Analysis
-
max time kernel
120s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-02-2021 16:02
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe
-
Size
467KB
-
MD5
1872d50febed32fe549f3c1257ede6bc
-
SHA1
8f5d4c4c47e3d0e1071a974d92f8bba0d9ae4b6a
-
SHA256
0ed05e4be5376f0cf391a78afc7a3114ffbfa064348fb66cd93e8ee6f6b27fe1
-
SHA512
bdcfc894b05b73af687315aa7f2ed9643462a07cbc9a7aa95d635e00fae620c5247f6863d63af4b084fd5b488a88a4eb63bf3971744b3e6319622596899e5bdb
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\readme-warning.txt
makop
toddmhickey@outlook.com
jamiepenkaty@cock.li
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Nirsoft 7 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exe Nirsoft -
Processes:
wbadmin.exepid process 652 wbadmin.exe -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 1672 AdvancedRun.exe 332 AdvancedRun.exe -
Loads dropped DLL 4 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exeAdvancedRun.exepid process 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1672 AdvancedRun.exe 1672 AdvancedRun.exe -
Processes:
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe = "0" SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe -
Processes:
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exepid process 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exedescription pid process target process PID 1108 set thread context of 296 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe -
Drops file in Program Files directory 64 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\descript.ion SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\7z.sfx SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\CloseDebug.m1v SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe File opened for modification C:\Program Files\7-Zip\License.txt SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1900 1108 WerFault.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 632 timeout.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1528 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exeSecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exeWerFault.exeSecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exepid process 1672 AdvancedRun.exe 1672 AdvancedRun.exe 332 AdvancedRun.exe 332 AdvancedRun.exe 1016 powershell.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe 1016 powershell.exe 1900 WerFault.exe 1900 WerFault.exe 1900 WerFault.exe 1900 WerFault.exe 1900 WerFault.exe 1900 WerFault.exe 296 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exeAdvancedRun.exeAdvancedRun.exepowershell.exeSecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exevssvc.exeWerFault.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe Token: SeDebugPrivilege 1672 AdvancedRun.exe Token: SeImpersonatePrivilege 1672 AdvancedRun.exe Token: SeDebugPrivilege 332 AdvancedRun.exe Token: SeImpersonatePrivilege 332 AdvancedRun.exe Token: SeDebugPrivilege 1016 powershell.exe Token: SeDebugPrivilege 1608 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe Token: SeBackupPrivilege 332 vssvc.exe Token: SeRestorePrivilege 332 vssvc.exe Token: SeAuditPrivilege 332 vssvc.exe Token: SeDebugPrivilege 1900 WerFault.exe Token: SeBackupPrivilege 1564 wbengine.exe Token: SeRestorePrivilege 1564 wbengine.exe Token: SeSecurityPrivilege 1564 wbengine.exe Token: SeIncreaseQuotaPrivilege 892 WMIC.exe Token: SeSecurityPrivilege 892 WMIC.exe Token: SeTakeOwnershipPrivilege 892 WMIC.exe Token: SeLoadDriverPrivilege 892 WMIC.exe Token: SeSystemProfilePrivilege 892 WMIC.exe Token: SeSystemtimePrivilege 892 WMIC.exe Token: SeProfSingleProcessPrivilege 892 WMIC.exe Token: SeIncBasePriorityPrivilege 892 WMIC.exe Token: SeCreatePagefilePrivilege 892 WMIC.exe Token: SeBackupPrivilege 892 WMIC.exe Token: SeRestorePrivilege 892 WMIC.exe Token: SeShutdownPrivilege 892 WMIC.exe Token: SeDebugPrivilege 892 WMIC.exe Token: SeSystemEnvironmentPrivilege 892 WMIC.exe Token: SeRemoteShutdownPrivilege 892 WMIC.exe Token: SeUndockPrivilege 892 WMIC.exe Token: SeManageVolumePrivilege 892 WMIC.exe Token: 33 892 WMIC.exe Token: 34 892 WMIC.exe Token: 35 892 WMIC.exe Token: SeIncreaseQuotaPrivilege 892 WMIC.exe Token: SeSecurityPrivilege 892 WMIC.exe Token: SeTakeOwnershipPrivilege 892 WMIC.exe Token: SeLoadDriverPrivilege 892 WMIC.exe Token: SeSystemProfilePrivilege 892 WMIC.exe Token: SeSystemtimePrivilege 892 WMIC.exe Token: SeProfSingleProcessPrivilege 892 WMIC.exe Token: SeIncBasePriorityPrivilege 892 WMIC.exe Token: SeCreatePagefilePrivilege 892 WMIC.exe Token: SeBackupPrivilege 892 WMIC.exe Token: SeRestorePrivilege 892 WMIC.exe Token: SeShutdownPrivilege 892 WMIC.exe Token: SeDebugPrivilege 892 WMIC.exe Token: SeSystemEnvironmentPrivilege 892 WMIC.exe Token: SeRemoteShutdownPrivilege 892 WMIC.exe Token: SeUndockPrivilege 892 WMIC.exe Token: SeManageVolumePrivilege 892 WMIC.exe Token: 33 892 WMIC.exe Token: 34 892 WMIC.exe Token: 35 892 WMIC.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exeAdvancedRun.execmd.exeSecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.execmd.exedescription pid process target process PID 1108 wrote to memory of 1672 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe AdvancedRun.exe PID 1108 wrote to memory of 1672 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe AdvancedRun.exe PID 1108 wrote to memory of 1672 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe AdvancedRun.exe PID 1108 wrote to memory of 1672 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe AdvancedRun.exe PID 1672 wrote to memory of 332 1672 AdvancedRun.exe AdvancedRun.exe PID 1672 wrote to memory of 332 1672 AdvancedRun.exe AdvancedRun.exe PID 1672 wrote to memory of 332 1672 AdvancedRun.exe AdvancedRun.exe PID 1672 wrote to memory of 332 1672 AdvancedRun.exe AdvancedRun.exe PID 1108 wrote to memory of 1016 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe powershell.exe PID 1108 wrote to memory of 1016 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe powershell.exe PID 1108 wrote to memory of 1016 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe powershell.exe PID 1108 wrote to memory of 1016 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe powershell.exe PID 1108 wrote to memory of 1636 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe powershell.exe PID 1108 wrote to memory of 1636 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe powershell.exe PID 1108 wrote to memory of 1636 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe powershell.exe PID 1108 wrote to memory of 1636 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe powershell.exe PID 1108 wrote to memory of 952 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe cmd.exe PID 1108 wrote to memory of 952 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe cmd.exe PID 1108 wrote to memory of 952 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe cmd.exe PID 1108 wrote to memory of 952 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe cmd.exe PID 952 wrote to memory of 632 952 cmd.exe timeout.exe PID 952 wrote to memory of 632 952 cmd.exe timeout.exe PID 952 wrote to memory of 632 952 cmd.exe timeout.exe PID 952 wrote to memory of 632 952 cmd.exe timeout.exe PID 1108 wrote to memory of 296 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe PID 1108 wrote to memory of 296 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe PID 1108 wrote to memory of 296 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe PID 1108 wrote to memory of 296 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe PID 1108 wrote to memory of 296 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe PID 1108 wrote to memory of 296 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe PID 1108 wrote to memory of 296 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe PID 1108 wrote to memory of 296 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe PID 1108 wrote to memory of 296 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe PID 1108 wrote to memory of 296 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe PID 296 wrote to memory of 1696 296 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe cmd.exe PID 296 wrote to memory of 1696 296 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe cmd.exe PID 296 wrote to memory of 1696 296 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe cmd.exe PID 296 wrote to memory of 1696 296 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe cmd.exe PID 1108 wrote to memory of 1900 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe WerFault.exe PID 1108 wrote to memory of 1900 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe WerFault.exe PID 1108 wrote to memory of 1900 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe WerFault.exe PID 1108 wrote to memory of 1900 1108 SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe WerFault.exe PID 1696 wrote to memory of 1528 1696 cmd.exe vssadmin.exe PID 1696 wrote to memory of 1528 1696 cmd.exe vssadmin.exe PID 1696 wrote to memory of 1528 1696 cmd.exe vssadmin.exe PID 1696 wrote to memory of 652 1696 cmd.exe wbadmin.exe PID 1696 wrote to memory of 652 1696 cmd.exe wbadmin.exe PID 1696 wrote to memory of 652 1696 cmd.exe wbadmin.exe PID 1696 wrote to memory of 892 1696 cmd.exe WMIC.exe PID 1696 wrote to memory of 892 1696 cmd.exe WMIC.exe PID 1696 wrote to memory of 892 1696 cmd.exe WMIC.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe"1⤵
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exe" /SpecialRun 4101d8 16723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe" -Force2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36380495.3131.9989.exe" n2963⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 14722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
b0c90dda99a84ae09551bef11316c51c
SHA189d1844d70561a194f762c65490b7b4bff9ac451
SHA256b9774b2264869b4b66f5c012e6d769bc35eb140f35e0bb9967c0ed21adbae80e
SHA5123f72b025a47199dbd9cf51ed70023d736819dfd6df88a8854852cae96e32ed3805adcafaa77e0765c5efc97d1e2fbd36f354471e16b613d54bb25023d0950ca5
-
\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\ad86f005-6749-425b-8c9c-48a4fddcb5a7\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/296-34-0x00000000004053F0-mapping.dmp
-
memory/296-46-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/296-33-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/332-15-0x0000000000000000-mapping.dmp
-
memory/632-28-0x0000000000000000-mapping.dmp
-
memory/652-78-0x0000000000000000-mapping.dmp
-
memory/652-82-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmpFilesize
8KB
-
memory/892-85-0x0000000000000000-mapping.dmp
-
memory/952-22-0x0000000000000000-mapping.dmp
-
memory/1016-48-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/1016-57-0x00000000060C0000-0x00000000060C1000-memory.dmpFilesize
4KB
-
memory/1016-26-0x0000000000B80000-0x0000000000B81000-memory.dmpFilesize
4KB
-
memory/1016-84-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/1016-83-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/1016-29-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/1016-30-0x00000000048F0000-0x00000000048F1000-memory.dmpFilesize
4KB
-
memory/1016-67-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/1016-32-0x00000000048F2000-0x00000000048F3000-memory.dmpFilesize
4KB
-
memory/1016-18-0x0000000000000000-mapping.dmp
-
memory/1016-66-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/1016-36-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/1016-62-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1016-58-0x0000000006170000-0x0000000006171000-memory.dmpFilesize
4KB
-
memory/1016-24-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1016-52-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/1108-5-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/1108-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1108-3-0x0000000001100000-0x0000000001101000-memory.dmpFilesize
4KB
-
memory/1108-6-0x0000000000540000-0x00000000005BC000-memory.dmpFilesize
496KB
-
memory/1528-43-0x0000000000000000-mapping.dmp
-
memory/1608-47-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/1608-38-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1636-25-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1636-19-0x0000000000000000-mapping.dmp
-
memory/1636-31-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/1672-9-0x0000000000000000-mapping.dmp
-
memory/1672-11-0x00000000760D1000-0x00000000760D3000-memory.dmpFilesize
8KB
-
memory/1696-37-0x0000000000000000-mapping.dmp
-
memory/1900-41-0x0000000000000000-mapping.dmp
-
memory/1900-42-0x00000000008C0000-0x00000000008D1000-memory.dmpFilesize
68KB
-
memory/1900-49-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB