Analysis
-
max time kernel
137s -
max time network
137s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe
Resource
win10v20201028
General
-
Target
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe
-
Size
69KB
-
MD5
18c32583a6fe320b4dc66a251be45e64
-
SHA1
c3d0c0568fa08b94172d88fc0c0795cf7da31b60
-
SHA256
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98
-
SHA512
3faaed3f4aeda3f04a9325e20e9df5e907239c9329913d688009f008763b6960956df87d84c5cc809e2c9cbcbc9da12e6b0f6745c69e3ade3e0ad2ff0f747c1c
Malware Config
Extracted
C:\ProgramData\Adobe\Updater6\E4E0A7-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\AppData\Roaming\E4E0A7-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Microsoft Office\Stationery\1033\E4E0A7-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RemoveStart.tiff 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File renamed C:\Users\Admin\Pictures\InitializeStep.tif => C:\Users\Admin\Pictures\InitializeStep.tif.e4e0a7 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File renamed C:\Users\Admin\Pictures\RemoveStart.tiff => C:\Users\Admin\Pictures\RemoveStart.tiff.e4e0a7 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 5720 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 7501 IoCs
Processes:
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1036\MSO.ACL 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART1.BDR 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00483_.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CRANE.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\INFOMAIL.CFG 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\E4E0A7-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107138.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01838_.GIF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0300862.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\sk.pak 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageMaskSmall.bmp 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\E4E0A7-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\E4E0A7-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14768_.GIF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18233_.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00253_.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImageMask.bmp 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR16F.GIF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195248.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PPINTL.REST.IDX_DLL 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02431_.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\validation.js 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GR8GALRY.GRA 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLNOTE.FAE 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00192_.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01805_.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233070.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01145_.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00074_.WMF 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1412 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5920 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 19505 IoCs
Processes:
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exepid process 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe Token: SeImpersonatePrivilege 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe Token: SeBackupPrivilege 7896 vssvc.exe Token: SeRestorePrivilege 7896 vssvc.exe Token: SeAuditPrivilege 7896 vssvc.exe Token: SeDebugPrivilege 5920 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.execmd.exedescription pid process target process PID 1940 wrote to memory of 1412 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe vssadmin.exe PID 1940 wrote to memory of 1412 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe vssadmin.exe PID 1940 wrote to memory of 1412 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe vssadmin.exe PID 1940 wrote to memory of 1412 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe vssadmin.exe PID 1940 wrote to memory of 5608 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe notepad.exe PID 1940 wrote to memory of 5608 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe notepad.exe PID 1940 wrote to memory of 5608 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe notepad.exe PID 1940 wrote to memory of 5608 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe notepad.exe PID 1940 wrote to memory of 5720 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe cmd.exe PID 1940 wrote to memory of 5720 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe cmd.exe PID 1940 wrote to memory of 5720 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe cmd.exe PID 1940 wrote to memory of 5720 1940 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe cmd.exe PID 5720 wrote to memory of 5920 5720 cmd.exe taskkill.exe PID 5720 wrote to memory of 5920 5720 cmd.exe taskkill.exe PID 5720 wrote to memory of 5920 5720 cmd.exe taskkill.exe PID 5720 wrote to memory of 5920 5720 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe"C:\Users\Admin\AppData\Local\Temp\162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\E4E0A7-Readme.txt"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2AB8.tmp.bat"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 19403⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp.batMD5
d8fe8a214fba930a39f6aab3a344889b
SHA152961dd3e863088363abebec9a629d73a1365917
SHA25664eb1fe708c2f9dfc2468f4467cec20d6e83b93051763b31d1be7289d42d4e68
SHA512e3dba09e135665fa6b7f5907ec54bffca0596a0dbd2a87d42b8306ca1fbce137e40c26de29b79312121ec761682311d94d130eb53e087fc79e805a6ba8d5a90a
-
C:\Users\Admin\Desktop\E4E0A7-Readme.txtMD5
e8b552facdf573ed5f2ae514c9a879ab
SHA182d78d9cd9ddca3e55cb1cb4f92fe6c872af0568
SHA256b3ce97abf2810f2490cd6f010fda3f1b6f6179fbc2b96baacc339f1ba00977f2
SHA5120e03082970a12ad21224c5894c5ad61a836718e448ae83df03533b4fba65f1d53ba9092416a343f5f471b0f90cd31409da7081db61b65ec839496c95292cef61
-
memory/1412-0-0x0000000000000000-mapping.dmp
-
memory/5608-4-0x0000000000000000-mapping.dmp
-
memory/5720-7-0x0000000000000000-mapping.dmp
-
memory/5920-12-0x0000000000000000-mapping.dmp