Resubmissions
20-10-2021 12:57
211020-p6w69ahag2 10Analysis
-
max time kernel
91s -
max time network
67s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20-10-2021 12:57
Static task
static1
Behavioral task
behavioral1
Sample
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe
Resource
win10-en-20211014
General
-
Target
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe
-
Size
69KB
-
MD5
3a601ee68000508d58ea12203449a202
-
SHA1
9068567b2b3fdae864ca9b1fb9013d0305e3ca83
-
SHA256
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5
-
SHA512
176d60567b2bcf89aa6338f3f14b22ee2592e4ea6349c0a51d67e5b7655de611c2a6e58495cab8d9c5c26deaef03ad19852a0f32cd37466fa3241d61395527b0
Malware Config
Extracted
C:\Program Files\Common Files\DESIGNER\FBA658-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exedescription ioc process File renamed C:\Users\Admin\Pictures\ConfirmSplit.crw => C:\Users\Admin\Pictures\ConfirmSplit.crw.fba658 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File renamed C:\Users\Admin\Pictures\RenameCheckpoint.tif => C:\Users\Admin\Pictures\RenameCheckpoint.tif.fba658 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File renamed C:\Users\Admin\Pictures\RedoApprove.raw => C:\Users\Admin\Pictures\RedoApprove.raw.fba658 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\Images\signal_white.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\sj_60x42.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OneConnectLargeTile.scale-200.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPageState2\mainPage_more_themes_bp_920.jpg 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\FBA658-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\ui-strings.js 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-256.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2494_48x48x32.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\2210_20x20x32.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\174.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\FBA658-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\BLUEPRNT.ELM 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\FBA658-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\resources.pri 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsMedTile.scale-125.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-400.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-200.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\10178_20x20x32.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\FBA658-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-white_scale-125.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-125.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\psfontj2d.properties 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\ui-strings.js 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-options.xml 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore\Resources\Assets\RT_Icons_Spilt_16.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page3.jpg 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-32_altform-unplated.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\ui-strings.js 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-hover_32.svg 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\cz_60x42.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\FBA658-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\ui-strings.js 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\_Resources\5.rsrc 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\FBA658-Readme.txt 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\_Resources\14.rsrc 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6100_40x40x32.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\animations\OneNoteFRE_SaveAutomatically_RTL_Phone.mp4 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\ui-strings.js 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-100.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-100.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-64.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200_contrast-white.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24_altform-unplated.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\main-selector.css 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\1195458082.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3068621934.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3296 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5004 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exepid process 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exevssvc.exetaskmgr.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe Token: SeImpersonatePrivilege 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe Token: SeBackupPrivilege 7536 vssvc.exe Token: SeRestorePrivilege 7536 vssvc.exe Token: SeAuditPrivilege 7536 vssvc.exe Token: SeDebugPrivilege 6912 taskmgr.exe Token: SeSystemProfilePrivilege 6912 taskmgr.exe Token: SeCreateGlobalPrivilege 6912 taskmgr.exe Token: SeDebugPrivilege 5004 taskkill.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
Processes:
taskmgr.exenotepad.exepid process 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 5552 notepad.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
Processes:
taskmgr.exepid process 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe 6912 taskmgr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.execmd.exedescription pid process target process PID 1524 wrote to memory of 3296 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe vssadmin.exe PID 1524 wrote to memory of 3296 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe vssadmin.exe PID 1524 wrote to memory of 5552 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe notepad.exe PID 1524 wrote to memory of 5552 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe notepad.exe PID 1524 wrote to memory of 5552 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe notepad.exe PID 1524 wrote to memory of 6624 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe cmd.exe PID 1524 wrote to memory of 6624 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe cmd.exe PID 1524 wrote to memory of 6624 1524 27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe cmd.exe PID 6624 wrote to memory of 5004 6624 cmd.exe taskkill.exe PID 6624 wrote to memory of 5004 6624 cmd.exe taskkill.exe PID 6624 wrote to memory of 5004 6624 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe"C:\Users\Admin\AppData\Local\Temp\27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\FBA658-Readme.txt"2⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\A593.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 15243⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\A593.tmp.batMD5
04d8a2f53ce852444559f838ea707ec9
SHA17f6ffd2b07c96e3ed75118e2c16f48f4824f60d4
SHA256fbcd19a20c1fa430adb12e8ee59f287c7c7111fb7eb862dd32687497208892a1
SHA5125f83194171b91e9bd7a16754d40459f209f499b9d3ea607f357816268ef7ba2184219d3f3bab37ef1893237aa0964894ec86ca3f2472ab0a24f4eda35a5a8413
-
C:\Users\Admin\Desktop\FBA658-Readme.txtMD5
444259231a94223c68fef1f51ec2df08
SHA193aed1dbbb8910a1c4b5897d51aeb71c4bdabbc2
SHA25603bb8a94b19890baf26174c3f36e27701406093877a471d2e109dcfea25b8c04
SHA51211682f1fe23edf30a79af07cacdd21dfdbbafe17e0167ca8750f56619d837e28e507273870b65ab171059dfbd8ab3ae502d89e43bf145f173768efb253200e9a
-
memory/3296-115-0x0000000000000000-mapping.dmp
-
memory/5004-119-0x0000000000000000-mapping.dmp
-
memory/5552-116-0x0000000000000000-mapping.dmp
-
memory/6624-117-0x0000000000000000-mapping.dmp