Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-06-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe
Resource
win10v20210410
General
-
Target
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe
-
Size
235KB
-
MD5
07f482fdc70a699d02495c8b4dc1ee63
-
SHA1
8c536b4c8a9a810635daa506c67f70180b048c83
-
SHA256
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259
-
SHA512
5a8ec11ed23b6e17e894965cf3fab92ae55e7408ee1f6bd00a59ba43c61648cd9d9fd7894288427a14446d3d9bc59c66b0416d57f7de9cd626d64e575ca14d91
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
Processes:
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exedescription ioc process File opened for modification C:\Windows\system32\drivers\iaLPSS2i_GPIO2_BXT_P.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\wmilib.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\drivers\en-US\iorate.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\en-US\Microsoft.Bluetooth.Legacy.LEEnumerator.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\drivers\en-US\MTConfig.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\en-US\nvdimmn.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\BtaMPM.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\errdev.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\exfat.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\drivers\en-US\mssecflt.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\dxgkrnl.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\flpydisk.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\drivers\en-US\cmimcext.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\en-US\srv2.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\UMDF\PosCx.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\hyperkbd.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\iaLPSS2i_I2C.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\mslldp.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\volume.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\drivers\en-US\ks.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\buttonconverter.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\usbohci.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\wacompen.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\WdiWiFi.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\drivers\en-US\mshidumdf.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\drivers\en-US\volmgrx.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\en-US\wmbclass.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\fdc.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\NdisImPlatform.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\rdbss.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\sfloppy.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\swenum.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\vpci.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\en-US\processr.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\drivers\gmreadme.txt 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\Synth3dVsc.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\drivers\en-US\pdc.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\evbda.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\urssynopsys.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\usbcir.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\en-US\refs.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\en-US\ucx01000.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\wcifs.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\agilevpn.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\amdppm.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\clfs.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\netio.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\usbprint.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\vmbkmclr.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\watchdog.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\en-US\spbcx.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\UMDF\SensorsCx.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\fltMgr.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\npsvctrig.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\scfilter.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\mshidkmdf.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\tcpip.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\en-US\usbport.sys.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\UMDF\usbdr.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\atapi.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\cdfs.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\disk.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\lsi_sss.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\drivers\rasacd.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\BackupStop.raw => C:\Users\Admin\Pictures\BackupStop.raw.ChupaCabra 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File renamed C:\Users\Admin\Pictures\SelectMeasure.crw => C:\Users\Admin\Pictures\SelectMeasure.crw.ChupaCabra 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 21 IoCs
Processes:
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\Pictures\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\Videos\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\Favorites\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Public\Documents\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Public\Pictures\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Public\Music\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\Music\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Public\Desktop\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\Desktop\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\Documents\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Public\Videos\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe -
Drops file in System32 directory 64 IoCs
Processes:
213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exedescription ioc process File opened for modification C:\Windows\system32\en-US\cscsvc.dll.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\d3d10warp.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\PING.EXE 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\TSSessionUX.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\DriverStore\en-US\c_fssystemrecovery.inf_loc 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\DriverStore\en-US\kscaptur.inf_loc 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\DriverStore\FileRepository\wiasa003.inf_amd64_a30880819970ec59\amd64\SAK2200.icc 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\evr.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\MixedRealityCapture.exe 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\en-US\gpsvc.dll.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\Hydrogen\BakedPlugins\Animation\typecompendium.hkdoc 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\oobe\en-US\setup.exe.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\wbem\refsv1.mof 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\DriverStore\FileRepository\c_legacydriver.inf_amd64_49a9062b287b046b\c_legacydriver.inf 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNBJOP9W.DLL 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\DriverStore\FileRepository\prnms002.inf_amd64_07ee1bb78d96a8d3\Amd64\FXSAPI.DLL 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\en-US\dcomcnfg.exe.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\en-US\WinSetupUI.dll.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\wbem\en-US\DscCoreConfProv.mfl 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Update-Ux-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\DriverStore\FileRepository\netb57va.inf_amd64_11911b9263320299\netb57va.inf 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\en-US\sxstrace.exe.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\iernonce.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-Containers-services-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\DriverStore\en-US\V_MSCDSC.inf_loc 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\DriverStore\FileRepository\prncacl2.inf_amd64_d0fd8eb0443cec17\prncacl2.cat 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\es-MX\WWAHost.exe.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\DriverStore\FileRepository\netax88772.inf_amd64_d2ca514cf72a9a18\ax88772.sys 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\DriverStore\FileRepository\nvdimmn.inf_amd64_65bd82fbc8bd058d\nvdimmn.inf 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\@edptoastimage.png 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\boot.sdi 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\dafpos.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\tapiui.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Network-Foundation-minio-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\DriverStore\en-US\mwlu97w8x64.inf_loc 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\wbem\en-US\SmbWitnessWmiv2Provider.mfl 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BranchCache\BranchCachePrimaryRepublicationCacheFile.cdxml 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Skype-ORTC-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\DriverStore\en-US\wvmic_shutdown.inf_loc 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\en-US\rsop.msc 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\migwiz\dlmanifests\TextServicesFramework-Migration-DL.man 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\migwiz\replacementmanifests\Microsoft-Windows-StorageMigration-Replacement.man 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\spp\tokens\skus\Professional\Professional-Volume-CSVLK-2-ul-store-rtm.xrm-ms 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\DriverStore\FileRepository\ntprint.inf_amd64_28deabbd337eb1dc\Amd64\PCLXL.DLL 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\spp\tokens\skus\Professional\Professional-Volume-MAK-1-ul-phn-rtm.xrm-ms 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\slc.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\SyncInfrastructure.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\winrssrv.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-CameraCaptureUI-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnms003.cat 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\downlevel\api-ms-win-core-heap-l1-1-0.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\en-US\printmanagement.msc 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\en-US\wwansvc.dll.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\msieftp.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\xpsrchvw.xml 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Guest-Storage-Filter-onecore-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\DriverStore\en-US\netnvma.inf_loc 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\DriverStore\FileRepository\prnbrcl1.inf_amd64_205cfd311a6b4e83\prnbrcl1.PNF 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\DriverStore\FileRepository\prnhpcl5.inf_amd64_d79d88c2b839182e\prnhpcl5.inf 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\BitsProxy.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\prauthproviders.dll 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File created C:\Windows\system32\en-US\mp4sdecd.dll.mui 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe File opened for modification C:\Windows\system32\rdpclip.exe 213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe -
Modifies registry class 11 IoCs
Processes:
OpenWith.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\ChupaCabra_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\ChupaCabra_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\.ChupaCabra\ = "ChupaCabra_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\ChupaCabra_auto_file\shell\edit OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\ChupaCabra_auto_file\shell\open\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\.ChupaCabra OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\ChupaCabra_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\ChupaCabra_auto_file\shell\edit\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\ChupaCabra_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\ChupaCabra_auto_file\shell\open OpenWith.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 3908 NOTEPAD.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OpenWith.exepid process 4036 OpenWith.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
NOTEPAD.EXEpid process 3908 NOTEPAD.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
OpenWith.exepid process 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe 4036 OpenWith.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
OpenWith.exedescription pid process target process PID 4036 wrote to memory of 3908 4036 OpenWith.exe NOTEPAD.EXE PID 4036 wrote to memory of 3908 4036 OpenWith.exe NOTEPAD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\213d6a4c5a5c0045550fa2b822434c51dfd1b6f573c1d1bf22d9eda4f7ab2259.bin.sample.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in System32 directory
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\WaitClear.DVR-MS.ChupaCabra2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\WaitClear.DVR-MS.ChupaCabraMD5
a953a561545e1a0ee369474294830f2a
SHA1df86f24ed464cad2a57a7eb9909fb3f8bd1a50be
SHA256540270ead1bc40293b34e6bb04ceb234513b82e6d202525c20c6c8f5e13e2484
SHA51244e1a655c559b7a54ac1e5f9cb42384a69d5584bd89af63d54aaa3b362a567994d667fdc999028472847a3659cc16a5495af0ac2497fd625af591e2d6d41de8a
-
memory/1704-114-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1704-116-0x000000001AE60000-0x000000001AE62000-memory.dmpFilesize
8KB
-
memory/3908-118-0x0000000000000000-mapping.dmp