Analysis
-
max time kernel
150s -
max time network
91s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-04-2021 05:06
Static task
static1
Behavioral task
behavioral1
Sample
051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe
Resource
win10v20201028
General
-
Target
051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe
-
Size
500KB
-
MD5
768ba1196f9534928ad2f8ffa12bd7f7
-
SHA1
b435fedf7e40e3ef24dba050102d63e2d5aa2e1e
-
SHA256
051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6
-
SHA512
17c8fcf034b6e9d41aace6486eaa1d550e77b305ca0c72804d9825d0bebccb1b2f639324bc5f0c75b565e26494edefa4219dc8f17db0162dbf402b9d5a6382a7
Malware Config
Signatures
-
Mespinoza Ransomware 2 TTPs
Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.
-
Modifies extensions of user files 24 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\GrantFind.png.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Users\Admin\Pictures\OutInitialize.crw.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\ReadRegister.tiff => C:\Users\Admin\Pictures\ReadRegister.tiff.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Users\Admin\Pictures\RepairSearch.crw.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\TraceStop.raw => C:\Users\Admin\Pictures\TraceStop.raw.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Users\Admin\Pictures\WatchHide.tif.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\GetFind.png => C:\Users\Admin\Pictures\GetFind.png.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Users\Admin\Pictures\InitializeConvert.tiff.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Users\Admin\Pictures\ReadRegister.tiff.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\RepairSearch.crw => C:\Users\Admin\Pictures\RepairSearch.crw.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Users\Admin\Pictures\ResumeSync.crw.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\WatchHide.tif => C:\Users\Admin\Pictures\WatchHide.tif.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Users\Admin\Pictures\GetFind.png.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\GrantFind.png => C:\Users\Admin\Pictures\GrantFind.png.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Users\Admin\Pictures\RenameTest.raw.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\ResumeSync.crw => C:\Users\Admin\Pictures\ResumeSync.crw.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\SwitchRestart.tif => C:\Users\Admin\Pictures\SwitchRestart.tif.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Users\Admin\Pictures\SwitchRestart.tif.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\SyncOpen.png => C:\Users\Admin\Pictures\SyncOpen.png.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Users\Admin\Pictures\SyncOpen.png.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\InitializeConvert.tiff => C:\Users\Admin\Pictures\InitializeConvert.tiff.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\OutInitialize.crw => C:\Users\Admin\Pictures\OutInitialize.crw.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File renamed C:\Users\Admin\Pictures\RenameTest.raw => C:\Users\Admin\Pictures\RenameTest.raw.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Users\Admin\Pictures\TraceStop.raw.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 864 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FLT.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files (x86)\Common Files\Services\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files\WindowsPowerShell\Configuration\Schema\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\WT61ES.LEX.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Edmonton.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files\Internet Explorer\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Monaco.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EET.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDFFile_8.ico.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEERR.DLL.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\DATES.XML.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\ms.pak.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\et.pak.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\MSB1ARFR.ITS.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Malta.pysa 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe -
Drops file in Windows directory 1 IoCs
Processes:
051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exedescription ioc process File created C:\Windows\Readme.README 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exedescription pid process target process PID 1864 wrote to memory of 864 1864 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe cmd.exe PID 1864 wrote to memory of 864 1864 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe cmd.exe PID 1864 wrote to memory of 864 1864 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe cmd.exe PID 1864 wrote to memory of 864 1864 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe cmd.exe PID 1864 wrote to memory of 864 1864 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe cmd.exe PID 1864 wrote to memory of 864 1864 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe cmd.exe PID 1864 wrote to memory of 864 1864 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe cmd.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = 48006900200043006f006d00700061006e0079002c000d000a000d000a00450076006500720079002000620079007400650020006f006e00200061006e00790020007400790070006500730020006f006600200079006f0075007200200064006500760069006300650073002000770061007300200065006e0063007200790070007400650064002e000d000a0044006f006e00270074002000740072007900200074006f00200075007300650020006200610063006b007500700073002000620065006300610075007300650020006900740020007700650072006500200065006e006300720079007000740065006400200074006f006f002e000d000a000d000a0054006f002000670065007400200061006c006c00200079006f00750072002000640061007400610020006200610063006b00200063006f006e0074006100630074002000750073003a000d000a004a006f006e0061007400680061006e006800480061006c006c0040006f006e0069006f006e006d00610069006c002e006f00720067000d000a00570069006c006c00690039003900390065004a006f0068006e0073006f006e006800480040006f006e0069006f006e006d00610069006c002e006f00720067000d000a007300680061006d006e00610073006b0061004000700072006f0074006f006e006d00610069006c002e0063006f006d000d000a000d000a0041006c0073006f002c0020006200650020006100770061007200650020007400680061007400200077006500200064006f0077006e006c006f0061006400650064002000660069006c00650073002000660072006f006d00200079006f007500720020007300650072007600650072007300200061006e006400200069006e002000630061007300650020006f00660020006e006f006e002d007000610079006d0065006e0074002000770065002000770069006c006c00200062006500200066006f007200630065006400200074006f002000750070006c006f006100640020007400680065006d0020006f006e0020006f0075007200200077006500620073006900740065002c00200061006e00640020006900660020006e00650063006500730073006100720079002c002000770065002000770069006c006c002000730065006c006c0020007400680065006d0020006f006e00200074006800650020006400610072006b006e00650074002e000d000a0043006800650063006b0020006f007500740020006f0075007200200077006500620073006900740065002c0020007700650020006a00750073007400200070006f00730074006500640020007400680065007200650020006e006500770020007500700064006100740065007300200066006f00720020006f0075007200200070006100720074006e006500720073003a00200068007400740070003a002f002f00770071006d0066007a006e00690032006e0076006200620070006b00320035002e006f006e0069006f006e002f000d000a002d002d002d002d002d002d002d002d002d002d002d002d002d002d000d000a000d000a004600410051003a000d000a000d000a0031002e000d000a0020002000200051003a00200048006f0077002000630061006e002000490020006d0061006b00650020007300750072006500200079006f007500200064006f006e0027007400200066006f006f006c0069006e00670020006d0065003f000d000a0020002000200041003a00200059006f0075002000630061006e002000730065006e006400200075007300200032002000660069006c006500730028006d0061007800200032006d00620029002e000d000a000d000a0032002e000d000a0020002000200051003a0020005700680061007400200074006f00200064006f00200074006f002000670065007400200061006c006c002000640061007400610020006200610063006b003f000d000a0020002000200041003a00200044006f006e0027007400200072006500730074006100720074002000740068006500200063006f006d00700075007400650072002c00200064006f006e002700740020006d006f00760065002000660069006c0065007300200061006e0064002000770072006900740065002000750073002e000d000a000d000a0033002e000d000a0020002000200051003a0020005700680061007400200074006f002000740065006c006c0020006d007900200062006f00730073003f000d000a0020002000200041003a002000500072006f007400650063007400200059006f00750072002000530079007300740065006d00200041006d00690067006f002e000d000a000d000a000000 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = 50005900530041000000 051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe"C:\Users\Admin\AppData\Local\Temp\051fb654403340420102430f807ea41ab790666488d897dc5b0008e99fed47d6.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\update.batMD5
eeb6ef1b9ac438f40e400b22ee7bd0e1
SHA1207cc8e35a7ad3edae9d8648737c1945fa08deab
SHA25683b3681140956baae979cb4a612081d6748922ad92b5c8f43833508dcdd1e10c
SHA5127479906b31c3066c3e5c51648ada57e1b5510160fcb8acabd8b1a4e37df5e03304ea4d628ac1a991290ca1fadaa7f17a5792adaeca350775cf18c5eeeefe91ba
-
memory/864-3-0x0000000000000000-mapping.dmp
-
memory/1864-2-0x00000000760B1000-0x00000000760B3000-memory.dmpFilesize
8KB