Analysis
-
max time kernel
139s -
max time network
140s -
platform
windows7_x64 -
resource
win7 -
submitted
25-10-2020 19:01
Static task
static1
Behavioral task
behavioral1
Sample
75f5c417a7ef4076d5730ce3e847d5bf.exe
Resource
win7
Behavioral task
behavioral2
Sample
75f5c417a7ef4076d5730ce3e847d5bf.exe
Resource
win10
General
-
Target
75f5c417a7ef4076d5730ce3e847d5bf.exe
-
Size
261KB
-
MD5
75f5c417a7ef4076d5730ce3e847d5bf
-
SHA1
a4931cd472f217de0056877ddd446c9a6627d1cd
-
SHA256
b2f644f5e3d2040ef24f9ca3a36de0c8606a00f30a0da4fbad471db7d2b2a377
-
SHA512
1fcf09a65466684ade22a1bcd56ff2c7943c5535dc3fcfcfa8a0188b219011cc0f46abafad26bbe7ea9d72253d0c7b8804072cffa1413235699b9e38240e9e25
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.onion.to/2696-1C4D-B3CE-0000-0DB2
http://cerberhhyed5frqa.onion.cab/2696-1C4D-B3CE-0000-0DB2
http://cerberhhyed5frqa.onion.nu/2696-1C4D-B3CE-0000-0DB2
http://cerberhhyed5frqa.onion.link/2696-1C4D-B3CE-0000-0DB2
http://cerberhhyed5frqa.tor2web.org/2696-1C4D-B3CE-0000-0DB2
http://cerberhhyed5frqa.onion/2696-1C4D-B3CE-0000-0DB2
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://cerberhhyed5frqa.onion.to/2696-1C4D-B3CE-0000-0DB2
http://cerberhhyed5frqa.onion.cab/2696-1C4D-B3CE-0000-0DB2
http://cerberhhyed5frqa.onion.nu/2696-1C4D-B3CE-0000-0DB2
http://cerberhhyed5frqa.onion.link/2696-1C4D-B3CE-0000-0DB2
http://cerberhhyed5frqa.tor2web.org/2696-1C4D-B3CE-0000-0DB2
http://cerberhhyed5frqa.onion.to/2696-1C4D-B3CE-0000-0DB2);
http://cerberhhyed5frqa.onion/2696-1C4D-B3CE-0000-0DB2
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Ursnif RM3
A heavily modified version of Ursnif discovered in the wild.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.exew32tm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\\w32tm.exe\"" 75f5c417a7ef4076d5730ce3e847d5bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\\w32tm.exe\"" w32tm.exe -
Executes dropped EXE 2 IoCs
Processes:
w32tm.exew32tm.exepid process 1540 w32tm.exe 1256 w32tm.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1856 cmd.exe -
Drops startup file 2 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.exew32tm.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\w32tm.lnk 75f5c417a7ef4076d5730ce3e847d5bf.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\w32tm.lnk w32tm.exe -
Loads dropped DLL 2 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.exew32tm.exepid process 1568 75f5c417a7ef4076d5730ce3e847d5bf.exe 1540 w32tm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
w32tm.exe75f5c417a7ef4076d5730ce3e847d5bf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\w32tm = "\"C:\\Users\\Admin\\AppData\\Roaming\\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\\w32tm.exe\"" w32tm.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\Run 75f5c417a7ef4076d5730ce3e847d5bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\Run\w32tm = "\"C:\\Users\\Admin\\AppData\\Roaming\\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\\w32tm.exe\"" 75f5c417a7ef4076d5730ce3e847d5bf.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 75f5c417a7ef4076d5730ce3e847d5bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\w32tm = "\"C:\\Users\\Admin\\AppData\\Roaming\\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\\w32tm.exe\"" 75f5c417a7ef4076d5730ce3e847d5bf.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\Run w32tm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\Run\w32tm = "\"C:\\Users\\Admin\\AppData\\Roaming\\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\\w32tm.exe\"" w32tm.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce w32tm.exe -
Processes:
w32tm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA w32tm.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
w32tm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2BE1.bmp" w32tm.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1904 taskkill.exe 1416 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.exew32tm.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Control Panel\Desktop 75f5c417a7ef4076d5730ce3e847d5bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\\w32tm.exe\"" 75f5c417a7ef4076d5730ce3e847d5bf.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Control Panel\Desktop w32tm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\\w32tm.exe\"" w32tm.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAF2AF21-1705-11EB-BD6E-7E84EB346C39} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EABE50E1-1705-11EB-BD6E-7E84EB346C39} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b530accd206940bf4cc3274d3cd52500000000020000000000106600000001000020000000598faf084ab94f211b8613dda406e959b508938da639f7c4b2d8f956288d78d1000000000e8000000002000020000000c21d70ccae07cccebf358685974951e0b73cb479f27f3303a911c8b2ade9052a200000006418de3b39f9b2030382173530563002a989ba2251c5f564a0d23dfb6c1b6d3240000000a7e5ed50bcce53035a1f4ed97ec505ebfbe569cf7819d4c4a64f207390030a7baa3dd295cc0b921cda8d78004b9d8a66b86bcc9cd753385b2497d2ab63cf9037 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b530accd206940bf4cc3274d3cd52500000000020000000000106600000001000020000000e46adc7791c8c3c75156896abed0ef450e037973c66d6407b7002338a55e4144000000000e8000000002000020000000cd382b6c30d64d09191501763901a31d3833d72a3868e21af3be176eb7fff56090000000a37a08e91b4583e52150d3fcb3de7cdd7a52875a145c2acd513f232121b2db1327a2082475ae4920f813ed3dd2ec0376572ca91b5720e1a16e786756ff72361981b29a4b9be0fc08a0522495bc9c6bd33ae34c6253ad44085401bbad24cbe42fa98cc2d5da02ebf51e385bc309f3b0a378e73643d5f3414cd51b599aebccf8344b933baf76dc7a31113fc57c1ee6302e40000000c418553c63bfba183a984a261884734d3ccc271274a3dbb1250580b5d97cfa538c5f38c657f5e78e80708b1b52fa6418e9388d3bb9527677756304425bf113cb iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "310424949" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f717b012abd601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 252 IoCs
Processes:
w32tm.exepid process 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe 1540 w32tm.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.exew32tm.exetaskkill.exew32tm.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 1568 75f5c417a7ef4076d5730ce3e847d5bf.exe Token: SeDebugPrivilege 1540 w32tm.exe Token: SeDebugPrivilege 1904 taskkill.exe Token: SeDebugPrivilege 1256 w32tm.exe Token: 33 1552 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1552 AUDIODG.EXE Token: 33 1552 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1552 AUDIODG.EXE Token: SeDebugPrivilege 1416 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exepid process 1044 iexplore.exe 1828 iexplore.exe 1044 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1044 iexplore.exe 1044 iexplore.exe 1828 iexplore.exe 1828 iexplore.exe 1044 iexplore.exe 1044 iexplore.exe 740 IEXPLORE.EXE 740 IEXPLORE.EXE 796 IEXPLORE.EXE 796 IEXPLORE.EXE 796 IEXPLORE.EXE 796 IEXPLORE.EXE 796 IEXPLORE.EXE 796 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 3 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.exew32tm.exew32tm.exepid process 1568 75f5c417a7ef4076d5730ce3e847d5bf.exe 1540 w32tm.exe 1256 w32tm.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.execmd.exetaskeng.exew32tm.exeiexplore.exeiexplore.execmd.exedescription pid process target process PID 1568 wrote to memory of 1540 1568 75f5c417a7ef4076d5730ce3e847d5bf.exe w32tm.exe PID 1568 wrote to memory of 1540 1568 75f5c417a7ef4076d5730ce3e847d5bf.exe w32tm.exe PID 1568 wrote to memory of 1540 1568 75f5c417a7ef4076d5730ce3e847d5bf.exe w32tm.exe PID 1568 wrote to memory of 1540 1568 75f5c417a7ef4076d5730ce3e847d5bf.exe w32tm.exe PID 1568 wrote to memory of 1856 1568 75f5c417a7ef4076d5730ce3e847d5bf.exe cmd.exe PID 1568 wrote to memory of 1856 1568 75f5c417a7ef4076d5730ce3e847d5bf.exe cmd.exe PID 1568 wrote to memory of 1856 1568 75f5c417a7ef4076d5730ce3e847d5bf.exe cmd.exe PID 1568 wrote to memory of 1856 1568 75f5c417a7ef4076d5730ce3e847d5bf.exe cmd.exe PID 1856 wrote to memory of 1904 1856 cmd.exe taskkill.exe PID 1856 wrote to memory of 1904 1856 cmd.exe taskkill.exe PID 1856 wrote to memory of 1904 1856 cmd.exe taskkill.exe PID 1856 wrote to memory of 1904 1856 cmd.exe taskkill.exe PID 1856 wrote to memory of 368 1856 cmd.exe PING.EXE PID 1856 wrote to memory of 368 1856 cmd.exe PING.EXE PID 1856 wrote to memory of 368 1856 cmd.exe PING.EXE PID 1856 wrote to memory of 368 1856 cmd.exe PING.EXE PID 764 wrote to memory of 1256 764 taskeng.exe w32tm.exe PID 764 wrote to memory of 1256 764 taskeng.exe w32tm.exe PID 764 wrote to memory of 1256 764 taskeng.exe w32tm.exe PID 764 wrote to memory of 1256 764 taskeng.exe w32tm.exe PID 1540 wrote to memory of 1044 1540 w32tm.exe iexplore.exe PID 1540 wrote to memory of 1044 1540 w32tm.exe iexplore.exe PID 1540 wrote to memory of 1044 1540 w32tm.exe iexplore.exe PID 1540 wrote to memory of 1044 1540 w32tm.exe iexplore.exe PID 1540 wrote to memory of 1564 1540 w32tm.exe NOTEPAD.EXE PID 1540 wrote to memory of 1564 1540 w32tm.exe NOTEPAD.EXE PID 1540 wrote to memory of 1564 1540 w32tm.exe NOTEPAD.EXE PID 1540 wrote to memory of 1564 1540 w32tm.exe NOTEPAD.EXE PID 1044 wrote to memory of 796 1044 iexplore.exe IEXPLORE.EXE PID 1044 wrote to memory of 796 1044 iexplore.exe IEXPLORE.EXE PID 1044 wrote to memory of 796 1044 iexplore.exe IEXPLORE.EXE PID 1044 wrote to memory of 796 1044 iexplore.exe IEXPLORE.EXE PID 1828 wrote to memory of 740 1828 iexplore.exe IEXPLORE.EXE PID 1828 wrote to memory of 740 1828 iexplore.exe IEXPLORE.EXE PID 1828 wrote to memory of 740 1828 iexplore.exe IEXPLORE.EXE PID 1828 wrote to memory of 740 1828 iexplore.exe IEXPLORE.EXE PID 1540 wrote to memory of 1988 1540 w32tm.exe WScript.exe PID 1540 wrote to memory of 1988 1540 w32tm.exe WScript.exe PID 1540 wrote to memory of 1988 1540 w32tm.exe WScript.exe PID 1540 wrote to memory of 1988 1540 w32tm.exe WScript.exe PID 1540 wrote to memory of 1820 1540 w32tm.exe cmd.exe PID 1540 wrote to memory of 1820 1540 w32tm.exe cmd.exe PID 1540 wrote to memory of 1820 1540 w32tm.exe cmd.exe PID 1540 wrote to memory of 1820 1540 w32tm.exe cmd.exe PID 1820 wrote to memory of 1416 1820 cmd.exe taskkill.exe PID 1820 wrote to memory of 1416 1820 cmd.exe taskkill.exe PID 1820 wrote to memory of 1416 1820 cmd.exe taskkill.exe PID 1820 wrote to memory of 2076 1820 cmd.exe PING.EXE PID 1820 wrote to memory of 2076 1820 cmd.exe PING.EXE PID 1820 wrote to memory of 2076 1820 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\75f5c417a7ef4076d5730ce3e847d5bf.exe"C:\Users\Admin\AppData\Local\Temp\75f5c417a7ef4076d5730ce3e847d5bf.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\w32tm.exe"C:\Users\Admin\AppData\Roaming\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\w32tm.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "w32tm.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\w32tm.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "w32tm.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "75f5c417a7ef4076d5730ce3e847d5bf.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\75f5c417a7ef4076d5730ce3e847d5bf.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "75f5c417a7ef4076d5730ce3e847d5bf.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\taskeng.exetaskeng.exe {C48945C1-B26C-4AF8-812F-4ED3DE324AA0} S-1-5-21-4210623931-3856158591-1213714290-1000:VDIPBIOF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\w32tm.exeC:\Users\Admin\AppData\Roaming\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\w32tm.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1828 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5741⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EABE50E1-1705-11EB-BD6E-7E84EB346C39}.datMD5
1ce61f1c1f7fc9557b1fa7bb7c0c6b30
SHA1a5e10e48e7d9d176f32dc56b1e40d480734bcf51
SHA2560b9d92f53208383007626ce604ed720656d45b688204f65c9bea182007b56528
SHA512245e81b0b9b8c4702db511f95c205e321cdb2dc682a33614c47b9de3b6c10ba3de7f126d3c776f3f8d07bd8a4abe57197351a7608844aa952985a587f2ad9ddd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\623NJA7M.txtMD5
a2e38d020e8827df12ec308622f151d4
SHA145a9152c7f4020707309fe5ee4ef22efde5329e7
SHA256de330c2e4a30e008474a0e39eeae3a8866ffa5a5e0e6cf8f31d6de5e05997113
SHA512b0ebb164410e7e5f03c6c44710e7240c25acae5d66b21f40feb4d58b2adcc44e4c3a75a6bc90c870ee6a8bd2f6120f50435a17a9d44de880773d67d70f9aa596
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\w32tm.lnkMD5
a69813818ae7108964a3a1947bdce9ab
SHA1d192c99bde38f22fa5cfc179fb5c79ca1205bd93
SHA256e95b7ff13b9ab9c92aefdead7ece5dd033a47dc2b263d368d470779bbc39c16a
SHA512d7cdbeae81c706350329d1a02ac64a7689f2bbc42c2665dac581a86db998f7aecce7b180135bd938f8b2192b9e213989895249e3d6bd3ab51dc939d28ab1cbed
-
C:\Users\Admin\AppData\Roaming\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\w32tm.exeMD5
75f5c417a7ef4076d5730ce3e847d5bf
SHA1a4931cd472f217de0056877ddd446c9a6627d1cd
SHA256b2f644f5e3d2040ef24f9ca3a36de0c8606a00f30a0da4fbad471db7d2b2a377
SHA5121fcf09a65466684ade22a1bcd56ff2c7943c5535dc3fcfcfa8a0188b219011cc0f46abafad26bbe7ea9d72253d0c7b8804072cffa1413235699b9e38240e9e25
-
C:\Users\Admin\AppData\Roaming\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\w32tm.exeMD5
75f5c417a7ef4076d5730ce3e847d5bf
SHA1a4931cd472f217de0056877ddd446c9a6627d1cd
SHA256b2f644f5e3d2040ef24f9ca3a36de0c8606a00f30a0da4fbad471db7d2b2a377
SHA5121fcf09a65466684ade22a1bcd56ff2c7943c5535dc3fcfcfa8a0188b219011cc0f46abafad26bbe7ea9d72253d0c7b8804072cffa1413235699b9e38240e9e25
-
C:\Users\Admin\AppData\Roaming\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\w32tm.exeMD5
75f5c417a7ef4076d5730ce3e847d5bf
SHA1a4931cd472f217de0056877ddd446c9a6627d1cd
SHA256b2f644f5e3d2040ef24f9ca3a36de0c8606a00f30a0da4fbad471db7d2b2a377
SHA5121fcf09a65466684ade22a1bcd56ff2c7943c5535dc3fcfcfa8a0188b219011cc0f46abafad26bbe7ea9d72253d0c7b8804072cffa1413235699b9e38240e9e25
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.htmlMD5
c69df29d2ffb29c07c1614930ef18c78
SHA1c5e98e1edf13f0c296ff2ce53d1f526cb16fcf66
SHA256a4a33b775ec2cc70b539c5650660f1812d90379d71a17def7f2559876b295afc
SHA5126814186bdce44fc1674e4f895df1a8cacbb3ab2683291bf26f6de396651fbe7281b739c19e73ed5becc293c0eb57d01397d95d26ac4bb442a7fc3aed08fdfce0
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txtMD5
1992b9ace6be9ebfe8fec5113106c031
SHA1b71b0fe10ae88d35d3827f47a723f3fb3d10990e
SHA256936298c21dea872cf3abb18023e6c284a40f833a788b333e7283f70a15463f65
SHA5120cae01f17667ef09782ad6a801a8e77936a602d4ece372f2a9ab389c7dd82b3ab22437753055660f2ba0ec46b7d647dad0d324c7b4fbfa69d89c2b59e0f796de
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.urlMD5
8d21b493471c8275de3e95666da2950b
SHA1605d3dfe858df98a457a72e7ff173d395c96e4e0
SHA256c5761e00131a1fba912dd6dad43dbb5d28db0afebd585c49c041fde05a14a25d
SHA512c86e2b1ca0cec6a41e9e13cad9b46409cc683b6cc24aab486786567292e2b26341b769582c95bb6bda7b5571a906c6ad7168f3156033c93f635ed635ff370e46
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbsMD5
6f84dbf74ef41dc3d861f5fb3e0f45ff
SHA13e5f17e9b9589f33ce6add7f2518a666ff2253a4
SHA256df5f432d7e0d2bd1c4dddb1fabbf1e77bd1065b9020f71abaf1a45fbb950bbb8
SHA5129f9ec25b815be7b20df26244d31848c9a4896b130241b63636d63511a290eaad78d289a9bb04592c0ba31492064671351b4c7359310f03469e27764132a20a5a
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Roaming\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\w32tm.exeMD5
75f5c417a7ef4076d5730ce3e847d5bf
SHA1a4931cd472f217de0056877ddd446c9a6627d1cd
SHA256b2f644f5e3d2040ef24f9ca3a36de0c8606a00f30a0da4fbad471db7d2b2a377
SHA5121fcf09a65466684ade22a1bcd56ff2c7943c5535dc3fcfcfa8a0188b219011cc0f46abafad26bbe7ea9d72253d0c7b8804072cffa1413235699b9e38240e9e25
-
\Users\Admin\AppData\Roaming\{802AADF0-CB9C-FB96-84D3-6C0834BDF578}\w32tm.exeMD5
75f5c417a7ef4076d5730ce3e847d5bf
SHA1a4931cd472f217de0056877ddd446c9a6627d1cd
SHA256b2f644f5e3d2040ef24f9ca3a36de0c8606a00f30a0da4fbad471db7d2b2a377
SHA5121fcf09a65466684ade22a1bcd56ff2c7943c5535dc3fcfcfa8a0188b219011cc0f46abafad26bbe7ea9d72253d0c7b8804072cffa1413235699b9e38240e9e25
-
memory/368-7-0x0000000000000000-mapping.dmp
-
memory/740-16-0x0000000000000000-mapping.dmp
-
memory/796-15-0x0000000000000000-mapping.dmp
-
memory/1044-12-0x0000000000000000-mapping.dmp
-
memory/1256-9-0x0000000000000000-mapping.dmp
-
memory/1416-27-0x0000000000000000-mapping.dmp
-
memory/1540-1-0x0000000000000000-mapping.dmp
-
memory/1564-13-0x0000000000000000-mapping.dmp
-
memory/1820-26-0x0000000000000000-mapping.dmp
-
memory/1856-4-0x0000000000000000-mapping.dmp
-
memory/1884-6-0x000007FEF6940000-0x000007FEF6BBA000-memory.dmpFilesize
2.5MB
-
memory/1904-5-0x0000000000000000-mapping.dmp
-
memory/1988-20-0x0000000000000000-mapping.dmp
-
memory/2076-28-0x0000000000000000-mapping.dmp