Analysis
-
max time kernel
145s -
max time network
185s -
platform
windows10_x64 -
resource
win10-en -
submitted
02-09-2021 08:12
Static task
static1
Behavioral task
behavioral1
Sample
26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
Resource
win10-en
General
-
Target
26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
-
Size
997KB
-
MD5
ba454585b9f42c7254c931c192556e08
-
SHA1
0b530303634283a43d53abd9190106869f57ba5a
-
SHA256
26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa
-
SHA512
2cb918eab6776c7cfea031cbb48cc4e33e068489a37f39ba1e246f32fef7a35c3511293b399c81b5b8056bca50d725554866584460f04efe0d65c1d1c625bc4b
Malware Config
Signatures
-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1808 created 900 1808 WerFault.exe 68 -
Modifies Windows Firewall 1 TTPs
-
Drops desktop.ini file(s) 4 IoCs
description ioc Process File created C:\Program Files\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2559286294-2439613352-4032193287-1000\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\$Recycle.Bin\S-1-5-21-2559286294-2439613352-4032193287-1000\desktop.ini 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
description flow ioc HTTP URL 17 http://www.sfml-dev.org/ip-provider.php -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\AssertUnprotect.potx 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\AssertUnprotect.potx.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\UnpublishFind.vbs.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\TestEnter.rtf.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\TraceBackup.exe.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\SelectWait.ttf 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\CompareUnregister.temp.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\StopSuspend.001.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\StopSuspend.001.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\descript.ion 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\ReceiveCompare.docm 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\TestEnter.rtf 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\TraceBackup.exe 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\InstallMerge.xla.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\RepairRead.wdp.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\UnregisterImport.avi.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\History.txt 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\InstallMerge.xla 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\7z.exe.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\CompareUnregister.temp.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\ResetDismount.3gp.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\ReceiveCompare.docm.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\InitializeFind.vst.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\TraceBackup.exe.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\7z.sfx.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\RepairRead.wdp 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\UnregisterImport.avi 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\7z.exe 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\AssertUnprotect.potx.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\TestEnter.rtf.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\RepairRead.wdp.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\CompareUnregister.temp 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\SwitchMerge.pcx.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\7-Zip\7z.exe.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\7-Zip\7zG.exe.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\PublishSave.pptx 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\UnblockSet.xlsb 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\InitializeFind.vst.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\SwitchMerge.pcx.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\PublishSave.pptx.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\License.txt 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\UnblockSet.xlsb.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\UnblockSet.xlsb.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\CompleteUse.png 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\7z.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\CompleteUse.png.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\SelectWait.ttf.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\desktop.ini.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\SelectWait.ttf.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\7zG.exe.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File created C:\Program Files\7-Zip\7-zip.dll.[[email protected]][ID-7ALS923EZQ4MFD8].Void 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\SwitchMerge.pcx 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\UnpublishFind.vbs 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1808 900 WerFault.exe 68 -
Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Documents and Settings\zh-TW\"쀀隚珞\:쀀隚珞\:쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀隚珞\3쀀\3쀀隚珞 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe File opened for modification C:\Documents and Settings\zh-TW\隚珞겨îꮸî闎珞ex\:쀀隚珞墘ì墀ì闎珞\隚珞嫘ì嫀ì闎珞IJ 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe 1808 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1808 WerFault.exe Token: SeBackupPrivilege 1808 WerFault.exe Token: SeDebugPrivilege 1808 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 900 wrote to memory of 3272 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 75 PID 900 wrote to memory of 3272 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 75 PID 900 wrote to memory of 3272 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 75 PID 3272 wrote to memory of 2600 3272 cmd.exe 78 PID 3272 wrote to memory of 2600 3272 cmd.exe 78 PID 3272 wrote to memory of 2600 3272 cmd.exe 78 PID 2600 wrote to memory of 184 2600 net.exe 80 PID 2600 wrote to memory of 184 2600 net.exe 80 PID 2600 wrote to memory of 184 2600 net.exe 80 PID 900 wrote to memory of 2968 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 81 PID 900 wrote to memory of 2968 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 81 PID 900 wrote to memory of 2968 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 81 PID 2968 wrote to memory of 2232 2968 cmd.exe 83 PID 2968 wrote to memory of 2232 2968 cmd.exe 83 PID 2968 wrote to memory of 2232 2968 cmd.exe 83 PID 2232 wrote to memory of 420 2232 net.exe 84 PID 2232 wrote to memory of 420 2232 net.exe 84 PID 2232 wrote to memory of 420 2232 net.exe 84 PID 900 wrote to memory of 1308 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 85 PID 900 wrote to memory of 1308 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 85 PID 900 wrote to memory of 1308 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 85 PID 1308 wrote to memory of 3464 1308 cmd.exe 87 PID 1308 wrote to memory of 3464 1308 cmd.exe 87 PID 1308 wrote to memory of 3464 1308 cmd.exe 87 PID 3464 wrote to memory of 516 3464 net.exe 88 PID 3464 wrote to memory of 516 3464 net.exe 88 PID 3464 wrote to memory of 516 3464 net.exe 88 PID 900 wrote to memory of 3780 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 89 PID 900 wrote to memory of 3780 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 89 PID 900 wrote to memory of 3780 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 89 PID 3780 wrote to memory of 2284 3780 cmd.exe 91 PID 3780 wrote to memory of 2284 3780 cmd.exe 91 PID 3780 wrote to memory of 2284 3780 cmd.exe 91 PID 2284 wrote to memory of 480 2284 net.exe 92 PID 2284 wrote to memory of 480 2284 net.exe 92 PID 2284 wrote to memory of 480 2284 net.exe 92 PID 900 wrote to memory of 4080 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 93 PID 900 wrote to memory of 4080 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 93 PID 900 wrote to memory of 4080 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 93 PID 4080 wrote to memory of 1300 4080 cmd.exe 95 PID 4080 wrote to memory of 1300 4080 cmd.exe 95 PID 4080 wrote to memory of 1300 4080 cmd.exe 95 PID 1300 wrote to memory of 2364 1300 net.exe 96 PID 1300 wrote to memory of 2364 1300 net.exe 96 PID 1300 wrote to memory of 2364 1300 net.exe 96 PID 900 wrote to memory of 3824 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 97 PID 900 wrote to memory of 3824 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 97 PID 900 wrote to memory of 3824 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 97 PID 900 wrote to memory of 3612 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 99 PID 900 wrote to memory of 3612 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 99 PID 900 wrote to memory of 3612 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 99 PID 900 wrote to memory of 2628 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 101 PID 900 wrote to memory of 2628 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 101 PID 900 wrote to memory of 2628 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 101 PID 900 wrote to memory of 184 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 103 PID 900 wrote to memory of 184 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 103 PID 900 wrote to memory of 184 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 103 PID 184 wrote to memory of 2860 184 cmd.exe 105 PID 184 wrote to memory of 2860 184 cmd.exe 105 PID 184 wrote to memory of 2860 184 cmd.exe 105 PID 2860 wrote to memory of 1084 2860 net.exe 106 PID 2860 wrote to memory of 1084 2860 net.exe 106 PID 2860 wrote to memory of 1084 2860 net.exe 106 PID 900 wrote to memory of 420 900 26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe"C:\Users\Admin\AppData\Local\Temp\26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLWriter2⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\net.exenet stop SQLWriter3⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter4⤵PID:184
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLBrowser2⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\net.exenet stop SQLBrowser3⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser4⤵PID:420
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵PID:516
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO12⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\net.exenet stop MSSQL$CONTOSO13⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$CONTOSO14⤵PID:480
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSDTC2⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\net.exenet stop MSDTC3⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSDTC4⤵PID:2364
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵PID:3824
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no2⤵PID:3612
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet2⤵PID:2628
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT2⤵
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT3⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT4⤵PID:1084
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵PID:420
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵PID:932
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵PID:692
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop vds2⤵PID:588
-
C:\Windows\SysWOW64\net.exenet stop vds3⤵PID:3584
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vds4⤵PID:2180
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off2⤵PID:2252
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off3⤵PID:3960
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable2⤵PID:3868
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵PID:2200
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 6002⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3788