a0070951284e17ec843b498d0a11f4a2ebb8ce64c9f27faf7af96124fd691b1e

Analysis

max time kernel
146s
max time network
111s
platform
windows7_x64
resource
win7v20210410
submitted
18/05/2021, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data.cmp.exe
Size

281KB
MD5

0e61e496fc218c1c6dc1f5640a3ac7e5
SHA1

aae1b11aa9f2b0a2e32577db8026b843dc16a79d
SHA256

a0070951284e17ec843b498d0a11f4a2ebb8ce64c9f27faf7af96124fd691b1e
SHA512

7b7d6acf3a8f1f2c948cdac035543715d0dc235a169f01127579685f54c7851b06130d5ac4db9345cdb2a6fedfec0395fe306d2f2f2a2bfa45847e325e0c49fd

Score

10^/10

evasion ransomware trojan

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\FILES ENCRYPTED.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .4E2840E1 The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: 7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- If your country have blocked the TOR network.You can get there by the following ways: ---------------------------------------------------------------------------------------- | 1. Open link in any browser: decryptmyfiles.top/contact/4E2840E1 | 2. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN KEY--- KR8fSB0QHkwdHEofS0sQHxFMHExKSB0RTRtPGh8ZTRkfHx9IHRAeTB0cSh9LSxAfEUwcTEpIHRFNSBoZGxFNSxhLSE9PShkcHhEdGx5PEUwdHRoRERBIHSk4jQWred91ml6zpMrAuPL/u53vtMML6uqEc17emfyEFgN8V7PRsQU+qGYwwsg5j1k9BlzXqfyJVuTRTUtukHf62kYCBlAZS+I6H8efD35IT9DfoOKpQkfi0N+g4qlCR+KpXUo/PbutIP6sW1V41LbOlKo9MC19uFpvyFGS12HJjbUrndbS/WIlrVybi9Gxwti2Ob1sO7dz+KZ9hoFnjixtwAHub+ALWrqBiE9plZNjFV6l4WW8ZWpQDxmriSHFJKkzg6Fepyhww4kNXrIaeHIt3oO5f5xC2OUWjzmchRACkWznWJsqDeCDTNW5gfySyO6EgLXmgv59ooSAteaC/n2i� ---END KEY---

URLs

http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta

Ransom Note

All your files have been encrypted! All your files, documents, photos, databases and other important files are encrypted and have the extension: .4E2840E1 The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. Free decryption as guarantee Before paying you can decrypt 1 file for free on our site. The size of file must be less than 2Mb (non archived), and the file should not contain valuable information. (databases,backups, large excel sheets, etc.) The server with your key is in a closed network Tor. You can get there by the following ways: Download Tor browser - https://www.torproject.org/ Install Tor browser Open link in Tor browser: http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1 Follow the instructions on this page If your country have blocked the Tor network.You can get there by the following ways: Open link in any browser: http://decryptmyfiles.top/contact/4E2840E1 Follow the instructions on this page Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1

http://decryptmyfiles.top/contact/4E2840E1

Extracted

Path

C:\Users\Admin\Desktop\FILES ENCRYPTED.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .4E2840E1 The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: 7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- If your country have blocked the TOR network.You can get there by the following ways: ---------------------------------------------------------------------------------------- | 1. Open link in any browser: decryptmyfiles.top/contact/4E2840E1 | 2. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN KEY--- a11dCl9SXA5fXghdCQlSXVMOXg4ICl9TD1kNWF1bD1tdXV0KX1JcDl9eCF0JCVJdUw5eDggKX1MPClhbWVMPCVoJCg0NCFteXFNfWVwNUw5fX1hTU1IKX0I4jQWred91ml6zpMrAuPL/u53vtMML6uqEc17emfyEFgN8V7PRsQU+qGYwwsg5j1k9BlzXqfyJVuTRTUtukHf62kYCBlAZS+I6H8efD35ITxs7wy332yq03U8qVsTwVgR+89AaJivMDPoiVu+J4WNq+dBIoH0/EkIvs91lIZgLlwzhBbt7ywNA5OXlOIRaTWI7DYhybtPYiL7f1wcvPmzFFHMRk5p7BdBNALrqqcjGiGt1KmEexY/9XRARWgU4wrHrP4ShICZOr45A/iodUCZ+6xX5YxJMq/bQWw5Vdz75djcFN+aHxjBGsQfwd7tMT+sVEI9F/xZ14S/OWa6iHKqR� ---END KEY---

URLs

http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta	data.cmp.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
6	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
760	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f000000000200000000001066000000010000200000002e7bbbc843d81773bdfd24eea03a15333a64d70f2bb37ea22624695332a365f1000000000e800000000200002000000001dab82afda5f1df5d2e128e08e5fcd1d728b0016ba7435cf216a99113e57b272000000043577fd0822835dddab2065cdf06bff613f289dc51eb24647464b97d2e3b534d4000000085cd9527c65fea0dad734cad730c4f90070f83959da306b57e41e1ca0a1c933b12f52a8aec0aff6a09f58ad259fccfb9a242cf82d58b9373c3764c77fca8e362	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5595B641-B7DA-11EB-9A32-C670C171E3F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50872830e74bd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "328108368"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000a8fc412b01b32969066dad3c80ef20891c1dbd6abd010da3b0f8bb1bd0bf5edb000000000e8000000002000020000000fbb4c17205e2e755e908c655574d19e281f7e373e501f3cd77e639bacaf419e89000000026c708dc98814d262bdb9b6da170d963d4039df8d6e4621fd9970a3a91ecf86d6c4e9a7e8449eb47d0aab2b647cf723b3cde27bd5de8d7dc5467a00d0dc90a0b01f7b976daa8dcd5113664c451fd772253bfcffc6357c37af7ed152dfda753bf7b8897d11f6e3de289b0be1d800a2a4fe9dbd88eb88b5d19ffb3e5f2275ec28dc413748227acf29f3604635d45fa4e3c4000000080f51d8bf07b22832d218695555fdde96a8348c341d3991f5530afb802442badbe3398807ca53dea584efe225f60df5440b99a487b0976817001cb90e5799b2d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	data.cmp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	data.cmp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	data.cmp.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1056	vssvc.exe
Token: SeRestorePrivilege	1056	vssvc.exe
Token: SeAuditPrivilege	1056	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
432	mshta.exe
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
652	IEXPLORE.EXE
652	IEXPLORE.EXE
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 1572	452	data.cmp.exe	33
PID 452 wrote to memory of 1572	452	data.cmp.exe	33
PID 452 wrote to memory of 1572	452	data.cmp.exe	33
PID 452 wrote to memory of 1572	452	data.cmp.exe	33
PID 1572 wrote to memory of 1732	1572	cmd.exe	35
PID 1572 wrote to memory of 1732	1572	cmd.exe	35
PID 1572 wrote to memory of 1732	1572	cmd.exe	35
PID 1572 wrote to memory of 1732	1572	cmd.exe	35
PID 452 wrote to memory of 1812	452	data.cmp.exe	36
PID 452 wrote to memory of 1812	452	data.cmp.exe	36
PID 452 wrote to memory of 1812	452	data.cmp.exe	36
PID 452 wrote to memory of 1812	452	data.cmp.exe	36
PID 452 wrote to memory of 408	452	data.cmp.exe	38
PID 452 wrote to memory of 408	452	data.cmp.exe	38
PID 452 wrote to memory of 408	452	data.cmp.exe	38
PID 452 wrote to memory of 408	452	data.cmp.exe	38
PID 452 wrote to memory of 676	452	data.cmp.exe	39
PID 452 wrote to memory of 676	452	data.cmp.exe	39
PID 452 wrote to memory of 676	452	data.cmp.exe	39
PID 452 wrote to memory of 676	452	data.cmp.exe	39
PID 1812 wrote to memory of 760	1812	cmd.exe	42
PID 1812 wrote to memory of 760	1812	cmd.exe	42
PID 1812 wrote to memory of 760	1812	cmd.exe	42
PID 1812 wrote to memory of 760	1812	cmd.exe	42
PID 960 wrote to memory of 432	960	explorer.exe	45
PID 960 wrote to memory of 432	960	explorer.exe	45
PID 960 wrote to memory of 432	960	explorer.exe	45
PID 960 wrote to memory of 432	960	explorer.exe	45
PID 1640 wrote to memory of 652	1640	iexplore.exe	48
PID 1640 wrote to memory of 652	1640	iexplore.exe	48
PID 1640 wrote to memory of 652	1640	iexplore.exe	48
PID 1640 wrote to memory of 652	1640	iexplore.exe	48
PID 1640 wrote to memory of 1644	1640	iexplore.exe	49
PID 1640 wrote to memory of 1644	1640	iexplore.exe	49
PID 1640 wrote to memory of 1644	1640	iexplore.exe	49
PID 1640 wrote to memory of 1644	1640	iexplore.exe	49

C:\Users\Admin\AppData\Local\Temp\data.cmp.exe
"C:\Users\Admin\AppData\Local\Temp\data.cmp.exe"
1⤵
- Drops startup file
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start "" "explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\explorer.exe
    "explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta
    3⤵
    PID:1732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} recoveryenabled No
  2⤵
  PID:408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:676

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta"
  2⤵
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:432

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
1⤵
PID:1384

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:472068 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-60-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/960-69-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

Filesize
8KB

Download
memory/1644-78-0x00000000009F0000-0x00000000009F2000-memory.dmp

Filesize
8KB

Download
memory/1732-67-0x00000000746E1000-0x00000000746E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads