Analysis
-
max time kernel
110s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-07-2021 12:57
Static task
static1
Behavioral task
behavioral1
Sample
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe
Resource
win10v20210410
General
-
Target
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe
-
Size
191KB
-
MD5
965d3b5a69778fb98336811099866921
-
SHA1
34293ddd9c4f8b2239e288bf7c3680743bc23eb3
-
SHA256
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c
-
SHA512
ff8f648702d53716bbf4d40f1e3097a288e0665614543fb21fca942bd12c6105023d9bddb99761b11ae2b4ec3257258be2ae995487225cdcd49955255d651b24
Malware Config
Extracted
\??\c:\_R_E_A_D___T_H_I_S___DH31LD_.txt
cerber
http://xpcx6erilkjced3j.onion/CDFC-ECDD-6DF1-0006-4C5B
http://xpcx6erilkjced3j.tor2web.org/CDFC-ECDD-6DF1-0006-4C5B
http://xpcx6erilkjced3j.onion.link/CDFC-ECDD-6DF1-0006-4C5B
http://xpcx6erilkjced3j.onion.nu/CDFC-ECDD-6DF1-0006-4C5B
http://xpcx6erilkjced3j.onion.cab/CDFC-ECDD-6DF1-0006-4C5B
http://xpcx6erilkjced3j.onion.to/CDFC-ECDD-6DF1-0006-4C5B
Extracted
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___0Z1C2HLD_.hta
http://xpcx6erilkjced3j.tor2web.org/CDFC-ECDD-6DF1-0006-4C5Bhttp://xpcx6erilkjced3j.onion.link/CDFC-ECDD-6DF1-0006-4C5Bhttp://xpcx6erilkjced3j.onion.nu/CDFC-ECDD-6DF1-0006-4C5Bhttp://xpcx6erilkjced3j.onion.cab/CDFC-ECDD-6DF1-0006-4C5Bhttp://xpcx6erilkjced3j.onion.to/CDFC-ECDD-6DF1-0006-4C5B
http://xpcx6erilkjced3j.onion/CDFC-ECDD-6DF1-0006-4C5B
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
suricata: ET MALWARE Ransomware/Cerber Checkin M3 (13)
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 1 IoCs
Processes:
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exedescription ioc process File opened (read-only) \??\m: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\p: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\r: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\e: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\i: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\l: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\q: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\k: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\n: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\o: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\t: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\a: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\b: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\f: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\g: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\x: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\z: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\v: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\w: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\y: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\h: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\j: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\s: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened (read-only) \??\u: 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe -
Drops file in System32 directory 38 IoCs
Processes:
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6A97.bmp" 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe -
Drops file in Program Files directory 20 IoCs
Processes:
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exedescription ioc process File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files\ 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\thunderbird 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\ 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\bitcoin 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\excel 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\office 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\the bat! 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\office 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\program files (x86)\steam 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe -
Drops file in Windows directory 64 IoCs
Processes:
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\ 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 208 656 WerFault.exe mshta.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 600 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 1212 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exeWerFault.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe Token: SeCreatePagefilePrivilege 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe Token: SeRestorePrivilege 208 WerFault.exe Token: SeBackupPrivilege 208 WerFault.exe Token: SeDebugPrivilege 208 WerFault.exe Token: SeDebugPrivilege 600 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.execmd.exedescription pid process target process PID 1892 wrote to memory of 2772 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe netsh.exe PID 1892 wrote to memory of 2772 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe netsh.exe PID 1892 wrote to memory of 2772 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe netsh.exe PID 1892 wrote to memory of 2736 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe netsh.exe PID 1892 wrote to memory of 2736 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe netsh.exe PID 1892 wrote to memory of 2736 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe netsh.exe PID 1892 wrote to memory of 656 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe mshta.exe PID 1892 wrote to memory of 656 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe mshta.exe PID 1892 wrote to memory of 656 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe mshta.exe PID 1892 wrote to memory of 1212 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe NOTEPAD.EXE PID 1892 wrote to memory of 1212 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe NOTEPAD.EXE PID 1892 wrote to memory of 1212 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe NOTEPAD.EXE PID 1892 wrote to memory of 2180 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe cmd.exe PID 1892 wrote to memory of 2180 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe cmd.exe PID 1892 wrote to memory of 2180 1892 2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe cmd.exe PID 2180 wrote to memory of 600 2180 cmd.exe taskkill.exe PID 2180 wrote to memory of 600 2180 cmd.exe taskkill.exe PID 2180 wrote to memory of 600 2180 cmd.exe taskkill.exe PID 2180 wrote to memory of 3584 2180 cmd.exe PING.EXE PID 2180 wrote to memory of 3584 2180 cmd.exe PING.EXE PID 2180 wrote to memory of 3584 2180 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe"C:\Users\Admin\AppData\Local\Temp\2f72425b28c03245758d9778b9f637ac981f1ec3df591162f69949c466bfb19c.sample.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___0Z1C2HLD_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 18363⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___8B0O2_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "2" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "2"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___0Z1C2HLD_.htaMD5
d1e19e9c632362509fb3c619bba8f254
SHA12102db20baa8377907e08271d20e515f033789d8
SHA25662c89f071d4fca94819372d7438fae1987451af74b69bc3b2224222dec0fbfd2
SHA5124212fabaf941837a708563e4079dd0b30aaf0a7e982f805b8998f539821260b678a5b8ea250eeb165a7baef6319f1a73d54c032ad97f2f3442f0c176e00e9bae
-
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___8B0O2_.txtMD5
143f22934fb58f10cae36f2f6feb24eb
SHA1f55b350f550792b4c7a1cecb35f1e070fec8245e
SHA256fe313eb93226b21e10edb162967e6240c7fe02b0c77d74234bee510f0214b049
SHA51287c555b92b7fca15fa641e5763df09a9d05cbf6f448592dac3ef7ae4b2a16be1636e02773eb2dee175da13bc68948d0115ad1d11000869de36674d4bcba460a3
-
memory/600-121-0x0000000000000000-mapping.dmp
-
memory/656-116-0x0000000000000000-mapping.dmp
-
memory/1212-117-0x0000000000000000-mapping.dmp
-
memory/2180-120-0x0000000000000000-mapping.dmp
-
memory/2736-115-0x0000000000000000-mapping.dmp
-
memory/2772-114-0x0000000000000000-mapping.dmp
-
memory/3584-122-0x0000000000000000-mapping.dmp