Overview
overview
10Static
static
10072158f558...86.exe
windows7_x64
10072158f558...86.exe
windows10_x64
100751c42296...a4.exe
windows7_x64
100751c42296...a4.exe
windows10_x64
1014a3e308c9...5c.exe
windows7_x64
314a3e308c9...5c.exe
windows10_x64
31c63a4fdee...49.exe
windows7_x64
101c63a4fdee...49.exe
windows10_x64
101eea3cbd72...c2.exe
windows7_x64
101eea3cbd72...c2.exe
windows10_x64
1020742987e6...41.exe
windows7_x64
1020742987e6...41.exe
windows10_x64
1022d7d67c3a...d6.exe
windows7_x64
1022d7d67c3a...d6.exe
windows10_x64
102466fca0e2...4c.exe
windows7_x64
102466fca0e2...4c.exe
windows10_x64
102aad85dbd4...7c.exe
windows7_x64
102aad85dbd4...7c.exe
windows10_x64
102c323453e9...09.exe
windows7_x64
102c323453e9...09.exe
windows10_x64
102cdb5edf30...fd.exe
windows7_x64
102cdb5edf30...fd.exe
windows10_x64
102e50eb85f6...b2.exe
windows7_x64
102e50eb85f6...b2.exe
windows10_x64
103a03530c73...17.exe
windows7_x64
103a03530c73...17.exe
windows10_x64
103a4bd5288b...40.exe
windows7_x64
103a4bd5288b...40.exe
windows10_x64
104ad9432cc8...91.dll
windows7_x64
104ad9432cc8...91.dll
windows10_x64
104be85e2083...2b.exe
windows7_x64
104be85e2083...2b.exe
windows10_x64
10Analysis
-
max time kernel
157s -
max time network
156s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
22-11-2021 13:14
Static task
static1
Behavioral task
behavioral1
Sample
072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486.exe
Resource
win10-en-20211104
Behavioral task
behavioral3
Sample
0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe
Resource
win7-en-20211014
Behavioral task
behavioral4
Sample
0751c422962dcd500d7cf2cf8bf544ddf5b2fe3465df7dd9b9998f6bba5e08a4.exe
Resource
win10-en-20211104
Behavioral task
behavioral5
Sample
14a3e308c90183b3785b6c26ec40d29405361cd8dec204a62235733401bf5f5c.exe
Resource
win7-en-20211014
Behavioral task
behavioral6
Sample
14a3e308c90183b3785b6c26ec40d29405361cd8dec204a62235733401bf5f5c.exe
Resource
win10-en-20211104
Behavioral task
behavioral7
Sample
1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
1c63a4fdee1528429886a0de5e89eaa540a058bf27cd378b8d139e045a2f7849.exe
Resource
win10-en-20211104
Behavioral task
behavioral9
Sample
1eea3cbd729d4493c0c0a84efe6840abf1760efe221dc971d32ca5017b5c19c2.exe
Resource
win7-en-20211104
Behavioral task
behavioral10
Sample
1eea3cbd729d4493c0c0a84efe6840abf1760efe221dc971d32ca5017b5c19c2.exe
Resource
win10-en-20211014
Behavioral task
behavioral11
Sample
20742987e6f743814b25e214f8b2cd43111e2f60a8856a6cca87cafd85422f41.exe
Resource
win7-en-20211104
Behavioral task
behavioral12
Sample
20742987e6f743814b25e214f8b2cd43111e2f60a8856a6cca87cafd85422f41.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6.exe
Resource
win10-en-20211104
Behavioral task
behavioral15
Sample
2466fca0e29b06c78ffa8a44193fb58c30e6bec4e54bbef8e6622349b95cce4c.exe
Resource
win7-en-20211014
Behavioral task
behavioral16
Sample
2466fca0e29b06c78ffa8a44193fb58c30e6bec4e54bbef8e6622349b95cce4c.exe
Resource
win10-en-20211104
Behavioral task
behavioral17
Sample
2aad85dbd4c79bd21c6218892552d5c9fb216293a251559ba59d45d56a01437c.exe
Resource
win7-en-20211014
Behavioral task
behavioral18
Sample
2aad85dbd4c79bd21c6218892552d5c9fb216293a251559ba59d45d56a01437c.exe
Resource
win10-en-20211104
Behavioral task
behavioral19
Sample
2c323453e959257c7aa86dc180bb3aaaa5c5ec06fa4e72b632d9e4b817052009.exe
Resource
win7-en-20211014
Behavioral task
behavioral20
Sample
2c323453e959257c7aa86dc180bb3aaaa5c5ec06fa4e72b632d9e4b817052009.exe
Resource
win10-en-20211104
Behavioral task
behavioral21
Sample
2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe
Resource
win7-en-20211104
Behavioral task
behavioral22
Sample
2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe
Resource
win10-en-20211014
Behavioral task
behavioral23
Sample
2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Resource
win7-en-20211104
Behavioral task
behavioral24
Sample
2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Resource
win10-en-20211014
Behavioral task
behavioral25
Sample
3a03530c732ebe53cdd7c17bee0988896d36c2b632dbd6118613697c2af82117.exe
Resource
win7-en-20211104
Behavioral task
behavioral26
Sample
3a03530c732ebe53cdd7c17bee0988896d36c2b632dbd6118613697c2af82117.exe
Resource
win10-en-20211014
Behavioral task
behavioral27
Sample
3a4bd5288b89aa26fbe39353b93c1205efa671be4f96e50beae0965f45fdcc40.exe
Resource
win7-en-20211104
Behavioral task
behavioral28
Sample
3a4bd5288b89aa26fbe39353b93c1205efa671be4f96e50beae0965f45fdcc40.exe
Resource
win10-en-20211014
Behavioral task
behavioral29
Sample
4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll
Resource
win7-en-20211104
Behavioral task
behavioral30
Sample
4ad9432cc817afa905bab2f16d4f713af42ea42f5e4fcf53e6d4b631a7d6da91.dll
Resource
win10-en-20211104
Behavioral task
behavioral31
Sample
4be85e2083b64838fb66b92195a250228a721cdb5ae91817ea97b37aa53f4a2b.exe
Resource
win7-en-20211014
Behavioral task
behavioral32
Sample
4be85e2083b64838fb66b92195a250228a721cdb5ae91817ea97b37aa53f4a2b.exe
Resource
win10-en-20211104
General
-
Target
2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe
-
Size
78KB
-
MD5
6e5986761cea340dce2efd4cf4f3790c
-
SHA1
4a8ca4b5c04112a753e9ff5989b80f0b12e13654
-
SHA256
2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd
-
SHA512
8df4406a8807978df8690cb578cd00f8d22c2ad5ff78b8d87806484adcde2eaa2901f1da100c31f1538da0503043c78cb3856d0592af2f094901d864956b83af
Malware Config
Extracted
C:\gawreXkrr.README.txt
blackmatter
http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/GBSLNRB4NL0OG6FX
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
suricata: ET MALWARE BlackMatter CnC Activity
suricata: ET MALWARE BlackMatter CnC Activity
-
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (mojobiden .com)
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (mojobiden .com)
-
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (nowautomation .com)
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (nowautomation .com)
-
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\UnlockEnter.tif.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File renamed C:\Users\Admin\Pictures\BlockDisable.tif => C:\Users\Admin\Pictures\BlockDisable.tif.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Users\Admin\Pictures\BlockDisable.tif.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Users\Admin\Pictures\CompressRepair.raw.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Users\Admin\Pictures\InvokeSelect.tiff.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File renamed C:\Users\Admin\Pictures\UnpublishEnter.png => C:\Users\Admin\Pictures\UnpublishEnter.png.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Users\Admin\Pictures\InvokeSelect.tiff 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File renamed C:\Users\Admin\Pictures\InvokeSelect.tiff => C:\Users\Admin\Pictures\InvokeSelect.tiff.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Users\Admin\Pictures\RestorePublish.png.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File renamed C:\Users\Admin\Pictures\UnlockEnter.tif => C:\Users\Admin\Pictures\UnlockEnter.tif.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File renamed C:\Users\Admin\Pictures\BlockUnpublish.raw => C:\Users\Admin\Pictures\BlockUnpublish.raw.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Users\Admin\Pictures\BlockUnpublish.raw.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File renamed C:\Users\Admin\Pictures\CompressRepair.raw => C:\Users\Admin\Pictures\CompressRepair.raw.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File renamed C:\Users\Admin\Pictures\RestorePublish.png => C:\Users\Admin\Pictures\RestorePublish.png.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Users\Admin\Pictures\UnpublishEnter.png.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe -
Loads dropped DLL 1 IoCs
pid Process 2024 splwow64.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\gawreXkrr.bmp" 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\gawreXkrr.bmp" 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\gawreXkrr.README.txt 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\TAB_ON.GIF.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Maroon.css 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Adjacency.xml.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200383.WMF.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\CT_ROOTS.XML.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDRESP.CFG.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107024.WMF 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186346.WMF 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImage.jpg 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MSTAG.TLB.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\StarterApplicationDescriptors.xml 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\attention.gif 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15275_.GIF.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\gawreXkrr.README.txt 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jre7\lib\content-types.properties.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00444_.WMF 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR18F.GIF.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME18.CSS 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK_COL.HXT.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chicago.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.GIF 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_thunderstorm.png 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\gadget.xml 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File created C:\Program Files\VideoLAN\VLC\locale\is\gawreXkrr.README.txt 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00798_.WMF.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR4B.GIF.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0235319.WMF.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01468_.WMF 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\gawreXkrr.README.txt 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File created C:\Program Files\Microsoft Games\Hearts\ja-JP\gawreXkrr.README.txt 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB8.BDR.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21370_.GIF.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.xml.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105600.WMF 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02503U.BMP.gawreXkrr 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\Desktop\WallpaperStyle = "10" 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\International 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\Desktop 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe -
Modifies registry class 20 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags splwow64.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots splwow64.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff splwow64.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg splwow64.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" splwow64.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_Classes\Local Settings splwow64.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 splwow64.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 splwow64.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" splwow64.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1732 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeBackupPrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeDebugPrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: 36 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeImpersonatePrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeIncBasePriorityPrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeIncreaseQuotaPrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: 33 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeManageVolumePrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeProfSingleProcessPrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeRestorePrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeSecurityPrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeSystemProfilePrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeTakeOwnershipPrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeShutdownPrivilege 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe Token: SeBackupPrivilege 1916 vssvc.exe Token: SeRestorePrivilege 1916 vssvc.exe Token: SeAuditPrivilege 1916 vssvc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2024 splwow64.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 320 wrote to memory of 1732 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 35 PID 320 wrote to memory of 1732 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 35 PID 320 wrote to memory of 1732 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 35 PID 320 wrote to memory of 1732 320 2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe 35 PID 1732 wrote to memory of 2024 1732 NOTEPAD.EXE 36 PID 1732 wrote to memory of 2024 1732 NOTEPAD.EXE 36 PID 1732 wrote to memory of 2024 1732 NOTEPAD.EXE 36 PID 1732 wrote to memory of 2024 1732 NOTEPAD.EXE 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe"C:\Users\Admin\AppData\Local\Temp\2cdb5edf3039863c30818ca34d9240cb0068ad33128895500721bcdca70c78fd.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" /p C:\gawreXkrr.README.txt2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2024
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1916