Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 12:57
Static task
static1
Behavioral task
behavioral1
Sample
120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe
Resource
win10v20210408
General
-
Target
120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe
-
Size
120KB
-
MD5
678fff3a5ab12f5af6bbb814d1810b4c
-
SHA1
b088bc6af8ddba1bee212b6f8bf4dcc66002a4ed
-
SHA256
120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30
-
SHA512
2904ac506a3959c6ed067ad62416ddfa392486f783f62f2eb97b7fe8b66b3292884d95e60886ca61894e9c041937378ad6dd059f9541f5cb170efd46f334bdfc
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
http://decrypttozxybarc.dconnect.eu/B8AE-27AC-278B-0006-4BF7
http://decrypttozxybarc.tor2web.org/B8AE-27AC-278B-0006-4BF7
http://decrypttozxybarc.onion.cab/B8AE-27AC-278B-0006-4BF7
http://decrypttozxybarc.onion.to/B8AE-27AC-278B-0006-4BF7
http://decrypttozxybarc.onion.link/B8AE-27AC-278B-0006-4BF7
http://decrypttozxybarc.onion/B8AE-27AC-278B-0006-4BF7
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://decrypttozxybarc.dconnect.eu/B8AE-27AC-278B-0006-4BF7
http://decrypttozxybarc.tor2web.org/B8AE-27AC-278B-0006-4BF7
http://decrypttozxybarc.onion.cab/B8AE-27AC-278B-0006-4BF7
http://decrypttozxybarc.onion.to/B8AE-27AC-278B-0006-4BF7
http://decrypttozxybarc.onion.link/B8AE-27AC-278B-0006-4BF7
http://decrypttozxybarc.onion/B8AE-27AC-278B-0006-4BF7
Signatures
-
suricata: ET MALWARE Ransomware/Cerber Checkin 2
-
suricata: ET MALWARE Ransomware/Cerber Checkin M3 (12)
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 1996 bcdedit.exe 624 bcdedit.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exeDisplaySwitch.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\\DisplaySwitch.exe\"" 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\\DisplaySwitch.exe\"" DisplaySwitch.exe -
Executes dropped EXE 3 IoCs
Processes:
DisplaySwitch.exeDisplaySwitch.exeDisplaySwitch.exepid process 1420 DisplaySwitch.exe 1208 DisplaySwitch.exe 1104 DisplaySwitch.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
DisplaySwitch.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DisplaySwitch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DisplaySwitch.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2016 cmd.exe -
Drops startup file 2 IoCs
Processes:
120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exeDisplaySwitch.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\DisplaySwitch.lnk 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\DisplaySwitch.lnk DisplaySwitch.exe -
Loads dropped DLL 3 IoCs
Processes:
120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exeDisplaySwitch.exepid process 1104 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe 1104 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe 1420 DisplaySwitch.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
DisplaySwitch.exe120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DisplaySwitch = "\"C:\\Users\\Admin\\AppData\\Roaming\\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\\DisplaySwitch.exe\"" DisplaySwitch.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\DisplaySwitch = "\"C:\\Users\\Admin\\AppData\\Roaming\\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\\DisplaySwitch.exe\"" 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DisplaySwitch = "\"C:\\Users\\Admin\\AppData\\Roaming\\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\\DisplaySwitch.exe\"" 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run DisplaySwitch.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\DisplaySwitch = "\"C:\\Users\\Admin\\AppData\\Roaming\\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\\DisplaySwitch.exe\"" DisplaySwitch.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce DisplaySwitch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1888 vssadmin.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1460 taskkill.exe 1084 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exeDisplaySwitch.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\\DisplaySwitch.exe\"" 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop DisplaySwitch.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\\DisplaySwitch.exe\"" DisplaySwitch.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d1e6e52182d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000030baab1ef6dc8647a439a042844d0d88000000000200000000001066000000010000200000004174d72a6550d2dd405c826b72528bb74025f9107bf2adeccc2f108a9afd87ef000000000e80000000020000200000006eac0aabdfb4ff28177ada30be047ea0bc29bae146d99da63e5a4ae6b1da6478900000000f5d65648f0cf40e65d0301f22dd45603ad69006b69e2993fc07acf9aebe4a2fcd078e7437e5cf90ce1be38bd4b56e7609ce1da63f5ebc37be40c7b75e24028f75cb52fa884de43b1d809d4f600b547505c6f74ab0dc5828e2cb83fc012e80c557379e0325020b092f49f61a19c643796c87e2e914fd183fc3bf99f795153f2391c5ff00bc9dc2b3f504192ebdefdbfe40000000f01fdef6dbf9359830c5181ec822072aa1c0f135fcc1aab996e9fb9c94d86ea637b9464021a4f439a53e62a7acaf759f3974753a22944aa6fa11756e4022d3bc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000030baab1ef6dc8647a439a042844d0d8800000000020000000000106600000001000020000000f205cdb962bbcbccfc698b829a29bf276f49d6bd11e4d6c55cb299e92d01b1f0000000000e800000000200002000000013dd52ad59959d38a5451345c1dab92798eac37644573d670ce757d1b6106d0e2000000049a0b3098396b835ee523b1ccd360661445ae367c1fd0024920adcac430643fd40000000e070966595b8961d55580dc19a0896f2c1d4115cb1cb2dcf45ecbed10efab90add8ecf04ae65a2548700d10f63c67eb28daf9e5579216970da7c7396186de8af iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10490B71-EE15-11EB-9155-42C11A88956C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
DisplaySwitch.exepid process 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe 1420 DisplaySwitch.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exeDisplaySwitch.exevssvc.exetaskkill.exewmic.exeDisplaySwitch.exeDisplaySwitch.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 1104 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe Token: SeDebugPrivilege 1420 DisplaySwitch.exe Token: SeBackupPrivilege 1356 vssvc.exe Token: SeRestorePrivilege 1356 vssvc.exe Token: SeAuditPrivilege 1356 vssvc.exe Token: SeDebugPrivilege 1460 taskkill.exe Token: SeIncreaseQuotaPrivilege 472 wmic.exe Token: SeSecurityPrivilege 472 wmic.exe Token: SeTakeOwnershipPrivilege 472 wmic.exe Token: SeLoadDriverPrivilege 472 wmic.exe Token: SeSystemProfilePrivilege 472 wmic.exe Token: SeSystemtimePrivilege 472 wmic.exe Token: SeProfSingleProcessPrivilege 472 wmic.exe Token: SeIncBasePriorityPrivilege 472 wmic.exe Token: SeCreatePagefilePrivilege 472 wmic.exe Token: SeBackupPrivilege 472 wmic.exe Token: SeRestorePrivilege 472 wmic.exe Token: SeShutdownPrivilege 472 wmic.exe Token: SeDebugPrivilege 472 wmic.exe Token: SeSystemEnvironmentPrivilege 472 wmic.exe Token: SeRemoteShutdownPrivilege 472 wmic.exe Token: SeUndockPrivilege 472 wmic.exe Token: SeManageVolumePrivilege 472 wmic.exe Token: 33 472 wmic.exe Token: 34 472 wmic.exe Token: 35 472 wmic.exe Token: SeIncreaseQuotaPrivilege 472 wmic.exe Token: SeSecurityPrivilege 472 wmic.exe Token: SeTakeOwnershipPrivilege 472 wmic.exe Token: SeLoadDriverPrivilege 472 wmic.exe Token: SeSystemProfilePrivilege 472 wmic.exe Token: SeSystemtimePrivilege 472 wmic.exe Token: SeProfSingleProcessPrivilege 472 wmic.exe Token: SeIncBasePriorityPrivilege 472 wmic.exe Token: SeCreatePagefilePrivilege 472 wmic.exe Token: SeBackupPrivilege 472 wmic.exe Token: SeRestorePrivilege 472 wmic.exe Token: SeShutdownPrivilege 472 wmic.exe Token: SeDebugPrivilege 472 wmic.exe Token: SeSystemEnvironmentPrivilege 472 wmic.exe Token: SeRemoteShutdownPrivilege 472 wmic.exe Token: SeUndockPrivilege 472 wmic.exe Token: SeManageVolumePrivilege 472 wmic.exe Token: 33 472 wmic.exe Token: 34 472 wmic.exe Token: 35 472 wmic.exe Token: SeDebugPrivilege 1208 DisplaySwitch.exe Token: SeDebugPrivilege 1104 DisplaySwitch.exe Token: 33 1824 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1824 AUDIODG.EXE Token: 33 1824 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1824 AUDIODG.EXE Token: SeDebugPrivilege 1084 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1892 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1892 iexplore.exe 1892 iexplore.exe 1172 IEXPLORE.EXE 1172 IEXPLORE.EXE 1172 IEXPLORE.EXE 1172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exeDisplaySwitch.execmd.exetaskeng.exeiexplore.execmd.exedescription pid process target process PID 1104 wrote to memory of 1420 1104 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe DisplaySwitch.exe PID 1104 wrote to memory of 1420 1104 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe DisplaySwitch.exe PID 1104 wrote to memory of 1420 1104 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe DisplaySwitch.exe PID 1104 wrote to memory of 1420 1104 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe DisplaySwitch.exe PID 1420 wrote to memory of 1888 1420 DisplaySwitch.exe vssadmin.exe PID 1420 wrote to memory of 1888 1420 DisplaySwitch.exe vssadmin.exe PID 1420 wrote to memory of 1888 1420 DisplaySwitch.exe vssadmin.exe PID 1420 wrote to memory of 1888 1420 DisplaySwitch.exe vssadmin.exe PID 1104 wrote to memory of 2016 1104 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe cmd.exe PID 1104 wrote to memory of 2016 1104 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe cmd.exe PID 1104 wrote to memory of 2016 1104 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe cmd.exe PID 1104 wrote to memory of 2016 1104 120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe cmd.exe PID 2016 wrote to memory of 1460 2016 cmd.exe taskkill.exe PID 2016 wrote to memory of 1460 2016 cmd.exe taskkill.exe PID 2016 wrote to memory of 1460 2016 cmd.exe taskkill.exe PID 2016 wrote to memory of 1460 2016 cmd.exe taskkill.exe PID 1420 wrote to memory of 472 1420 DisplaySwitch.exe wmic.exe PID 1420 wrote to memory of 472 1420 DisplaySwitch.exe wmic.exe PID 1420 wrote to memory of 472 1420 DisplaySwitch.exe wmic.exe PID 1420 wrote to memory of 472 1420 DisplaySwitch.exe wmic.exe PID 2016 wrote to memory of 1988 2016 cmd.exe PING.EXE PID 2016 wrote to memory of 1988 2016 cmd.exe PING.EXE PID 2016 wrote to memory of 1988 2016 cmd.exe PING.EXE PID 2016 wrote to memory of 1988 2016 cmd.exe PING.EXE PID 1420 wrote to memory of 1996 1420 DisplaySwitch.exe bcdedit.exe PID 1420 wrote to memory of 1996 1420 DisplaySwitch.exe bcdedit.exe PID 1420 wrote to memory of 1996 1420 DisplaySwitch.exe bcdedit.exe PID 1420 wrote to memory of 1996 1420 DisplaySwitch.exe bcdedit.exe PID 1420 wrote to memory of 624 1420 DisplaySwitch.exe bcdedit.exe PID 1420 wrote to memory of 624 1420 DisplaySwitch.exe bcdedit.exe PID 1420 wrote to memory of 624 1420 DisplaySwitch.exe bcdedit.exe PID 1420 wrote to memory of 624 1420 DisplaySwitch.exe bcdedit.exe PID 848 wrote to memory of 1208 848 taskeng.exe DisplaySwitch.exe PID 848 wrote to memory of 1208 848 taskeng.exe DisplaySwitch.exe PID 848 wrote to memory of 1208 848 taskeng.exe DisplaySwitch.exe PID 848 wrote to memory of 1208 848 taskeng.exe DisplaySwitch.exe PID 848 wrote to memory of 1104 848 taskeng.exe DisplaySwitch.exe PID 848 wrote to memory of 1104 848 taskeng.exe DisplaySwitch.exe PID 848 wrote to memory of 1104 848 taskeng.exe DisplaySwitch.exe PID 848 wrote to memory of 1104 848 taskeng.exe DisplaySwitch.exe PID 1420 wrote to memory of 2036 1420 DisplaySwitch.exe NOTEPAD.EXE PID 1420 wrote to memory of 2036 1420 DisplaySwitch.exe NOTEPAD.EXE PID 1420 wrote to memory of 2036 1420 DisplaySwitch.exe NOTEPAD.EXE PID 1420 wrote to memory of 2036 1420 DisplaySwitch.exe NOTEPAD.EXE PID 1420 wrote to memory of 1892 1420 DisplaySwitch.exe iexplore.exe PID 1420 wrote to memory of 1892 1420 DisplaySwitch.exe iexplore.exe PID 1420 wrote to memory of 1892 1420 DisplaySwitch.exe iexplore.exe PID 1420 wrote to memory of 1892 1420 DisplaySwitch.exe iexplore.exe PID 1420 wrote to memory of 1320 1420 DisplaySwitch.exe WScript.exe PID 1420 wrote to memory of 1320 1420 DisplaySwitch.exe WScript.exe PID 1420 wrote to memory of 1320 1420 DisplaySwitch.exe WScript.exe PID 1420 wrote to memory of 1320 1420 DisplaySwitch.exe WScript.exe PID 1892 wrote to memory of 1172 1892 iexplore.exe IEXPLORE.EXE PID 1892 wrote to memory of 1172 1892 iexplore.exe IEXPLORE.EXE PID 1892 wrote to memory of 1172 1892 iexplore.exe IEXPLORE.EXE PID 1892 wrote to memory of 1172 1892 iexplore.exe IEXPLORE.EXE PID 1420 wrote to memory of 924 1420 DisplaySwitch.exe cmd.exe PID 1420 wrote to memory of 924 1420 DisplaySwitch.exe cmd.exe PID 1420 wrote to memory of 924 1420 DisplaySwitch.exe cmd.exe PID 1420 wrote to memory of 924 1420 DisplaySwitch.exe cmd.exe PID 924 wrote to memory of 1084 924 cmd.exe taskkill.exe PID 924 wrote to memory of 1084 924 cmd.exe taskkill.exe PID 924 wrote to memory of 1084 924 cmd.exe taskkill.exe PID 924 wrote to memory of 552 924 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe"C:\Users\Admin\AppData\Local\Temp\120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exe"C:\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "DisplaySwitch.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "DisplaySwitch.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30.sample.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {8C210ED2-5432-44F3-91D2-8960C0D98E71} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exeC:\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exeC:\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x57c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\DisplaySwitch.lnkMD5
3ecae11d58e98bd22a6172b9b7a40e10
SHA19ff40811521d10632e8eaea43b5b547625c33ee9
SHA256dc9e300447cbcdead190bb09dd297510863fba38c3574a45486e6dc222a747fd
SHA5123f30109571ea0691cad2ed044a8d99175ae6929f65e9cb80ff9c900ff815e9cd4e7aec339dc30cf87a4ad00ba18263e7ddc17d77463206147d4e255f8ecc2e03
-
C:\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exeMD5
678fff3a5ab12f5af6bbb814d1810b4c
SHA1b088bc6af8ddba1bee212b6f8bf4dcc66002a4ed
SHA256120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30
SHA5122904ac506a3959c6ed067ad62416ddfa392486f783f62f2eb97b7fe8b66b3292884d95e60886ca61894e9c041937378ad6dd059f9541f5cb170efd46f334bdfc
-
C:\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exeMD5
678fff3a5ab12f5af6bbb814d1810b4c
SHA1b088bc6af8ddba1bee212b6f8bf4dcc66002a4ed
SHA256120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30
SHA5122904ac506a3959c6ed067ad62416ddfa392486f783f62f2eb97b7fe8b66b3292884d95e60886ca61894e9c041937378ad6dd059f9541f5cb170efd46f334bdfc
-
C:\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exeMD5
678fff3a5ab12f5af6bbb814d1810b4c
SHA1b088bc6af8ddba1bee212b6f8bf4dcc66002a4ed
SHA256120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30
SHA5122904ac506a3959c6ed067ad62416ddfa392486f783f62f2eb97b7fe8b66b3292884d95e60886ca61894e9c041937378ad6dd059f9541f5cb170efd46f334bdfc
-
C:\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exeMD5
678fff3a5ab12f5af6bbb814d1810b4c
SHA1b088bc6af8ddba1bee212b6f8bf4dcc66002a4ed
SHA256120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30
SHA5122904ac506a3959c6ed067ad62416ddfa392486f783f62f2eb97b7fe8b66b3292884d95e60886ca61894e9c041937378ad6dd059f9541f5cb170efd46f334bdfc
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.htmlMD5
c8f127af75cd678b937a63004ab8e9bd
SHA1068117f650fa47a02ff827b9790d7c9eda9d6baa
SHA25602d3149eacaa75304cb2443637a167ed95688642a067059bd4fda7ee2454da0b
SHA5127625696c491327a4348f45fdb6e6f015c61659f354e2cc0a17c936f880ec3462c34b3bcd3608f4e31f567efb45bceb903aa89f8f62fe6db7637f5e9ec31a11cc
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txtMD5
5e550d301ea8fde33866eae79f7b3f3b
SHA1db96d84a14239db86f6e443fa4052cb9b7464196
SHA25618dcf3c4e51cd63b087f8ca70f11d7bb4e392a19c4882e946058d08a184f5e9c
SHA51209b1fbe75ea489bbc7c400b2214421f51fb7d89b7d7bb46f7a1c515e2bc1a6b02c3de0c769718454c7937d2fb8beb7cbf2484aa8c844c41cf10eb55351b3204a
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbsMD5
f4f62c6f03227c16f4224d94f3df3290
SHA1e5d588a1fba64c8886685b948f51550e4807431e
SHA256794ae25ea84923dbb539d6c7fba91206d56f11606a853ccb1dad54a8f84cebe2
SHA512bcb43c92f5c95dfe301d4c2c219d9dfdebf8b47336c190a639e7436229ae6f7c16b861c422f3c054121962caced526a0d397eb1d93536fcf13e836c0fda67363
-
\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exeMD5
678fff3a5ab12f5af6bbb814d1810b4c
SHA1b088bc6af8ddba1bee212b6f8bf4dcc66002a4ed
SHA256120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30
SHA5122904ac506a3959c6ed067ad62416ddfa392486f783f62f2eb97b7fe8b66b3292884d95e60886ca61894e9c041937378ad6dd059f9541f5cb170efd46f334bdfc
-
\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exeMD5
678fff3a5ab12f5af6bbb814d1810b4c
SHA1b088bc6af8ddba1bee212b6f8bf4dcc66002a4ed
SHA256120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30
SHA5122904ac506a3959c6ed067ad62416ddfa392486f783f62f2eb97b7fe8b66b3292884d95e60886ca61894e9c041937378ad6dd059f9541f5cb170efd46f334bdfc
-
\Users\Admin\AppData\Roaming\{F7A21D6E-5744-E3E1-1E0E-7FCE223524B1}\DisplaySwitch.exeMD5
678fff3a5ab12f5af6bbb814d1810b4c
SHA1b088bc6af8ddba1bee212b6f8bf4dcc66002a4ed
SHA256120904fa76dba7bdaf0f5c3732b58b050e8d1366c11093ada9e4d894076f2d30
SHA5122904ac506a3959c6ed067ad62416ddfa392486f783f62f2eb97b7fe8b66b3292884d95e60886ca61894e9c041937378ad6dd059f9541f5cb170efd46f334bdfc
-
memory/472-70-0x0000000000000000-mapping.dmp
-
memory/552-93-0x0000000000000000-mapping.dmp
-
memory/624-73-0x0000000000000000-mapping.dmp
-
memory/924-91-0x0000000000000000-mapping.dmp
-
memory/1084-92-0x0000000000000000-mapping.dmp
-
memory/1104-59-0x0000000076E11000-0x0000000076E13000-memory.dmpFilesize
8KB
-
memory/1104-78-0x0000000000000000-mapping.dmp
-
memory/1172-88-0x0000000000000000-mapping.dmp
-
memory/1208-75-0x0000000000000000-mapping.dmp
-
memory/1320-85-0x0000000000000000-mapping.dmp
-
memory/1420-62-0x0000000000000000-mapping.dmp
-
memory/1460-69-0x0000000000000000-mapping.dmp
-
memory/1888-67-0x0000000000000000-mapping.dmp
-
memory/1892-83-0x0000000000000000-mapping.dmp
-
memory/1988-71-0x0000000000000000-mapping.dmp
-
memory/1996-72-0x0000000000000000-mapping.dmp
-
memory/2016-68-0x0000000000000000-mapping.dmp
-
memory/2036-82-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmpFilesize
8KB
-
memory/2036-81-0x0000000000000000-mapping.dmp