Analysis
-
max time kernel
155s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-08-2021 17:11
Static task
static1
Behavioral task
behavioral1
Sample
5984c5c2b4ccc824c196ad3a9f966013.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
5984c5c2b4ccc824c196ad3a9f966013.exe
Resource
win10v20210408
General
-
Target
5984c5c2b4ccc824c196ad3a9f966013.exe
-
Size
151KB
-
MD5
5984c5c2b4ccc824c196ad3a9f966013
-
SHA1
6f5c96fb67b4b88d08d0b4e28001421366c4cd66
-
SHA256
7e92233d9ad854b672068825a64c442ed8e6f4f283729c874296278e235d7241
-
SHA512
443ba4a8df892f3d0a6a7bc70233c639e92af87e9beb38dbdd4396f0896dd640a1fde3e513a73de6b13c6add3801bc34b90659bcd0e71cc05eb7fdb0c1c573b8
Malware Config
Extracted
C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
buran
Extracted
C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt
ryuk
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Extracted
vidar
40.1
824
https://eduarroma.tumblr.com/
-
profile_id
824
Extracted
vidar
40.1
903
https://eduarroma.tumblr.com/
-
profile_id
903
Signatures
-
Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 5 IoCs
resource yara_rule behavioral2/memory/3612-138-0x0000000003FD0000-0x000000000406D000-memory.dmp family_vidar behavioral2/memory/3612-139-0x0000000000400000-0x00000000023FF000-memory.dmp family_vidar behavioral2/memory/1364-169-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar behavioral2/memory/1364-170-0x000000000046B77D-mapping.dmp family_vidar behavioral2/memory/1364-178-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
pid Process 1136 FE3C.exe 3612 FF75.exe 1328 16A.exe 1196 4B7.exe 2296 explorer.exe 1892 explorer.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion FE3C.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FE3C.exe -
Deletes itself 1 IoCs
pid Process 3000 Process not Found -
Loads dropped DLL 4 IoCs
pid Process 3612 FF75.exe 3612 FF75.exe 1364 MSBuild.exe 1364 MSBuild.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000300000001ab1e-119.dat themida behavioral2/files/0x000300000001ab1e-120.dat themida behavioral2/memory/1136-133-0x0000000000800000-0x0000000000801000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run 16A.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" -start" 16A.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FE3C.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\B: explorer.exe File opened (read-only) \??\A: explorer.exe File opened (read-only) \??\X: explorer.exe File opened (read-only) \??\U: explorer.exe File opened (read-only) \??\R: explorer.exe File opened (read-only) \??\L: explorer.exe File opened (read-only) \??\I: explorer.exe File opened (read-only) \??\H: explorer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\Z: explorer.exe File opened (read-only) \??\S: explorer.exe File opened (read-only) \??\Q: explorer.exe File opened (read-only) \??\O: explorer.exe File opened (read-only) \??\N: explorer.exe File opened (read-only) \??\J: explorer.exe File opened (read-only) \??\G: explorer.exe File opened (read-only) \??\Y: explorer.exe File opened (read-only) \??\W: explorer.exe File opened (read-only) \??\V: explorer.exe File opened (read-only) \??\T: explorer.exe File opened (read-only) \??\P: explorer.exe File opened (read-only) \??\M: explorer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 geoiptool.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1136 FE3C.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3492 set thread context of 3464 3492 5984c5c2b4ccc824c196ad3a9f966013.exe 77 PID 1196 set thread context of 1364 1196 4B7.exe 89 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-unplated_contrast-white.png explorer.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.payfast.C95-F8C-EF5 explorer.exe File created C:\Program Files\VideoLAN\VLC\locale\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\THMBNAIL.PNG.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-40_altform-unplated.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\WideTile.scale-100.png explorer.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Resources\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.payfast.C95-F8C-EF5 explorer.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Awards\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\LargeFreecellTile.jpg explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluError_136x136.svg.payfast.C95-F8C-EF5 explorer.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Avatars\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\Aerial.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_uinline_warning.svg.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\ResetCoord.scale-180.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\paperboat.3mf explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1937_20x20x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-32.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.payfast.C95-F8C-EF5 explorer.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchLargeTile.scale-125.png explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2017.125.40.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_scale-125.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.XLSX.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\4694_24x24x32.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\THMBNAIL.PNG explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-150.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_contrast-white.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\aquarium_10h.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8576_40x40x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-400.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\Hx.HxT.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-200.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\cn_16x11.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\AppxSignature.p7x explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-24.png explorer.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Resources\Fonts\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reportabuse-default_18.svg explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-64.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-100.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_contrast-black.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.payfast.C95-F8C-EF5 explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\PAPYRUS.INF explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileWide.scale-200.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_up_selected_18.svg explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.payfast.C95-F8C-EF5 explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3932 1364 WerFault.exe 89 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5984c5c2b4ccc824c196ad3a9f966013.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5984c5c2b4ccc824c196ad3a9f966013.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5984c5c2b4ccc824c196ad3a9f966013.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FF75.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FF75.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3148 timeout.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 948 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 2232 taskkill.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 16A.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 16A.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3464 5984c5c2b4ccc824c196ad3a9f966013.exe 3464 5984c5c2b4ccc824c196ad3a9f966013.exe 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3000 Process not Found -
Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 3464 5984c5c2b4ccc824c196ad3a9f966013.exe 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeDebugPrivilege 1196 4B7.exe Token: SeDebugPrivilege 1136 FE3C.exe Token: SeRestorePrivilege 3932 WerFault.exe Token: SeBackupPrivilege 3932 WerFault.exe Token: SeDebugPrivilege 2232 taskkill.exe Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeDebugPrivilege 3932 WerFault.exe Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeShutdownPrivilege 3000 Process not Found Token: SeCreatePagefilePrivilege 3000 Process not Found Token: SeIncreaseQuotaPrivilege 2212 WMIC.exe Token: SeSecurityPrivilege 2212 WMIC.exe Token: SeTakeOwnershipPrivilege 2212 WMIC.exe Token: SeLoadDriverPrivilege 2212 WMIC.exe Token: SeSystemProfilePrivilege 2212 WMIC.exe Token: SeSystemtimePrivilege 2212 WMIC.exe Token: SeProfSingleProcessPrivilege 2212 WMIC.exe Token: SeIncBasePriorityPrivilege 2212 WMIC.exe Token: SeCreatePagefilePrivilege 2212 WMIC.exe Token: SeBackupPrivilege 2212 WMIC.exe Token: SeRestorePrivilege 2212 WMIC.exe Token: SeShutdownPrivilege 2212 WMIC.exe Token: SeDebugPrivilege 2212 WMIC.exe Token: SeSystemEnvironmentPrivilege 2212 WMIC.exe Token: SeRemoteShutdownPrivilege 2212 WMIC.exe Token: SeUndockPrivilege 2212 WMIC.exe Token: SeManageVolumePrivilege 2212 WMIC.exe Token: 33 2212 WMIC.exe Token: 34 2212 WMIC.exe Token: 35 2212 WMIC.exe Token: 36 2212 WMIC.exe Token: SeBackupPrivilege 1876 vssvc.exe Token: SeRestorePrivilege 1876 vssvc.exe Token: SeAuditPrivilege 1876 vssvc.exe Token: SeIncreaseQuotaPrivilege 2212 WMIC.exe Token: SeSecurityPrivilege 2212 WMIC.exe Token: SeTakeOwnershipPrivilege 2212 WMIC.exe Token: SeLoadDriverPrivilege 2212 WMIC.exe Token: SeSystemProfilePrivilege 2212 WMIC.exe Token: SeSystemtimePrivilege 2212 WMIC.exe Token: SeProfSingleProcessPrivilege 2212 WMIC.exe Token: SeIncBasePriorityPrivilege 2212 WMIC.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3000 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3492 wrote to memory of 3464 3492 5984c5c2b4ccc824c196ad3a9f966013.exe 77 PID 3492 wrote to memory of 3464 3492 5984c5c2b4ccc824c196ad3a9f966013.exe 77 PID 3492 wrote to memory of 3464 3492 5984c5c2b4ccc824c196ad3a9f966013.exe 77 PID 3492 wrote to memory of 3464 3492 5984c5c2b4ccc824c196ad3a9f966013.exe 77 PID 3492 wrote to memory of 3464 3492 5984c5c2b4ccc824c196ad3a9f966013.exe 77 PID 3492 wrote to memory of 3464 3492 5984c5c2b4ccc824c196ad3a9f966013.exe 77 PID 3000 wrote to memory of 1136 3000 Process not Found 79 PID 3000 wrote to memory of 1136 3000 Process not Found 79 PID 3000 wrote to memory of 1136 3000 Process not Found 79 PID 3000 wrote to memory of 3612 3000 Process not Found 81 PID 3000 wrote to memory of 3612 3000 Process not Found 81 PID 3000 wrote to memory of 3612 3000 Process not Found 81 PID 3000 wrote to memory of 1328 3000 Process not Found 82 PID 3000 wrote to memory of 1328 3000 Process not Found 82 PID 3000 wrote to memory of 1328 3000 Process not Found 82 PID 3000 wrote to memory of 1196 3000 Process not Found 83 PID 3000 wrote to memory of 1196 3000 Process not Found 83 PID 3000 wrote to memory of 1196 3000 Process not Found 83 PID 3000 wrote to memory of 1536 3000 Process not Found 84 PID 3000 wrote to memory of 1536 3000 Process not Found 84 PID 3000 wrote to memory of 1536 3000 Process not Found 84 PID 3000 wrote to memory of 1536 3000 Process not Found 84 PID 3000 wrote to memory of 1816 3000 Process not Found 85 PID 3000 wrote to memory of 1816 3000 Process not Found 85 PID 3000 wrote to memory of 1816 3000 Process not Found 85 PID 3000 wrote to memory of 3476 3000 Process not Found 86 PID 3000 wrote to memory of 3476 3000 Process not Found 86 PID 3000 wrote to memory of 3476 3000 Process not Found 86 PID 3000 wrote to memory of 3476 3000 Process not Found 86 PID 3000 wrote to memory of 2292 3000 Process not Found 87 PID 3000 wrote to memory of 2292 3000 Process not Found 87 PID 3000 wrote to memory of 2292 3000 Process not Found 87 PID 1328 wrote to memory of 2296 1328 16A.exe 88 PID 1328 wrote to memory of 2296 1328 16A.exe 88 PID 1328 wrote to memory of 2296 1328 16A.exe 88 PID 3000 wrote to memory of 3596 3000 Process not Found 90 PID 3000 wrote to memory of 3596 3000 Process not Found 90 PID 3000 wrote to memory of 3596 3000 Process not Found 90 PID 3000 wrote to memory of 3596 3000 Process not Found 90 PID 1196 wrote to memory of 1364 1196 4B7.exe 89 PID 1196 wrote to memory of 1364 1196 4B7.exe 89 PID 1196 wrote to memory of 1364 1196 4B7.exe 89 PID 1196 wrote to memory of 1364 1196 4B7.exe 89 PID 1196 wrote to memory of 1364 1196 4B7.exe 89 PID 1196 wrote to memory of 1364 1196 4B7.exe 89 PID 1196 wrote to memory of 1364 1196 4B7.exe 89 PID 1196 wrote to memory of 1364 1196 4B7.exe 89 PID 3000 wrote to memory of 3636 3000 Process not Found 91 PID 3000 wrote to memory of 3636 3000 Process not Found 91 PID 3000 wrote to memory of 3636 3000 Process not Found 91 PID 3000 wrote to memory of 1988 3000 Process not Found 92 PID 3000 wrote to memory of 1988 3000 Process not Found 92 PID 3000 wrote to memory of 1988 3000 Process not Found 92 PID 3000 wrote to memory of 1988 3000 Process not Found 92 PID 3612 wrote to memory of 1748 3612 FF75.exe 93 PID 3612 wrote to memory of 1748 3612 FF75.exe 93 PID 3612 wrote to memory of 1748 3612 FF75.exe 93 PID 3000 wrote to memory of 3884 3000 Process not Found 96 PID 3000 wrote to memory of 3884 3000 Process not Found 96 PID 3000 wrote to memory of 3884 3000 Process not Found 96 PID 1748 wrote to memory of 2232 1748 cmd.exe 99 PID 1748 wrote to memory of 2232 1748 cmd.exe 99 PID 1748 wrote to memory of 2232 1748 cmd.exe 99 PID 3000 wrote to memory of 3600 3000 Process not Found 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\5984c5c2b4ccc824c196ad3a9f966013.exe"C:\Users\Admin\AppData\Local\Temp\5984c5c2b4ccc824c196ad3a9f966013.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\5984c5c2b4ccc824c196ad3a9f966013.exe"C:\Users\Admin\AppData\Local\Temp\5984c5c2b4ccc824c196ad3a9f966013.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3464
-
-
C:\Users\Admin\AppData\Local\Temp\FE3C.exeC:\Users\Admin\AppData\Local\Temp\FE3C.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
C:\Users\Admin\AppData\Local\Temp\FF75.exeC:\Users\Admin\AppData\Local\Temp\FF75.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im FF75.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\FF75.exe" & del C:\ProgramData\*.dll & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im FF75.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:3148
-
-
-
C:\Users\Admin\AppData\Local\Temp\16A.exeC:\Users\Admin\AppData\Local\Temp\16A.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -start2⤵
- Executes dropped EXE
- Enumerates connected drives
PID:2296 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete3⤵PID:3880
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵PID:200
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet3⤵PID:204
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -agent 03⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1892
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet3⤵PID:4060
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:948
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no3⤵PID:1280
-
-
-
C:\Users\Admin\AppData\Local\Temp\4B7.exeC:\Users\Admin\AppData\Local\Temp\4B7.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Loads dropped DLL
PID:1364 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 14883⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3932
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1536
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1816
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3476
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2292
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3596
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3636
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1988
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3884
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3600
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1876