248d5a818db8086fe0451751c83ec32c9d7964e5e9339329121a1e77a14a5237ea7b4442c
-
C:\Users\Admin\Desktop\FD6F5D-Readme.txt
MD5de355bdbab95d82574264b24e411f5c4
SHA1d188760a8ff286b38a64113286332a019ffe4fa9
SHA25607c261db4a4b45aafd9ebaa1972f46b77ecbff066dd91fac2204bb391b5cd10a
SHA512624130d813070340c8e011b2e83cf3f4eb29d62a5167ad0d23bb7a047feb20e3d021aa17cee1fd1c417f3a308c3f62d07e05387b45eeb2678fbab15b5de98867
-
memory/1540-0-0x0000000000000000-mapping.dmp
-
memory/4152-2-0x0000000000000000-mapping.dmp
-
memory/4324-4-0x0000000000000000-mapping.dmp
-
memory/6048-1-0x0000000000000000-mapping.dmp