Analysis
-
max time kernel
130s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-07-2021 12:41
Static task
static1
Behavioral task
behavioral1
Sample
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe
Resource
win10v20210410
General
-
Target
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe
-
Size
69KB
-
MD5
3229e2489dde524195cf0ccbbf5f7d40
-
SHA1
a257fc0b117fb9e0a6df128213e11de5cee21129
-
SHA256
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d
-
SHA512
d719fcf974a9304154daf95f0c80805b9a720a1db1289aa4fd189494cb0c29820a1b999d26fb38378d3a47602b26ff8375189ed9586a9c94c19fae0f4e0c650e
Malware Config
Extracted
C:\C7FE97-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\odt\C7FE97-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\C7FE97-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\UpdateComplete.png => C:\Users\Admin\Pictures\UpdateComplete.png.c7fe97 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Users\Admin\Pictures\ResolveHide.tiff 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\WaitBackup.tif => C:\Users\Admin\Pictures\WaitBackup.tif.c7fe97 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\ResolveHide.tiff => C:\Users\Admin\Pictures\ResolveHide.tiff.c7fe97 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\StartUninstall.tif => C:\Users\Admin\Pictures\StartUninstall.tif.c7fe97 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File renamed C:\Users\Admin\Pictures\TraceExport.tif => C:\Users\Admin\Pictures\TraceExport.tif.c7fe97 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-125.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-200_contrast-high.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\ECHO.ELM 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\C7FE97-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\mh_60x42.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\drink.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-100_contrast-black.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jvmti.h 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16_altform-unplated.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_contrast-white.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeWideTile.scale-400.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-100.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\THMBNAIL.PNG 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-black_scale-100.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL027.XML 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\en-US.pak 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_retina.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare-2x.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-black\Square44x44Logo.targetsize-16.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-white\Square310x310Logo.scale-100.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\office.core.operational.js 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\ExpandGet.wav 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-200.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\SmallTile.scale-125.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-150_contrast-black.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZY______.PFB 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-150.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\excluded.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\selector.js 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\remove.svg 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-80.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-48.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\C7FE97-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-16.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookMedTile.scale-200.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-32_altform-unplated.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-125.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-150.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\C7FE97-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\ui-strings.js 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\lobby_deck_style_western.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.LEX 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT532.CNV 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\PREVIEW.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\OfflineMapsWide.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\snooze.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Effects\effects_lobby_particles.jpg 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-100.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_SV-SE.respack 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchSmallTile.contrast-white_scale-125.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\C7FE97-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1160 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5384 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exepid process 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe Token: SeImpersonatePrivilege 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe Token: SeBackupPrivilege 8496 vssvc.exe Token: SeRestorePrivilege 8496 vssvc.exe Token: SeAuditPrivilege 8496 vssvc.exe Token: SeDebugPrivilege 5384 taskkill.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.execmd.exedescription pid process target process PID 3156 wrote to memory of 1160 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe vssadmin.exe PID 3156 wrote to memory of 1160 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe vssadmin.exe PID 3156 wrote to memory of 6848 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe notepad.exe PID 3156 wrote to memory of 6848 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe notepad.exe PID 3156 wrote to memory of 6848 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe notepad.exe PID 3156 wrote to memory of 9160 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe cmd.exe PID 3156 wrote to memory of 9160 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe cmd.exe PID 3156 wrote to memory of 9160 3156 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe cmd.exe PID 9160 wrote to memory of 5384 9160 cmd.exe taskkill.exe PID 9160 wrote to memory of 5384 9160 cmd.exe taskkill.exe PID 9160 wrote to memory of 5384 9160 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe"C:\Users\Admin\AppData\Local\Temp\488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.sample.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\C7FE97-Readme.txt"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\D4AB.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 31563⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\D4AB.tmp.batMD5
f50239ce42ac029bddd455c7de7c0bc2
SHA1ef29f8e910e84b306221155953d5cc41f256affd
SHA256faa5fac5bf086fa65a6c6e10ef5f677f5415d70bee5af4abe198cf8c6bcaf639
SHA5126aad47a408024e68fa9b0b9139d4c19e9b90581c91574216bcee730ef224ef269c888adb6731ab1dfca24a33516bf4ec480abb75fc524aa0a47188ef0218f764
-
C:\Users\Admin\Desktop\C7FE97-Readme.txtMD5
d4498a21ccb55b5527ec91aa7a10a79d
SHA17e4ad259c317bf585d550804a00a427abd304009
SHA2561fcdd19b225bafe4780420f514b02d13369b25b1179143844406ff6655584eca
SHA5128edff9e917c150475609ec5d32e2986e76691c5b5be391e18e57a4840f2512ffd976aae124e4d33becb7e32fa17137252d678680aea002f93ce0352bb1dcbc45
-
memory/1160-114-0x0000000000000000-mapping.dmp
-
memory/5384-118-0x0000000000000000-mapping.dmp
-
memory/6848-115-0x0000000000000000-mapping.dmp
-
memory/9160-116-0x0000000000000000-mapping.dmp