Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17/11/2020, 11:26
Static task
static1
Behavioral task
behavioral1
Sample
735e27f460be6edce9f0cd5c0d0972b0.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
735e27f460be6edce9f0cd5c0d0972b0.exe
Resource
win10v20201028
General
-
Target
735e27f460be6edce9f0cd5c0d0972b0.exe
-
Size
173KB
-
MD5
2df254dce86ca636e77f4ad422d21da4
-
SHA1
4efa723962bc64e753742f5fdeec4dc1c2985a51
-
SHA256
a1a1e34dbc30a46811f5b717f808908412aa6f3d6840aa526d5c0154e008558e
-
SHA512
9cc70f4525162dfeedba5c3ec421fbf219596077824489cd74d3bc9038c00d96210396312a7426416db1df62d3cad7b71167145aaa1ff8c3623645ffcfa53acd
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
http://cerberhhyed5frqa.onion.to/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.cab/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.nu/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.link/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.tor2web.org/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.to/83B4-FED4-14BB-0000-0415);
http://cerberhhyed5frqa.onion/83B4-FED4-14BB-0000-0415
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://cerberhhyed5frqa.onion.to/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.cab/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.nu/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.link/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.tor2web.org/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.to/83B4-FED4-14BB-0000-0415);
http://cerberhhyed5frqa.onion/83B4-FED4-14BB-0000-0415
Signatures
-
Ursnif RM3
A heavily modified version of Ursnif discovered in the wild.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\ntoskrnl.exe\"" 735e27f460be6edce9f0cd5c0d0972b0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\ntoskrnl.exe\"" ntoskrnl.exe -
Executes dropped EXE 3 IoCs
pid Process 1232 ntoskrnl.exe 1336 ntoskrnl.exe 1624 ntoskrnl.exe -
Deletes itself 1 IoCs
pid Process 1100 cmd.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ntoskrnl.lnk 735e27f460be6edce9f0cd5c0d0972b0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ntoskrnl.lnk ntoskrnl.exe -
Loads dropped DLL 2 IoCs
pid Process 292 735e27f460be6edce9f0cd5c0d0972b0.exe 1232 ntoskrnl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 735e27f460be6edce9f0cd5c0d0972b0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ntoskrnl = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\ntoskrnl.exe\"" 735e27f460be6edce9f0cd5c0d0972b0.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run ntoskrnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntoskrnl = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\ntoskrnl.exe\"" ntoskrnl.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce ntoskrnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ntoskrnl = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\ntoskrnl.exe\"" ntoskrnl.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run 735e27f460be6edce9f0cd5c0d0972b0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntoskrnl = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\ntoskrnl.exe\"" 735e27f460be6edce9f0cd5c0d0972b0.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ntoskrnl.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ipinfo.io -
Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 880 vssadmin.exe -
Kills process with taskkill 2 IoCs
pid Process 1624 taskkill.exe 2328 taskkill.exe -
Modifies Control Panel 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop ntoskrnl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\ntoskrnl.exe\"" ntoskrnl.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop 735e27f460be6edce9f0cd5c0d0972b0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\ntoskrnl.exe\"" 735e27f460be6edce9f0cd5c0d0972b0.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0aefa57d9bcd601 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000fc46876d6a659df303ba7baf7a3648d8a283b9d93dd8d66b3471d95f819ea781000000000e80000000020000200000007b1a802acb9e1c389839267cdedd22719a2c0d1cec03d96421b3dad604841c4a90000000b7d521860cd35970edddc31c0606cf76ab2746265fb5166b5fd2e691b35865c8eabb47d051e9ecb22f003b28fa24dc67db5bac598a3388492edda9713c301990ea7f1f2108f87a074e3dcadef48306eae4fb7b0ae25eb3e4c289e648357de9a546fc49a6ef37ef282833993fd07d834d16eedf4d4d6bc9e2fe2654c7e1be5a218aa5cccf687b76f7e692944cbc5f169a4000000001335acc18a542fa3ec75005228aa92718c2fa22961cf7e1555dc462c11d6747c5943f4d12e176141570211cc7d32e1a5e8c5128e97aa9f3dd447f73c80f6e31 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "312379442" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{935F61C1-28CC-11EB-B2E7-DA78EDA9FF87} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{931CBB41-28CC-11EB-B2E7-DA78EDA9FF87} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a600000000002000000000010660000000100002000000088b10d4a5f754a268d6ce9ce5446888418bcc9b7999392769c8ad5e2084e794c000000000e800000000200002000000000a65b1eca52c04537841579abecd4f595bd7959f88f66df1a58296b37bf336320000000c3d06f5dc953cf0a151ff487dd197e0b60bd2e40bb894a262966cf9da6bb611740000000ff8380a497ea2d001460d5dda91679f2e3f74ca57bf72cddeeebb5b8d12f974b4db30267cbfc139486c3513056dfd997434ca4739cee82d4c46f41a04c313262 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 1416 PING.EXE 2372 PING.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe 1232 ntoskrnl.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeDebugPrivilege 292 735e27f460be6edce9f0cd5c0d0972b0.exe Token: SeDebugPrivilege 1232 ntoskrnl.exe Token: SeDebugPrivilege 1624 taskkill.exe Token: SeBackupPrivilege 1008 vssvc.exe Token: SeRestorePrivilege 1008 vssvc.exe Token: SeAuditPrivilege 1008 vssvc.exe Token: SeIncreaseQuotaPrivilege 1200 wmic.exe Token: SeSecurityPrivilege 1200 wmic.exe Token: SeTakeOwnershipPrivilege 1200 wmic.exe Token: SeLoadDriverPrivilege 1200 wmic.exe Token: SeSystemProfilePrivilege 1200 wmic.exe Token: SeSystemtimePrivilege 1200 wmic.exe Token: SeProfSingleProcessPrivilege 1200 wmic.exe Token: SeIncBasePriorityPrivilege 1200 wmic.exe Token: SeCreatePagefilePrivilege 1200 wmic.exe Token: SeBackupPrivilege 1200 wmic.exe Token: SeRestorePrivilege 1200 wmic.exe Token: SeShutdownPrivilege 1200 wmic.exe Token: SeDebugPrivilege 1200 wmic.exe Token: SeSystemEnvironmentPrivilege 1200 wmic.exe Token: SeRemoteShutdownPrivilege 1200 wmic.exe Token: SeUndockPrivilege 1200 wmic.exe Token: SeManageVolumePrivilege 1200 wmic.exe Token: 33 1200 wmic.exe Token: 34 1200 wmic.exe Token: 35 1200 wmic.exe Token: SeIncreaseQuotaPrivilege 1200 wmic.exe Token: SeSecurityPrivilege 1200 wmic.exe Token: SeTakeOwnershipPrivilege 1200 wmic.exe Token: SeLoadDriverPrivilege 1200 wmic.exe Token: SeSystemProfilePrivilege 1200 wmic.exe Token: SeSystemtimePrivilege 1200 wmic.exe Token: SeProfSingleProcessPrivilege 1200 wmic.exe Token: SeIncBasePriorityPrivilege 1200 wmic.exe Token: SeCreatePagefilePrivilege 1200 wmic.exe Token: SeBackupPrivilege 1200 wmic.exe Token: SeRestorePrivilege 1200 wmic.exe Token: SeShutdownPrivilege 1200 wmic.exe Token: SeDebugPrivilege 1200 wmic.exe Token: SeSystemEnvironmentPrivilege 1200 wmic.exe Token: SeRemoteShutdownPrivilege 1200 wmic.exe Token: SeUndockPrivilege 1200 wmic.exe Token: SeManageVolumePrivilege 1200 wmic.exe Token: 33 1200 wmic.exe Token: 34 1200 wmic.exe Token: 35 1200 wmic.exe Token: SeDebugPrivilege 1336 ntoskrnl.exe Token: SeDebugPrivilege 1624 ntoskrnl.exe Token: 33 948 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 948 AUDIODG.EXE Token: 33 948 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 948 AUDIODG.EXE Token: SeDebugPrivilege 2328 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1144 iexplore.exe 1336 iexplore.exe 1144 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1144 iexplore.exe 1144 iexplore.exe 1336 iexplore.exe 1336 iexplore.exe 1144 iexplore.exe 1144 iexplore.exe 592 IEXPLORE.EXE 592 IEXPLORE.EXE 592 IEXPLORE.EXE 592 IEXPLORE.EXE 944 IEXPLORE.EXE 944 IEXPLORE.EXE 592 IEXPLORE.EXE 592 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 292 wrote to memory of 1232 292 735e27f460be6edce9f0cd5c0d0972b0.exe 29 PID 292 wrote to memory of 1232 292 735e27f460be6edce9f0cd5c0d0972b0.exe 29 PID 292 wrote to memory of 1232 292 735e27f460be6edce9f0cd5c0d0972b0.exe 29 PID 292 wrote to memory of 1232 292 735e27f460be6edce9f0cd5c0d0972b0.exe 29 PID 292 wrote to memory of 1100 292 735e27f460be6edce9f0cd5c0d0972b0.exe 30 PID 292 wrote to memory of 1100 292 735e27f460be6edce9f0cd5c0d0972b0.exe 30 PID 292 wrote to memory of 1100 292 735e27f460be6edce9f0cd5c0d0972b0.exe 30 PID 292 wrote to memory of 1100 292 735e27f460be6edce9f0cd5c0d0972b0.exe 30 PID 1232 wrote to memory of 880 1232 ntoskrnl.exe 32 PID 1232 wrote to memory of 880 1232 ntoskrnl.exe 32 PID 1232 wrote to memory of 880 1232 ntoskrnl.exe 32 PID 1232 wrote to memory of 880 1232 ntoskrnl.exe 32 PID 1100 wrote to memory of 1624 1100 cmd.exe 34 PID 1100 wrote to memory of 1624 1100 cmd.exe 34 PID 1100 wrote to memory of 1624 1100 cmd.exe 34 PID 1100 wrote to memory of 1624 1100 cmd.exe 34 PID 1232 wrote to memory of 1200 1232 ntoskrnl.exe 37 PID 1232 wrote to memory of 1200 1232 ntoskrnl.exe 37 PID 1232 wrote to memory of 1200 1232 ntoskrnl.exe 37 PID 1232 wrote to memory of 1200 1232 ntoskrnl.exe 37 PID 1100 wrote to memory of 1416 1100 cmd.exe 39 PID 1100 wrote to memory of 1416 1100 cmd.exe 39 PID 1100 wrote to memory of 1416 1100 cmd.exe 39 PID 1100 wrote to memory of 1416 1100 cmd.exe 39 PID 1352 wrote to memory of 1336 1352 taskeng.exe 43 PID 1352 wrote to memory of 1336 1352 taskeng.exe 43 PID 1352 wrote to memory of 1336 1352 taskeng.exe 43 PID 1352 wrote to memory of 1336 1352 taskeng.exe 43 PID 1352 wrote to memory of 1624 1352 taskeng.exe 45 PID 1352 wrote to memory of 1624 1352 taskeng.exe 45 PID 1352 wrote to memory of 1624 1352 taskeng.exe 45 PID 1352 wrote to memory of 1624 1352 taskeng.exe 45 PID 1232 wrote to memory of 1144 1232 ntoskrnl.exe 46 PID 1232 wrote to memory of 1144 1232 ntoskrnl.exe 46 PID 1232 wrote to memory of 1144 1232 ntoskrnl.exe 46 PID 1232 wrote to memory of 1144 1232 ntoskrnl.exe 46 PID 1232 wrote to memory of 1560 1232 ntoskrnl.exe 47 PID 1232 wrote to memory of 1560 1232 ntoskrnl.exe 47 PID 1232 wrote to memory of 1560 1232 ntoskrnl.exe 47 PID 1232 wrote to memory of 1560 1232 ntoskrnl.exe 47 PID 1144 wrote to memory of 592 1144 iexplore.exe 49 PID 1144 wrote to memory of 592 1144 iexplore.exe 49 PID 1144 wrote to memory of 592 1144 iexplore.exe 49 PID 1144 wrote to memory of 592 1144 iexplore.exe 49 PID 1336 wrote to memory of 944 1336 iexplore.exe 50 PID 1336 wrote to memory of 944 1336 iexplore.exe 50 PID 1336 wrote to memory of 944 1336 iexplore.exe 50 PID 1336 wrote to memory of 944 1336 iexplore.exe 50 PID 1232 wrote to memory of 1904 1232 ntoskrnl.exe 51 PID 1232 wrote to memory of 1904 1232 ntoskrnl.exe 51 PID 1232 wrote to memory of 1904 1232 ntoskrnl.exe 51 PID 1232 wrote to memory of 1904 1232 ntoskrnl.exe 51 PID 1232 wrote to memory of 2292 1232 ntoskrnl.exe 55 PID 1232 wrote to memory of 2292 1232 ntoskrnl.exe 55 PID 1232 wrote to memory of 2292 1232 ntoskrnl.exe 55 PID 1232 wrote to memory of 2292 1232 ntoskrnl.exe 55 PID 2292 wrote to memory of 2328 2292 cmd.exe 57 PID 2292 wrote to memory of 2328 2292 cmd.exe 57 PID 2292 wrote to memory of 2328 2292 cmd.exe 57 PID 2292 wrote to memory of 2328 2292 cmd.exe 57 PID 2292 wrote to memory of 2372 2292 cmd.exe 58 PID 2292 wrote to memory of 2372 2292 cmd.exe 58 PID 2292 wrote to memory of 2372 2292 cmd.exe 58 PID 2292 wrote to memory of 2372 2292 cmd.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\735e27f460be6edce9f0cd5c0d0972b0.exe"C:\Users\Admin\AppData\Local\Temp\735e27f460be6edce9f0cd5c0d0972b0.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\ntoskrnl.exe"C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\ntoskrnl.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:880
-
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1144 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:592
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵PID:1560
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵PID:1904
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "ntoskrnl.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\ntoskrnl.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "ntoskrnl.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
PID:2372
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "735e27f460be6edce9f0cd5c0d0972b0.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\735e27f460be6edce9f0cd5c0d0972b0.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "735e27f460be6edce9f0cd5c0d0972b0.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:1416
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
C:\Windows\system32\taskeng.exetaskeng.exe {760246CC-2274-42A1-8FCC-3809EBBB384B} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\ntoskrnl.exeC:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\ntoskrnl.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1336
-
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\ntoskrnl.exeC:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\ntoskrnl.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:944
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:608
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x57c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:948