Analysis
-
max time kernel
85s -
max time network
29s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-01-2021 14:14
Static task
static1
Behavioral task
behavioral1
Sample
af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe
Resource
win10v20201028
General
-
Target
af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe
-
Size
66KB
-
MD5
1b033111b8923c12f1d84e09769806f5
-
SHA1
2ab84be1752574bac3ad0f9a8f9107fa5657033a
-
SHA256
af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa
-
SHA512
2c47a5121eb0cd965f29b934a2a8536da7245eee42c7e66987410b537240f502a4b94263423ced8600be9a6fa61540bb218d4fa9f2213b888b28f0e331462c9c
Malware Config
Extracted
C:\58D8C7-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\58D8C7-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\BackupInvoke.tiff af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File renamed C:\Users\Admin\Pictures\SetConvertFrom.raw => C:\Users\Admin\Pictures\SetConvertFrom.raw.58d8c7 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File renamed C:\Users\Admin\Pictures\PushMount.crw => C:\Users\Admin\Pictures\PushMount.crw.58d8c7 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File renamed C:\Users\Admin\Pictures\RemoveStop.tiff => C:\Users\Admin\Pictures\RemoveStop.tiff.58d8c7 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File renamed C:\Users\Admin\Pictures\AddUnlock.tif => C:\Users\Admin\Pictures\AddUnlock.tif.58d8c7 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File renamed C:\Users\Admin\Pictures\UninstallReceive.raw => C:\Users\Admin\Pictures\UninstallReceive.raw.58d8c7 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Users\Admin\Pictures\RemoveStop.tiff af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File renamed C:\Users\Admin\Pictures\BackupInvoke.tiff => C:\Users\Admin\Pictures\BackupInvoke.tiff.58d8c7 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File renamed C:\Users\Admin\Pictures\WaitFind.tif => C:\Users\Admin\Pictures\WaitFind.tif.58d8c7 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File renamed C:\Users\Admin\Pictures\CompressStop.tif => C:\Users\Admin\Pictures\CompressStop.tif.58d8c7 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 6720 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 8926 IoCs
Processes:
af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\fur.txt af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105386.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107132.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239967.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Maceio af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART8.BDR af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153093.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Groove.gif af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21326_.GIF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FRENCH.LNG af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_rtp_plugin.dll af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SOCIALPROVIDER.DLL af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianResume.Dotx af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02263_.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BROCHURE.DPV af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0171685.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\nl.pak af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\58D8C7-Readme.txt af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02444_.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\LoginForm.zip af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_F_COL.HXK af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\58D8C7-Readme.txt af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21337_.GIF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02024_.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\1100.accdt af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCHKBRD.DPV af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00256_.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\58D8C7-Readme.txt af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01069_.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0221903.WMF af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1520 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 12824 IoCs
Processes:
af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exepid process 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe Token: SeImpersonatePrivilege 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe Token: SeDebugPrivilege 1520 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.execmd.exedescription pid process target process PID 2028 wrote to memory of 5648 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe notepad.exe PID 2028 wrote to memory of 5648 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe notepad.exe PID 2028 wrote to memory of 5648 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe notepad.exe PID 2028 wrote to memory of 5648 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe notepad.exe PID 2028 wrote to memory of 6720 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe cmd.exe PID 2028 wrote to memory of 6720 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe cmd.exe PID 2028 wrote to memory of 6720 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe cmd.exe PID 2028 wrote to memory of 6720 2028 af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe cmd.exe PID 6720 wrote to memory of 1520 6720 cmd.exe taskkill.exe PID 6720 wrote to memory of 1520 6720 cmd.exe taskkill.exe PID 6720 wrote to memory of 1520 6720 cmd.exe taskkill.exe PID 6720 wrote to memory of 1520 6720 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe"C:\Users\Admin\AppData\Local\Temp\af03b1a30294baaca1cdb803f86a6bed945aa69544cb3d37fb99f1412568b7aa.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\58D8C7-Readme.txt"2⤵PID:5648
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4FA6.tmp.bat"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:6720 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 20283⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp.batMD5
634bfce3774824571ef8cd82ba5d738c
SHA1aa5debb66b9ac95bc5295d7a324f8a5aeddec0d1
SHA256df89e789aec7779cd60160f4ca9784ebeb8b530905a594fd4d43a4c675edd7cd
SHA51246b0ae71931f16e3b37ec3bf481ab88c62e2341ace7587977d15b7435b31d28b325767a21d30ada3415284d3593b698b44918b14f9c3fdde1b1e6d2e37ea98a0
-
C:\Users\Admin\Desktop\58D8C7-Readme.txtMD5
704222230038862e680711b72e7ba57d
SHA1952af48edcdb98cceee9a2d2083aa46404062dc8
SHA2565f1a5baf2ae5a1adceecb13a98ea8495f3d336a0b7577b7dd3f8cb41451cace7
SHA512b577a4f9d2e03968a556dd2c4f65e58f40eded1ae27ea03b47f41172bbeea2039db9a1300ad74c08a9ebdf6727fbfbb7695e5f0301d303e98f726dab914d3b4b
-
memory/1520-7-0x0000000000000000-mapping.dmp
-
memory/2028-2-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB
-
memory/5648-3-0x0000000000000000-mapping.dmp
-
memory/6720-5-0x0000000000000000-mapping.dmp