netwalker | 99597a1e872c4bc2ef740522090868854bfef090d1375c4906b1696d4161834e

General

Target

99597a1e872c4bc2ef740522090868854bfef090d1375c4906b1696d4161834e.dll
Size

57KB
MD5

06777fc51010815284f38dcff3769da1
SHA1

05a1f84e040a30cfdfe70b855d6da8eefb0a82d7
SHA256

99597a1e872c4bc2ef740522090868854bfef090d1375c4906b1696d4161834e
SHA512

5d4b0ea574adc22f2e90509f46166980adb26a3bc7d5e4ba6e1a7982865ebcff331185587bf7772a3a50adcfb529743735da51386c3dec68271b0d6376a217af

Score

10^/10

netwalker ransomware spyware

Malware Config

Extracted

Path

C:\odt\F2782A-Readme.txt

Family

netwalker

Ransom Note

Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .f2782a -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_f2782a: azvvWjo/cZPG3smJ1BgLdNkumyeGBx6kqsbFXne5jrm4w3BCI9 zTssV+zelsqIyWAdYSq90SKt127T6Kqfw2BLg+/qSr7TEv65Yy i348jaPw0xQilrzt3PkHnpcwW3Np5QFzAD1sy3G3rBbUPU884b 33bGmIGFTd4ryVyPBC3lcRSodT/8Gztw0/8/4gUkxuB+X7bC1C 7xduwtFF7CHBvLuuD/+2CuKCYtqtDO2Y+I541IuFRIrpszsTTM h15f8GfZKA1ONQoBYZJRo/i8kVlAXW6dw3UOpZ3g==}

URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Users\Admin\Pictures\F2782A-Readme.txt

Family

netwalker

Ransom Note

Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .f2782a -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_f2782a: azvvWjo/cZPG3smJ1BgLdNkumyeGBx6kqsbFXne5jrm4w3BCI9 zTssV+zelsqIyWAdYSq90SKt127T6Kqfw2BLg+/qSr7TEv65Yy i348jaPw0xQilrzt3PkHnpcwW3Np5QFzAD1sy3G3rBbUPU884b 33bGmIGFTd4ryVyPBC3lcRSodT/8Gztw0/8/4gUkxuB+X7bC1C 7xduwtFF7CHBvLuuD/+2CuKCYtqtDO2Y+I541IuFRIrpszsTTM h15f8GfZKA1ONQoBYZJRo/i8kVlAXW6dw3UOpZ3g==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .f2782a -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_f2782a: azvvWjo/cZPG3smJ1BgLdNkumyeGBx6kqsbFXne5jrm4w3BCI9 zTssV+zelsqIyWAdYSq90SKt127T6Kqfw2BLg+/qSr7TEv65Yy i348jaPw0xQilrzt3PkHnpcwW3Np5QFzAD1sy3G3rBbUPU884b 33bGmIGFTd4ryVyPBC3lcRSodT/8Gztw0/8/4gUkxuB+X7bC1C 7xduwtFF7CHBvLuuD/+2CuKCYtqtDO2Y+I541IuFRIrpszsTTM h15f8GfZKA1ONQoBYZJRo/i8kVlAXW6dw3UOpZ3g==}

URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Users\Admin\Downloads\F2782A-Readme.txt

Family

netwalker

Ransom Note

Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .f2782a -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_f2782a: azvvWjo/cZPG3smJ1BgLdNkumyeGBx6kqsbFXne5jrm4w3BCI9 zTssV+zelsqIyWAdYSq90SKt127T6Kqfw2BLg+/qSr7TEv65Yy i348jaPw0xQilrzt3PkHnpcwW3Np5QFzAD1sy3G3rBbUPU884b 33bGmIGFTd4ryVyPBC3lcRSodT/8Gztw0/8/4gUkxuB+X7bC1C 7xduwtFF7CHBvLuuD/+2CuKCYtqtDO2Y+I541IuFRIrpszsTTM h15f8GfZKA1ONQoBYZJRo/i8kVlAXW6dw3UOpZ3g==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .f2782a -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_f2782a: azvvWjo/cZPG3smJ1BgLdNkumyeGBx6kqsbFXne5jrm4w3BCI9 zTssV+zelsqIyWAdYSq90SKt127T6Kqfw2BLg+/qSr7TEv65Yy i348jaPw0xQilrzt3PkHnpcwW3Np5QFzAD1sy3G3rBbUPU884b 33bGmIGFTd4ryVyPBC3lcRSodT/8Gztw0/8/4gUkxuB+X7bC1C 7xduwtFF7CHBvLuuD/+2CuKCYtqtDO2Y+I541IuFRIrpszsTTM h15f8GfZKA1ONQoBYZJRo/i8kVlAXW6dw3UOpZ3g==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .f2782a -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_f2782a: azvvWjo/cZPG3smJ1BgLdNkumyeGBx6kqsbFXne5jrm4w3BCI9 zTssV+zelsqIyWAdYSq90SKt127T6Kqfw2BLg+/qSr7TEv65Yy i348jaPw0xQilrzt3PkHnpcwW3Np5QFzAD1sy3G3rBbUPU884b 33bGmIGFTd4ryVyPBC3lcRSodT/8Gztw0/8/4gUkxuB+X7bC1C 7xduwtFF7CHBvLuuD/+2CuKCYtqtDO2Y+I541IuFRIrpszsTTM h15f8GfZKA1ONQoBYZJRo/i8kVlAXW6dw3UOpZ3g==}

URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\F2782A-Readme.txt

Family

netwalker

Ransom Note

Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .f2782a -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_f2782a: azvvWjo/cZPG3smJ1BgLdNkumyeGBx6kqsbFXne5jrm4w3BCI9 zTssV+zelsqIyWAdYSq90SKt127T6Kqfw2BLg+/qSr7TEv65Yy i348jaPw0xQilrzt3PkHnpcwW3Np5QFzAD1sy3G3rBbUPU884b 33bGmIGFTd4ryVyPBC3lcRSodT/8Gztw0/8/4gUkxuB+X7bC1C 7xduwtFF7CHBvLuuD/+2CuKCYtqtDO2Y+I541IuFRIrpszsTTM h15f8GfZKA1ONQoBYZJRo/i8kVlAXW6dw3UOpZ3g==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .f2782a -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_f2782a: azvvWjo/cZPG3smJ1BgLdNkumyeGBx6kqsbFXne5jrm4w3BCI9 zTssV+zelsqIyWAdYSq90SKt127T6Kqfw2BLg+/qSr7TEv65Yy i348jaPw0xQilrzt3PkHnpcwW3Np5QFzAD1sy3G3rBbUPU884b 33bGmIGFTd4ryVyPBC3lcRSodT/8Gztw0/8/4gUkxuB+X7bC1C 7xduwtFF7CHBvLuuD/+2CuKCYtqtDO2Y+I541IuFRIrpszsTTM h15f8GfZKA1ONQoBYZJRo/i8kVlAXW6dw3UOpZ3g==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .f2782a -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_f2782a: azvvWjo/cZPG3smJ1BgLdNkumyeGBx6kqsbFXne5jrm4w3BCI9 zTssV+zelsqIyWAdYSq90SKt127T6Kqfw2BLg+/qSr7TEv65Yy i348jaPw0xQilrzt3PkHnpcwW3Np5QFzAD1sy3G3rBbUPU884b 33bGmIGFTd4ryVyPBC3lcRSodT/8Gztw0/8/4gUkxuB+X7bC1C 7xduwtFF7CHBvLuuD/+2CuKCYtqtDO2Y+I541IuFRIrpszsTTM h15f8GfZKA1ONQoBYZJRo/i8kVlAXW6dw3UOpZ3g==}Hi! Your files are encrypted by Netwalker. All encrypted files for this computer has extension: .f2782a -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_f2782a: azvvWjo/cZPG3smJ1BgLdNkumyeGBx6kqsbFXne5jrm4w3BCI9 zTssV+zelsqIyWAdYSq90SKt127T6Kqfw2BLg+/qSr7TEv65Yy i348jaPw0xQilrzt3PkHnpcwW3Np5QFzAD1sy3G3rBbUPU884b 33bGmIGFTd4ryVyPBC3lcRSodT/8Gztw0/8/4gUkxuB+X7bC1C 7xduwtFF7CHBvLuuD/+2CuKCYtqtDO2Y+I541IuFRIrpszsTTM h15f8GfZKA1ONQoBYZJRo/i8kVlAXW6dw3UOpZ3g==}

URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Signatures

Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
ransomware netwalker

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

rundll32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SplitUnregister.raw => C:\Users\Admin\Pictures\SplitUnregister.raw.f2782a	rundll32.exe
File renamed	C:\Users\Admin\Pictures\GroupReceive.crw => C:\Users\Admin\Pictures\GroupReceive.crw.f2782a	rundll32.exe
File renamed	C:\Users\Admin\Pictures\RemoveInstall.tiff => C:\Users\Admin\Pictures\RemoveInstall.tiff.f2782a	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ExportRestore.tif => C:\Users\Admin\Pictures\ExportRestore.tif.f2782a	rundll32.exe
File renamed	C:\Users\Admin\Pictures\BlockTest.tiff => C:\Users\Admin\Pictures\BlockTest.tiff.f2782a	rundll32.exe
File opened for modification	C:\Users\Admin\Pictures\RemoveInstall.tiff	rundll32.exe
File opened for modification	C:\Users\Admin\Pictures\EditRevoke.tiff	rundll32.exe
File renamed	C:\Users\Admin\Pictures\EditRevoke.tiff => C:\Users\Admin\Pictures\EditRevoke.tiff.f2782a	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ConfirmInstall.crw => C:\Users\Admin\Pictures\ConfirmInstall.crw.f2782a	rundll32.exe
File opened for modification	C:\Users\Admin\Pictures\BlockTest.tiff	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 17174 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PeopleAppList.scale-125.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_shared_single_filetype.svg	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.ViewerPlugin\ReliveSurfaces\Video\ReliveVideoControl.xaml	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\music_welcome_page1.jpg	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated_contrast-white.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-fullcolor.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-80_altform-unplated.png	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-focus.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\move.svg	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-300.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-200.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reportabuse-default_18.svg	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7296_20x20x32.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-100.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_checkbox_selected_18.svg	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\F2782A-Readme.txt	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_contrast-black.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80_contrast-black.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Voices\en-IN\en-IN_female_TTS\common.lua	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Spider\Goal_40.jpg	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-execution.jar	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\selector.js	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\pyramid\Treasure_Chamber_Unearned_small.png	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\F2782A-Readme.txt	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\F2782A-Readme.txt	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6918_40x40x32.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-white_scale-100.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\shape_tetrahedron.png	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\localedata.jar	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\F2782A-Readme.txt	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.dualsim1.wink.small.scale-150.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.News\Assets\news_button_over.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\desktop\en-GB\doc_offline_narrator.xml	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\5034_32x32x32.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Workflow\Icon_Layout.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\TriPeaks\Goal_2.jpg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\hyph_en_GB.dic	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\F2782A-Readme.txt	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2_24x24x32.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-20.png	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\wordvisi.ttf	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\mask\cardback.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_WorriedEye.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileMediumSquare.scale-100.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\SkypeApp\Assets\skype_titlebar_logo.scale-125.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\pl_60x42.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxSmallTile.scale-100.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8498_48x48x32.png	rundll32.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\F2782A-Readme.txt	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\fr_60x42.png	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3068 IoCs

Processes:

rundll32.exe

pid	process
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe
3704	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 3704 rundll32.exe
Token: SeImpersonatePrivilege 3704 rundll32.exe

description	pid	process
Token: SeDebugPrivilege	3704	rundll32.exe
Token: SeImpersonatePrivilege	3704	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 744 wrote to memory of 3704	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 3704	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 3704	744	rundll32.exe	rundll32.exe
PID 3704 wrote to memory of 7740	3704	rundll32.exe	notepad.exe
PID 3704 wrote to memory of 7740	3704	rundll32.exe	notepad.exe
PID 3704 wrote to memory of 7740	3704	rundll32.exe	notepad.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99597a1e872c4bc2ef740522090868854bfef090d1375c4906b1696d4161834e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99597a1e872c4bc2ef740522090868854bfef090d1375c4906b1696d4161834e.dll,#1
2⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704

C:\Windows\SysWOW64\notepad.exe
C:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\F2782A-Readme.txt"
3⤵
PID:7740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\F2782A-Readme.txt
MD5
5183448931c66f526c096e8465e9389f

SHA1
fc0868c763cb58bf89ae061d8b2ce5fd71b79ae7

SHA256
33656369db1b006b2bd14668ef4d4bdd75ca32f6cfa7fa237ece471b5450a1f3

SHA512
ce16b051a734098875796142e4daab5b5f8bd71b7501d0e8f8a08e98fddd6441778c30c2752d69e4a0f0dc5855e2d52a050696e8175cdcf77a3df5fb31ef5ee4

Download Submit
memory/3704-0-0x0000000000000000-mapping.dmp

Download
memory/7740-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads