Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
10-11-2021 00:42
Static task
static1
Behavioral task
behavioral1
Sample
7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe
Resource
win10-en-20211104
General
-
Target
7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe
-
Size
500KB
-
MD5
dfe4dcc5c1ecd6cc9fea2373c672c326
-
SHA1
11e399bed1a2e4ac51dfbae16a21f1adaff7c95f
-
SHA256
7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14
-
SHA512
9f9e43601a88c386026d58e0f95785a97d86b228dbe5bb168dec90297c0480d8ba9aa07bdd92b90b0033dd098c2f1da17c72a1b05678fb2d6db43b254dbb1523
Malware Config
Signatures
-
Mespinoza Ransomware 2 TTPs
Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.
-
Modifies extensions of user files 20 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\InvokeGet.crw.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Users\Admin\Pictures\RedoOptimize.crw.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File renamed C:\Users\Admin\Pictures\SelectShow.tiff => C:\Users\Admin\Pictures\SelectShow.tiff.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Users\Admin\Pictures\SelectShow.tiff.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File renamed C:\Users\Admin\Pictures\ExportOut.png => C:\Users\Admin\Pictures\ExportOut.png.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Users\Admin\Pictures\GrantConfirm.png.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File renamed C:\Users\Admin\Pictures\RedoOptimize.crw => C:\Users\Admin\Pictures\RedoOptimize.crw.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Users\Admin\Pictures\ExportOut.png.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File renamed C:\Users\Admin\Pictures\GrantConfirm.png => C:\Users\Admin\Pictures\GrantConfirm.png.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File renamed C:\Users\Admin\Pictures\InvokeGet.crw => C:\Users\Admin\Pictures\InvokeGet.crw.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File renamed C:\Users\Admin\Pictures\OpenWait.png => C:\Users\Admin\Pictures\OpenWait.png.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File renamed C:\Users\Admin\Pictures\StopReset.crw => C:\Users\Admin\Pictures\StopReset.crw.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Users\Admin\Pictures\StopReset.crw.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Users\Admin\Pictures\CloseSearch.tiff.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Users\Admin\Pictures\ExportStart.raw.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Users\Admin\Pictures\OpenWait.png.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File renamed C:\Users\Admin\Pictures\SetPush.crw => C:\Users\Admin\Pictures\SetPush.crw.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Users\Admin\Pictures\SetPush.crw.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File renamed C:\Users\Admin\Pictures\CloseSearch.tiff => C:\Users\Admin\Pictures\CloseSearch.tiff.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File renamed C:\Users\Admin\Pictures\ExportStart.raw => C:\Users\Admin\Pictures\ExportStart.raw.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adc_logo.png.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\plugin.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_zh_CN.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files\VideoLAN\VLC\locale\th\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\jaccess.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\PYCC.pf.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files\VideoLAN\VLC\locale\et\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-actions.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Regular.otf.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int.gif.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons.png.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_tr_135x40.svg.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluDCFilesEmpty_180x180.svg.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons.png.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\ui-strings.js.pysa 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Readme.README 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2708 wrote to memory of 1072 2708 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe 71 PID 2708 wrote to memory of 1072 2708 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe 71 PID 2708 wrote to memory of 1072 2708 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe 71 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = 48006900200043006f006d00700061006e0079002c000d000a000d000a00450076006500720079002000620079007400650020006f006e00200061006e00790020007400790070006500730020006f006600200079006f0075007200200064006500760069006300650073002000770061007300200065006e0063007200790070007400650064002e000d000a0044006f006e00270074002000740072007900200074006f00200075007300650020006200610063006b007500700073002000620065006300610075007300650020006900740020007700650072006500200065006e006300720079007000740065006400200074006f006f002e000d000a000d000a0054006f002000670065007400200061006c006c00200079006f00750072002000640061007400610020006200610063006b00200063006f006e0074006100630074002000750073003a000d000a006b0061007200640061006c006b006100720065006500660068006100640064006100640040006f006e0069006f006e006d00610069006c002e006f00720067000d000a000d000a0041006c0073006f002c0020006200650020006100770061007200650020007400680061007400200077006500200064006f0077006e006c006f0061006400650064002000660069006c00650073002000660072006f006d00200079006f007500720020007300650072007600650072007300200061006e006400200069006e002000630061007300650020006f00660020006e006f006e002d007000610079006d0065006e0074002000770065002000770069006c006c00200062006500200066006f007200630065006400200074006f002000750070006c006f006100640020007400680065006d0020006f006e0020006f0075007200200077006500620073006900740065002c00200061006e00640020006900660020006e00650063006500730073006100720079002c002000770065002000770069006c006c002000730065006c006c0020007400680065006d0020006f006e00200074006800650020006400610072006b006e00650074002e000d000a0043006800650063006b0020006f007500740020006f0075007200200077006500620073006900740065002c0020007700650020006a00750073007400200070006f00730074006500640020007400680065007200650020006e006500770020007500700064006100740065007300200066006f00720020006f0075007200200070006100720074006e006500720073003a00200068007400740070003a002f002f0070007900730061003200620069007400630035006c00640065007900660061006b00340073006500650072007500710079006d0071007300340073006a00350077007400350071006b0063007100370061006f00790067003400680032006100630071006900650079007700610064002e006f006e0069006f006e002f000d000a0054006f00200067006f00200074006f0020006f007500720020007300690074006500200079006f00750020006800610076006500200074006f002000750073006500200054004f0052002000420072006f0077007300650072002e00200044006f0077006e006c006f006100640020006c0069006e006b003a002000680074007400700073003a002f002f007700770077002e0074006f007200700072006f006a006500630074002e006f00720067002f0064006f0077006e006c006f00610064002f000d000a002d002d002d002d002d002d002d002d002d002d002d002d002d002d000d000a000d000a004600410051003a000d000a000d000a0031002e000d000a0020002000200051003a00200048006f0077002000630061006e002000490020006d0061006b00650020007300750072006500200079006f007500200064006f006e0027007400200066006f006f006c0069006e00670020006d0065003f000d000a0020002000200041003a00200059006f0075002000630061006e002000730065006e006400200075007300200032002000660069006c006500730028006d0061007800200032006d00620029002e000d000a000d000a0032002e000d000a0020002000200051003a0020005700680061007400200074006f00200064006f00200074006f002000670065007400200061006c006c002000640061007400610020006200610063006b003f000d000a0020002000200041003a00200044006f006e0027007400200072006500730074006100720074002000740068006500200063006f006d00700075007400650072002c00200064006f006e002700740020006d006f00760065002000660069006c0065007300200061006e0064002000770072006900740065002000750073002e000d000a000d000a0033002e000d000a0020002000200051003a0020005700680061007400200069006600200049002000680061007600650020006e006f00200072006500730070006f006e00730065003f000d000a0020002000200041003a0020005700610069007400200061006e0064002000770065002000770069006c006c00200061006e007300770065007200200079006f007500200069006e00200032003400200068006f007500720073002e000d000a000d000a0034002e000d000a0020002000200051003a0020005700680061007400200074006f002000740065006c006c0020006d007900200062006f00730073003f000d000a0020002000200041003a002000500072006f007400650063007400200059006f00750072002000530079007300740065006d00200041006d00690067006f002e000d000a000d000a000000 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = 50005900530041000000 7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe"C:\Users\Admin\AppData\Local\Temp\7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14.bin.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "2⤵PID:1072
-