4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin

General
Target

4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe

Filesize

500KB

Completed

05-01-2021 19:40

Score
10 /10
MD5

83e1ca89bcd55a87f826bc6901ff7f3e

SHA1

d0db4d232331234f0c430008a4320c0dea993c20

SHA256

4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b

Malware Config
Signatures 8

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Impact
  • Mespinoza Ransomware

    Description

    Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

    TTPs

    Query RegistryData Encrypted for Impact
  • Modifies extensions of user files
    4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\Pictures\RevokeMove.png.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File renamedC:\Users\Admin\Pictures\AddProtect.raw => C:\Users\Admin\Pictures\AddProtect.raw.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File renamedC:\Users\Admin\Pictures\AssertShow.tif => C:\Users\Admin\Pictures\AssertShow.tif.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File renamedC:\Users\Admin\Pictures\CloseComplete.crw => C:\Users\Admin\Pictures\CloseComplete.crw.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\CloseComplete.crw.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\ExitEnable.raw.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File renamedC:\Users\Admin\Pictures\RevokeMove.png => C:\Users\Admin\Pictures\RevokeMove.png.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\AddProtect.raw.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\AssertShow.tif.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File renamedC:\Users\Admin\Pictures\DisconnectCompress.tif => C:\Users\Admin\Pictures\DisconnectCompress.tif.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\DisconnectCompress.tif.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File renamedC:\Users\Admin\Pictures\ExitEnable.raw => C:\Users\Admin\Pictures\ExitEnable.raw.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Drops file in Program Files directory
    4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\he-il\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\ui-strings.js.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\ui-strings.js.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\de_get.svg.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\ui-strings.js.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\NewSet.m1v.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\ui-strings.js.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.svg.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\Java\jre1.8.0_66\lib\ext\sunec.jar.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\PlayStore_icon.svg.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Common Files\System\msadc\en-US\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files\VideoLAN\VLC\locale\pa\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare-2x.png.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-view.css.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sv_get.svg.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files\Common Files\microsoft shared\ink\en-GB\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\export.svg.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\ui-strings.js.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview2x.png.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\ui-strings.js.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    File opened for modificationC:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSGet.Resource.psd1.pysa4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
  • Drops file in Windows directory
    4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\Readme.README4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious use of WriteProcessMemory
    4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4776 wrote to memory of 206847764dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.execmd.exe
    PID 4776 wrote to memory of 206847764dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.execmd.exe
    PID 4776 wrote to memory of 206847764dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.execmd.exe
  • System policy modification
    4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe

    Tags

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = 48006900200043006f006d00700061006e0079002c000d000a000d000a00450076006500720079002000620079007400650020006f006e00200061006e00790020007400790070006500730020006f006600200079006f0075007200200064006500760069006300650073002000770061007300200065006e0063007200790070007400650064002e000d000a0044006f006e00270074002000740072007900200074006f00200075007300650020006200610063006b007500700073002000620065006300610075007300650020006900740020007700650072006500200065006e006300720079007000740065006400200074006f006f002e000d000a000d000a0054006f002000670065007400200061006c006c00200079006f00750072002000640061007400610020006200610063006b00200063006f006e0074006100630074002000750073003a000d000a0065006c00610069006e00610072006f006e00650061006c0040006f006e0069006f006e006d00610069006c002e006f00720067000d000a006800610079006c0065007900630061006e0064006c006500720040006f006e0069006f006e006d00610069006c002e006f00720067000d000a0076006900630074006f007200690061007300610064006c006900650072004000700072006f0074006f006e006d00610069006c002e0063006f006d000d000a000d000a0041006c0073006f002c0020006200650020006100770061007200650020007400680061007400200077006500200064006f0077006e006c006f0061006400650064002000660069006c00650073002000660072006f006d00200079006f007500720020007300650072007600650072007300200061006e006400200069006e002000630061007300650020006f00660020006e006f006e002d007000610079006d0065006e0074002000770065002000770069006c006c00200062006500200066006f007200630065006400200074006f002000750070006c006f006100640020007400680065006d0020006f006e0020006f0075007200200077006500620073006900740065002c00200061006e00640020006900660020006e00650063006500730073006100720079002c002000770065002000770069006c006c002000730065006c006c0020007400680065006d0020006f006e00200074006800650020006400610072006b006e00650074002e000d000a0043006800650063006b0020006f007500740020006f0075007200200077006500620073006900740065002c0020007700650020006a00750073007400200070006f00730074006500640020007400680065007200650020006e006500770020007500700064006100740065007300200066006f00720020006f0075007200200070006100720074006e006500720073003a00200068007400740070003a002f002f00770071006d0066007a006e00690032006e0076006200620070006b00320035002e006f006e0069006f006e002f000d000a002d002d002d002d002d002d002d002d002d002d002d002d002d002d000d000a000d000a004600410051003a000d000a000d000a0031002e000d000a0020002000200051003a00200048006f0077002000630061006e002000490020006d0061006b00650020007300750072006500200079006f007500200064006f006e0027007400200066006f006f006c0069006e00670020006d0065003f000d000a0020002000200041003a00200059006f0075002000630061006e002000730065006e006400200075007300200032002000660069006c006500730028006d0061007800200032006d00620029002e000d000a000d000a0032002e000d000a0020002000200051003a0020005700680061007400200074006f00200064006f00200074006f002000670065007400200061006c006c002000640061007400610020006200610063006b003f000d000a0020002000200041003a00200044006f006e0027007400200072006500730074006100720074002000740068006500200063006f006d00700075007400650072002c00200064006f006e002700740020006d006f00760065002000660069006c0065007300200061006e0064002000770072006900740065002000750073002e000d000a000d000a0033002e000d000a0020002000200051003a0020005700680061007400200074006f002000740065006c006c0020006d007900200062006f00730073003f000d000a0020002000200041003a002000500072006f007400650063007400200059006f00750072002000530079007300740065006d00200041006d00690067006f002e000d000a000d000a0000004dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = 500059005300410000004dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin.exe"
    Modifies extensions of user files
    Drops file in Program Files directory
    Drops file in Windows directory
    Suspicious use of WriteProcessMemory
    System policy modification
    PID:4776
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
      PID:2068
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Execution
      Exfiltration
        Initial Access
          Lateral Movement
            Persistence
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Users\Admin\AppData\Local\Temp\update.bat

                  MD5

                  75cc55377c2348720a37f9bdace6ce14

                  SHA1

                  fd6d28d77391b6453296dd65fb5b475d68da5c47

                  SHA256

                  1d6b39b6ca1dee8e0ab2067d4a6e09650eed9ca275a10aa3e44baa21ada377f6

                  SHA512

                  d53c4ee271dcdc7115e9167510ab497d4c31d8925dd41943ca4e29e18ff5e5eff074462873452647c950d809860907602305d6ac6083fc83c218bbcc6b60f729

                • memory/2068-2-0x0000000000000000-mapping.dmp