4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99

General
Target

4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe

Filesize

504KB

Completed

08-04-2021 04:28

Score
10 /10
MD5

e3da64fd9a0a585ebe00ac7f235104d6

SHA1

52b2fc13ec0dbf8a0250c066cd3486b635a27827

SHA256

4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99

Malware Config
Signatures 8

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Impact
  • Mespinoza Ransomware

    Description

    Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

    TTPs

    Query RegistryData Encrypted for Impact
  • Modifies extensions of user files
    4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\Pictures\CompareEnter.raw.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Users\Admin\Pictures\HideCompare.tif.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Users\Admin\Pictures\OptimizeOut.crw.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File renamedC:\Users\Admin\Pictures\CompareEnter.raw => C:\Users\Admin\Pictures\CompareEnter.raw.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File renamedC:\Users\Admin\Pictures\DisableCheckpoint.raw => C:\Users\Admin\Pictures\DisableCheckpoint.raw.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Users\Admin\Pictures\DisableCheckpoint.raw.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Users\Admin\Pictures\FormatWait.png.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File renamedC:\Users\Admin\Pictures\SkipResume.png => C:\Users\Admin\Pictures\SkipResume.png.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File renamedC:\Users\Admin\Pictures\UnpublishExpand.crw => C:\Users\Admin\Pictures\UnpublishExpand.crw.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File renamedC:\Users\Admin\Pictures\FormatWait.png => C:\Users\Admin\Pictures\FormatWait.png.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Users\Admin\Pictures\UnpublishExpand.crw.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File renamedC:\Users\Admin\Pictures\CompleteRegister.crw => C:\Users\Admin\Pictures\CompleteRegister.crw.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Users\Admin\Pictures\CompleteRegister.crw.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File renamedC:\Users\Admin\Pictures\HideCompare.tif => C:\Users\Admin\Pictures\HideCompare.tif.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File renamedC:\Users\Admin\Pictures\OptimizeOut.crw => C:\Users\Admin\Pictures\OptimizeOut.crw.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Users\Admin\Pictures\SkipResume.png.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Drops file in Program Files directory
    4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files\CompleteReceive.pptx.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\ui-strings.js.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files\Common Files\microsoft shared\ink\hu-HU\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\ui-strings.js.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-hk_get.svg.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\organize.svg.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag_retina.png.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\ui-strings.js.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\BackupPush.php.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Home.aapp.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluCCFilesEmpty_180x180.svg.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\zh-TW.pak.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\ui-strings.js.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started.png.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\ui-strings.js.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\ui-strings.js.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\ui-strings.js.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\share.svg.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons_retina.png.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\fr.pak.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-nodes.xml.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\ui-strings.js.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Checkmark_White@1x.png.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\db\bin\dblook.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files\VideoLAN\VLC\locale\ms\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_radio_selected_18.svg.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\ui-strings.js.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jre1.8.0_66\lib\ext\cldrdata.jar.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    File opened for modificationC:\Program Files\Java\jre1.8.0_66\lib\jfr\profile.jfc.pysa4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
  • Drops file in Windows directory
    4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\Readme.README4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious use of WriteProcessMemory
    4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1144 wrote to memory of 68411444770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.execmd.exe
    PID 1144 wrote to memory of 68411444770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.execmd.exe
    PID 1144 wrote to memory of 68411444770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.execmd.exe
  • System policy modification
    4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe

    Tags

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = 48006900200043006f006d00700061006e0079002c000d000a000d000a00450076006500720079002000620079007400650020006f006e00200061006e00790020007400790070006500730020006f006600200079006f0075007200200064006500760069006300650073002000770061007300200065006e0063007200790070007400650064002e000d000a0044006f006e00270074002000740072007900200074006f00200075007300650020006200610063006b007500700073002000620065006300610075007300650020006900740020007700650072006500200065006e006300720079007000740065006400200074006f006f002e000d000a000d000a0054006f002000670065007400200061006c006c00200079006f00750072002000640061007400610020006200610063006b00200063006f006e0074006100630074002000750073003a000d000a004c00700079006f00740072002e0062006100720063006c00610079004000700072006f0074006f006e006d00610069006c002e0063006f006d000d000a00670061006c0065007400720065006e00640061006c006c004000700072006f0074006f006e006d00610069006c002e0063006f006d000d000a002d002d002d002d002d002d002d002d002d002d002d002d002d002d000d000a000d000a004600410051003a000d000a000d000a0031002e000d000a0020002000200051003a00200048006f0077002000630061006e002000490020006d0061006b00650020007300750072006500200079006f007500200064006f006e0027007400200066006f006f006c0069006e00670020006d0065003f000d000a0020002000200041003a00200059006f0075002000630061006e002000730065006e006400200075007300200032002000660069006c006500730028006d0061007800200032006d00620029002e000d000a000d000a0032002e000d000a0020002000200051003a0020005700680061007400200074006f00200064006f00200074006f002000670065007400200061006c006c002000640061007400610020006200610063006b003f000d000a0020002000200041003a00200044006f006e0027007400200072006500730074006100720074002000740068006500200063006f006d00700075007400650072002c00200064006f006e002700740020006d006f00760065002000660069006c0065007300200061006e0064002000770072006900740065002000750073002e000d000a000d000a0033002e000d000a0020002000200051003a0020005700680061007400200074006f002000740065006c006c0020006d007900200062006f00730073003f000d000a0020002000200041003a002000500072006f007400650063007400200059006f00750072002000530079007300740065006d00200041006d00690067006f002e000d000a000d000a0000004770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = 500059005300410000004770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe
    "C:\Users\Admin\AppData\Local\Temp\4770a0447ebc83a36e590da8d01ff4a418d58221c1f44d21f433aaf18fad5a99.exe"
    Modifies extensions of user files
    Drops file in Program Files directory
    Drops file in Windows directory
    Suspicious use of WriteProcessMemory
    System policy modification
    PID:1144
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
      PID:684
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Execution
      Exfiltration
        Initial Access
          Lateral Movement
            Persistence
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\$Recycle.Bin\S-1-5-21-3341490333-719741536-2920803124-1000\desktop.ini

                  MD5

                  54fc812a6acc37f554f18b925f0a3c76

                  SHA1

                  ec32bd50f94749a7d5aef2e8dd2b9a803824141d

                  SHA256

                  13f93021c2cd44b04518b2dbfd7e7d88950a59934b72aafadcfdc9f32cf1fb7c

                  SHA512

                  e7b2128500f6db9f8532734e83669d26498c905218457a709cf95ce9c1abf4a3ad0551a053b094e1c8dd31c96400a485c214e1f6a16299cdff325ac09f1aeff6

                • C:\Users\Admin\AppData\Local\Temp\update.bat

                  MD5

                  bf99f2f8d175b9aef55db401f3c49345

                  SHA1

                  9beef2a4448154f943fcba2b2330aaf8e383882a

                  SHA256

                  492820e53f7c019a6f3ee166179378064da00c7d65e162a2432edb97467a0198

                  SHA512

                  edc250dae97c251446f8d71acdc95da52d8dc4ff16c08c6d0e938903b86effaa4643796fa5763f3e934dfccf16312367e25da4a06944166aaa798068b6890b35

                • memory/684-3-0x0000000000000000-mapping.dmp