463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604
General
Target
Filesize
Completed
463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe
169KB
16-06-2021 14:40
Score
10/10
MD5
SHA1
SHA256
e39a000a6c0925438b1bf9a4a9b19745
65edffb71bc17b8fcb7a9b102952189fe13b1c4f
463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604
Malware Config
Extracted
| Path | C:\KRAB-DECRYPT.txt |
| Ransom Note |
---= GANDCRAB V4 =---
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .KRAB
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/6fa755ca9d8583c1
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAANz/LpMeLMaqWLO5no/F/+BQ4przNRO3yFNV/GFoP6SmpKDtNxHP25KOcxJc23rzj1jSn9dm7QmSajD4vqzIT27MUmjtTLpIrT6RUIxEHSQHTO/yyPOFgSKhfElHyrfFvG4bclNbPEtcQJKOyznbplpInPwlZILsjSzXrgtvX23D/wPuVGhZ855xw0/SRIURZnNktrv5yhXtzbKs5Row5P7IjytBpDJLMqPY/V60ziuk6695m8Pz9tf22aqNQMxK8kN+17ol7c8vAcFY8DjTmeCqZJVaCtbbMNgUpLjLMeQ9Mu5SYKBRG4rRK407eNAYTYsQ7K+piE+lGyeBI52Mwl7CWrgET+rS+x3L4QB4jpl6t9m84YS7LXHUa486F3Xfplo/z4lWWWrU7ZEmY3kbXAg6Dg8xmIaFM181mUG21MCsTiMKY3w/5bHZHtlrP92R6H7YnNxLDXb1kVHwMZcgGt7kY274zdB9xnKpHHyWRfLYyxqZZg1umvncFd0mluzwAmIxxbPOvfM1oRPBT3NXfCjAHHMUjhvDkxA14jZBng0qj77o/+IMWPluJRW0Jx3/BcD2HGzuwln+tnasMD+l9mHVFrfSier+afIPv/jAX/Qb+qZXsUmBEGQHGnemAWpm1y5JBkwuA2ISGDuYfPOjF/0lbMHWCECSeexc4hFcfJ+j3us64wtt5/YuvjMOaLZL0xzJLPwQqKIct5yhWo4Em24taVkFPXJs6ZGJjcWhvja5HiQ7+FqiKT+JkDy8TH10p0qOhG2wCsU3AFZOXk1X7oUG+MTOj5trFoSpSK4Gr5iwKOJQQ8Mdam1ZfXH9WEwy0NyXf+Vi4YT2NEcu1tOwXe2+IbYDjgzu1a0AQ7mslcjXJZG3utOe/4JK5NwtUEk5gsDZiJqHG37gu+8p6agobIYbZ4Abi+hCF8AQ+Xx+vnuvltMeOjwuCBbLxk7T6GOAuvjWitaY6ocuQ1NR9sGsj62wiybeO7bae9j1LTRfcVGm4+KAA4fGwxjv/z6AgVoxSgaxFQp+XXphl1MVuwbT4b65WY5N4u3OZJpIxOPWXK/sHimoydhyu2qsVXcKc3qrO7Sj6L+mUuBFoWUkN7EsTjy8472ew4HKW/mSGGSbvbKSpKEXKroRCZnOFBRLtq0HzhwvcSJmaQDYH2A0ffcMdWW92JBthGeR5bvdAptR8ylZzeKyZ9izSUSsCR7W/ftI3OCCW1W393dfIFjT//WFDzDEl+jZEfv5sEMQ3BjF2/rI8C8Dw4xcFyzON6ReUNr/Sm7mww1Hjom9JF+TbiUT1lmuRkxENWDoYhubGO2Dhwfqo8RKpkpiR+YpZmiJbNoVZuJqqkcyeXYaOyoN5j/nS+qYdE5VYUjR1pr/GBzEgolOYkwSvOmsMtKx5f66HZ45QgR98f7OZF6c8RfQbkfrSo09l+5VLS0NjZPAnFg8SRVLODLTfFnsIWV0qtIRjb/DDvGVd4ZwBE27ld2+MdFWZWRmG40PtOEj9G88EhQIWlecWQIOFrp899nl5JvhJSd9PWnyKtRC9DqXruQ4HhPAY/6pDZ8ezkQt/3/3QGtAvlEo+NAbsuJYs0YHEJY2CPaP6eKUVc4dN0NQg6zITsfsZKQBPSA99h1Nr0B/APk56DlclcLBECd57jzMBikoWh0JMdwOlqK9BWmIk4NJ1/hSYMLXC3qX5xypeUQe60VNZhav29edBgCkyokxtFZlLNFGmuxSQuCdip8TrQ0cSsi+Q2bE2xZ2XrqXYbrgcU1wqDQLPSOcR4/bB4Pt97Pt0RNN9+M38tuPnakcW55H6G06/c/fzzxQf3c3XKTrBZVylEVXQvo0TUkw8u60k2Vi6M7zr8HM0ULhP1CDM8436PBDoLY5dgKxaTqxbNxpzqsrgbJPUyDaNtMRPfUcxN+MV3N1bgpLzE0GMs4tanlnTMGLj9IH3psLiETYppnrYWPhDkvqyqco3sn60qY51+tq0+SY1nI6XENCFJ3DYrilTZez9EJzSQbWXxiHsuNPT88ZXrNTOwRyxUtMzU2QypETQ8qaIJLQW90mGth2PjJaujcXFpVF6DmhHJyUSVJo4PQrsp3qB4vSo6LG4NYuniqNcpmRBAPnbZEkQVrIKgvCU5taY4KcAy1S8Imv1TxPksgOYQxyvxi9vQXj4EBmQE3QWALgQ0bixvIV2nJZOSd8DdN5Nc+p0VDZGNdu84+XXnGzQiKNQl0w5tEQpV5XF2bgnFj/SF83ECk=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZFTp1Rs3YO7npWs7fRTG+Hhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZdP6U/VvqF1shzlzbajc1AHXg7l8xnT91gCFUxMg7ADMEr7316SnTFUg/DkeItL9jgqZmnprr55+pi5rF3kRvBseKt/zI2GesjGtNYb1rQBibtuxGOEY0b9Scf4qq4MaaXY7JyAYzW2Q+irpQZTWgqalO4JIUJo5FhwNYoDBPInKY+DO5AAL6fhWEzg6trLg3uxA9KyQ7/ZijpCxFb3qzLZeak1wcZNHQARhaKOTmD1j7gLX9ZmUXfmSz3QV9n27J7lo2wqHJXVdHpIjf5fBAcYsBiP2hNgH9AQyDCiKYGErrtc0j2BYRMPpGkHsYOIL8=
---END PC DATA---
|
| URLs |
http://gandcrabmfe6mnef.onion/6fa755ca9d8583c1 |
Signatures 15
Filter: none
Collection
Credential Access
Defense Evasion
Discovery
Impact
-
GandCrab Payload
Reported IOCs
resource yara_rule behavioral2/memory/3680-114-0x0000000000400000-0x0000000000430000-memory.dmp family_gandcrab -
Gandcrab
Description
Gandcrab is a Trojan horse that encrypts files on a computer.
Tags
-
Deletes shadow copies
Description
Ransomware often targets backup files to inhibit system recovery.
Tags
TTPs
-
Modifies extensions of user files463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe
Description
Ransomware generally changes the extension on encrypted files.
Tags
Reported IOCs
description ioc process File renamed C:\Users\Admin\Pictures\BlockComplete.tiff => C:\Users\Admin\Pictures\BlockComplete.tiff.KRAB 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File renamed C:\Users\Admin\Pictures\DebugUpdate.png => C:\Users\Admin\Pictures\DebugUpdate.png.KRAB 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Users\Admin\Pictures\SearchInstall.tiff 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File renamed C:\Users\Admin\Pictures\SkipConfirm.png => C:\Users\Admin\Pictures\SkipConfirm.png.KRAB 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File renamed C:\Users\Admin\Pictures\SearchInstall.tiff => C:\Users\Admin\Pictures\SearchInstall.tiff.KRAB 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Users\Admin\Pictures\BlockComplete.tiff 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File renamed C:\Users\Admin\Pictures\MeasureWait.raw => C:\Users\Admin\Pictures\MeasureWait.raw.KRAB 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File renamed C:\Users\Admin\Pictures\MoveUnregister.png => C:\Users\Admin\Pictures\MoveUnregister.png.KRAB 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File renamed C:\Users\Admin\Pictures\PushRequest.png => C:\Users\Admin\Pictures\PushRequest.png.KRAB 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe -
Drops startup file463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe
Reported IOCs
description ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\KRAB-DECRYPT.txt 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\9d8584219d8583c1418.lock 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe -
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Enumerates connected drives463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe
Description
Attempts to read the root path of hard drives other than the default C: drive.
TTPs
Reported IOCs
description ioc process File opened (read-only) \??\B: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\E: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\J: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\S: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\Y: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\G: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\H: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\R: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\X: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\F: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\L: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\M: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\N: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\T: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\V: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\W: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\Z: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\A: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\I: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\K: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\O: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\P: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\Q: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened (read-only) \??\U: 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe -
Drops file in Program Files directory463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe
Reported IOCs
description ioc process File opened for modification C:\Program Files\MeasureUnregister.zip 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\CloseUninstall.3g2 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\JoinConvertFrom.png 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\WatchWrite.mp4v 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File created C:\Program Files\KRAB-DECRYPT.txt 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\LockGrant.jpeg 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\PushUnpublish.WTV 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\SuspendPing.vsd 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\WatchUnregister.avi 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\DebugExit.emf 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\ExitDisable.pptm 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\GroupSelect.aiff 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File created C:\Program Files (x86)\9d8584219d8583c1418.lock 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\DenySend.xltx 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\EditExport.emf 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\RevokeTest.dib 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File created C:\Program Files (x86)\KRAB-DECRYPT.txt 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\ComparePop.ppsx 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\ConvertFromInitialize.wmf 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\OutEnter.eprtx 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\RevokePublish.aiff 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\SubmitSwitch.vsdm 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\UndoEnable.gif 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File created C:\Program Files\9d8584219d8583c1418.lock 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\ConvertFromExpand.scf 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\MergeSet.vsdm 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\ReceiveUninstall.csv 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\TestResume.otf 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\ExitDeny.m4v 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\RequestWatch.dwfx 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\UnlockDisable.gif 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe File opened for modification C:\Program Files\UnpublishSuspend.ADT 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe -
Enumerates physical storage devices
Description
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
TTPs
-
Checks SCSI registry key(s)463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe
Description
SCSI information is often read in order to detect sandboxing environments.
TTPs
Reported IOCs
description ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\UpperFilters 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\LowerFilters 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\UpperFilters 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\LowerFilters 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe -
Checks processor information in registry463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe
Description
Processor information is often read in order to detect sandboxing environments.
TTPs
Reported IOCs
description ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe -
Modifies system certificate store463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe
Tags
TTPs
Reported IOCs
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe -
Suspicious behavior: EnumeratesProcesses463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe
Reported IOCs
pid process 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe -
Suspicious use of AdjustPrivilegeToken463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe
Reported IOCs
description pid process Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe Token: SeLoadDriverPrivilege 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe -
Suspicious use of WriteProcessMemory463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe
Reported IOCs
description pid process target process PID 3680 wrote to memory of 3436 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe wmic.exe PID 3680 wrote to memory of 3436 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe wmic.exe PID 3680 wrote to memory of 3436 3680 463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe wmic.exe
Processes 3
-
C:\Users\Admin\AppData\Local\Temp\463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exePID:3680"C:\Users\Admin\AppData\Local\Temp\463dac638934df6e6bc4be2b7b8f796befbafae68cb465eb85a90da39de75604.exe"Modifies extensions of user filesDrops startup fileEnumerates connected drivesDrops file in Program Files directoryChecks SCSI registry key(s)Checks processor information in registryModifies system certificate storeSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exePID:3436"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
-
C:\Windows\system32\vssvc.exePID:1492C:\Windows\system32\vssvc.exe
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
memory/3436-115-0x0000000000000000-mapping.dmp
-
memory/3680-114-0x0000000000400000-0x0000000000430000-memory.dmp
Title
Loading data