Analysis
-
max time kernel
155s -
max time network
164s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 12:41
Static task
static1
Behavioral task
behavioral1
Sample
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe
Resource
win10v20210410
General
-
Target
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe
-
Size
69KB
-
MD5
3229e2489dde524195cf0ccbbf5f7d40
-
SHA1
a257fc0b117fb9e0a6df128213e11de5cee21129
-
SHA256
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d
-
SHA512
d719fcf974a9304154daf95f0c80805b9a720a1db1289aa4fd189494cb0c29820a1b999d26fb38378d3a47602b26ff8375189ed9586a9c94c19fae0f4e0c650e
Malware Config
Extracted
C:\ProgramData\Microsoft\User Account Pictures\FDECCD-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Google\Chrome\Application\89.0.4389.114\FDECCD-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\StopDeny.png => C:\Users\Admin\Pictures\StopDeny.png.fdeccd 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\InstallOptimize.png => C:\Users\Admin\Pictures\InstallOptimize.png.fdeccd 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\BackupStart.png => C:\Users\Admin\Pictures\BackupStart.png.fdeccd 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Users\Admin\Pictures\RevokeRemove.tiff 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\ConvertFromPublish.tiff => C:\Users\Admin\Pictures\ConvertFromPublish.tiff.fdeccd 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\AssertFind.png => C:\Users\Admin\Pictures\AssertFind.png.fdeccd 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\DismountUnpublish.tif => C:\Users\Admin\Pictures\DismountUnpublish.tif.fdeccd 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\PushMerge.tif => C:\Users\Admin\Pictures\PushMerge.tif.fdeccd 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\MountMove.tif => C:\Users\Admin\Pictures\MountMove.tif.fdeccd 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\ImportFormat.crw => C:\Users\Admin\Pictures\ImportFormat.crw.fdeccd 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\ReceiveEnter.png => C:\Users\Admin\Pictures\ReceiveEnter.png.fdeccd 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Users\Admin\Pictures\ConvertFromPublish.tiff 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\RevokeRemove.tiff => C:\Users\Admin\Pictures\RevokeRemove.tiff.fdeccd 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 6936 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188513.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02752U.BMP 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCINFO.XML 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Composite.eftx 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\FDECCD-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01145_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\THOCR.PSP 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR25F.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107150.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.XLS 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01474_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\HEADER.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\FDECCD-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SNIPE.POC 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGMASTHD.DPV 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.HXS 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143749.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\FDECCD-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\TAB_ON.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00443_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nipigon 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185842.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02740G.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cuiaba 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341551.JPG 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN020.XML 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18205_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02736G.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CA.XML 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0221903.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00780L.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\jvm.hprof.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\GRID_01.MID 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1100 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4924 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exepid process 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe Token: SeImpersonatePrivilege 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe Token: SeBackupPrivilege 2644 vssvc.exe Token: SeRestorePrivilege 2644 vssvc.exe Token: SeAuditPrivilege 2644 vssvc.exe Token: SeDebugPrivilege 4924 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.execmd.exedescription pid process target process PID 1656 wrote to memory of 1100 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe vssadmin.exe PID 1656 wrote to memory of 1100 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe vssadmin.exe PID 1656 wrote to memory of 1100 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe vssadmin.exe PID 1656 wrote to memory of 1100 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe vssadmin.exe PID 1656 wrote to memory of 5396 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe notepad.exe PID 1656 wrote to memory of 5396 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe notepad.exe PID 1656 wrote to memory of 5396 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe notepad.exe PID 1656 wrote to memory of 5396 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe notepad.exe PID 1656 wrote to memory of 6936 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe cmd.exe PID 1656 wrote to memory of 6936 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe cmd.exe PID 1656 wrote to memory of 6936 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe cmd.exe PID 1656 wrote to memory of 6936 1656 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe cmd.exe PID 6936 wrote to memory of 4924 6936 cmd.exe taskkill.exe PID 6936 wrote to memory of 4924 6936 cmd.exe taskkill.exe PID 6936 wrote to memory of 4924 6936 cmd.exe taskkill.exe PID 6936 wrote to memory of 4924 6936 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe"C:\Users\Admin\AppData\Local\Temp\488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\FDECCD-Readme.txt"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\DF28.tmp.bat"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 16563⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DF28.tmp.batMD5
c5326522db8a0cfe430eb93bf3d841b4
SHA19865c40321156f4106b546515297c0f2295e0dc8
SHA256640302305c180f7ac4f8afa37f1f4a68adb11395db4d1fab2daf4b8c9702ee5b
SHA512f88c3c6c0d6d12c12055c5377437d21a08dedbdc784eb5ef7ffcaf5928e9c20a7d3e6f7efa662a20b73270831b6d687d208d8dccc96eff9f84226ee5e6a0c7fa
-
C:\Users\Admin\Desktop\FDECCD-Readme.txtMD5
5d65511883d204197a5738287d8ddc06
SHA1bbfeb2626323f0d9202a69274d1966746bf9ca77
SHA256c2c07aaa05c228e5756b30eefbb8d3aa4027ab4b683c4fdfdcfa438b11dd3218
SHA51269f26e17af89124189382c2486d7062176b5840d81d86cfeda03e296ee692d104b4cf3d618d2e846c606059db56640a8e8f5e3bba022086ab713d695584e8377
-
memory/1100-61-0x0000000000000000-mapping.dmp
-
memory/1656-60-0x0000000075201000-0x0000000075203000-memory.dmpFilesize
8KB
-
memory/4924-67-0x0000000000000000-mapping.dmp
-
memory/5396-62-0x0000000000000000-mapping.dmp
-
memory/6936-64-0x0000000000000000-mapping.dmp