globeimposter | a7f49d965383c1d18343a3469f482820f41ea3d8a908d3e8cf43de0c20aa7442

General

Target

656a5cfc0f176a53f5da1635497c886e.exe
Size

1.9MB
MD5

656a5cfc0f176a53f5da1635497c886e
SHA1

1934b132e695562df0d36dd8df13dd2e47aadd35
SHA256

a7f49d965383c1d18343a3469f482820f41ea3d8a908d3e8cf43de0c20aa7442
SHA512

c21c16394350e3c0f1602ab128970af66b36a343f6644a60f3ded030f067003eb70f4dca12eb445ebd7131187b97d2ea97ecbab3d9df2978e0f07dc100d8d0bb

Score

10^/10

globeimposter evasion persistence ransomware trojan

Malware Config

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note

All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ��75 81 52 6D F8 87 37 7D AA 23 33 AC 8D 5E A6 19 13 44 7F ED B9 39 B5 D8 88 DD 6C 97 0A 4A 60 A8 2F E9 19 0D 04 62 C9 0A 43 80 91 EE 4F 1B 2B 6F 47 8E A2 45 54 86 F5 3C BB ED A7 14 47 01 37 F4 2A 11 F0 57 D0 44 06 E1 CD DA 84 AD F2 5F 6D 33 3C D9 16 63 FF 1F A1 AD 0B 3E 49 7D 77 45 6B 5A 4E 88 4C 36 0F 15 7D F2 6B 0F 82 5D 93 9A 07 FD 82 B1 83 50 F1 E8 97 9C 82 99 B2 EE 5A E7 23 F2 B1 F6 98 49 E5 C5 B2 31 B2 08 51 53 74 04 B1 F1 15 21 E9 BB 8A CE 69 C9 18 5C E6 9B BC 2B E9 86 53 CB 60 EE 6E 50 B5 EB 0A 2A 2C 58 53 49 D3 5A 30 DA ED 72 4C DD 14 3C 1B 75 90 22 7A 89 5F 94 13 42 A6 7F 8D E8 CB 92 BB 35 43 8D 56 22 F5 A1 B2 0C B2 56 E3 DD 00 65 31 D1 10 20 3F 9A CA EC C7 59 29 5C 91 9D 9F 4B F9 03 9E B9 DA 84 42 70 30 ED 69 9F D0 7A 84 87 F6 70 85 0F AA 48 73 6F

URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

AddInProcess32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConfirmInstall.tif => C:\Users\Admin\Pictures\ConfirmInstall.tif.xls	AddInProcess32.exe
File renamed	C:\Users\Admin\Pictures\DebugAssert.crw => C:\Users\Admin\Pictures\DebugAssert.crw.xls	AddInProcess32.exe
File renamed	C:\Users\Admin\Pictures\GetTest.raw => C:\Users\Admin\Pictures\GetTest.raw.xls	AddInProcess32.exe
File renamed	C:\Users\Admin\Pictures\InitializeConvert.tif => C:\Users\Admin\Pictures\InitializeConvert.tif.xls	AddInProcess32.exe
File renamed	C:\Users\Admin\Pictures\InvokeStep.raw => C:\Users\Admin\Pictures\InvokeStep.raw.xls	AddInProcess32.exe
File renamed	C:\Users\Admin\Pictures\PopRestart.raw => C:\Users\Admin\Pictures\PopRestart.raw.xls	AddInProcess32.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

656a5cfc0f176a53f5da1635497c886e.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	656a5cfc0f176a53f5da1635497c886e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	656a5cfc0f176a53f5da1635497c886e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\aero\Shell\D7B4D56CF88F2C9AD204F39DF651A704\svchost.exe = "0"	656a5cfc0f176a53f5da1635497c886e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\656a5cfc0f176a53f5da1635497c886e.exe = "0"	656a5cfc0f176a53f5da1635497c886e.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

656a5cfc0f176a53f5da1635497c886e.exeAddInProcess32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AEDD2F2952941E5B3EA29EEA9B369FA8 = "C:\\Windows\\Resources\\Themes\\aero\\Shell\\D7B4D56CF88F2C9AD204F39DF651A704\\svchost.exe"	656a5cfc0f176a53f5da1635497c886e.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	AddInProcess32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\AddInProcess32.exe"	AddInProcess32.exe

Drops desktop.ini file(s) 36 IoCs

Processes:

AddInProcess32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Music\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Program Files\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	AddInProcess32.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	AddInProcess32.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

656a5cfc0f176a53f5da1635497c886e.exe

description pid process target process

PID 1684 set thread context of 1232 1684 656a5cfc0f176a53f5da1635497c886e.exe AddInProcess32.exe

description	pid	process	target process
PID 1684 set thread context of 1232	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess32.exe

Drops file in Program Files directory 64 IoCs

Processes:

AddInProcess32.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL022.XML	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216540.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanMergeLetter.Dotx	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_alignleft.gif	AddInProcess32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo	AddInProcess32.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\read-me.txt	AddInProcess32.exe
File opened for modification	C:\Program Files\Java\jre7\bin\nio.dll	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00555_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00563_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSRETRO.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00671_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_SlateBlue.gif	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\TAB_OFF.GIF	AddInProcess32.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\read-me.txt	AddInProcess32.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00687_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151041.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf	AddInProcess32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Visualizer.zip	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BIZFORM.XML	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0235319.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01166_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00546_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESP98.POC	AddInProcess32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll	AddInProcess32.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215076.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll	AddInProcess32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac	AddInProcess32.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\read-me.txt	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTIRMV.XML	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR27F.GIF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00641_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03668_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00735_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN075.XML	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21299_.GIF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188587.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239965.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_01.MID	AddInProcess32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png	AddInProcess32.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati	AddInProcess32.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar	AddInProcess32.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar	AddInProcess32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libexport_plugin.dll	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00693_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_es.dll	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00152_.WMF	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\utilityfunctions.js	AddInProcess32.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\EXPTOOWS.DLL	AddInProcess32.exe

Drops file in Windows directory 2 IoCs

Processes:

656a5cfc0f176a53f5da1635497c886e.exe

description	ioc	process
File created	C:\Windows\Resources\Themes\aero\Shell\D7B4D56CF88F2C9AD204F39DF651A704\svchost.exe	656a5cfc0f176a53f5da1635497c886e.exe
File opened for modification	C:\Windows\Resources\Themes\aero\Shell\D7B4D56CF88F2C9AD204F39DF651A704\svchost.exe	656a5cfc0f176a53f5da1635497c886e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exe656a5cfc0f176a53f5da1635497c886e.exe

pid process

1228 powershell.exe
1472 powershell.exe
1928 powershell.exe
1684 656a5cfc0f176a53f5da1635497c886e.exe
1684 656a5cfc0f176a53f5da1635497c886e.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

AddInProcess32.exe

pid process

1232 AddInProcess32.exe

pid	process
1228	powershell.exe
1472	powershell.exe
1928	powershell.exe
1684	656a5cfc0f176a53f5da1635497c886e.exe
1684	656a5cfc0f176a53f5da1635497c886e.exe

pid	process
1232	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

656a5cfc0f176a53f5da1635497c886e.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1684	656a5cfc0f176a53f5da1635497c886e.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

656a5cfc0f176a53f5da1635497c886e.exe

description	pid	process	target process
PID 1684 wrote to memory of 1472	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1472	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1472	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1472	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1228	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1228	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1228	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1228	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1928	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1928	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1928	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1928	1684	656a5cfc0f176a53f5da1635497c886e.exe	powershell.exe
PID 1684 wrote to memory of 1544	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess.exe
PID 1684 wrote to memory of 1544	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess.exe
PID 1684 wrote to memory of 1544	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess.exe
PID 1684 wrote to memory of 1544	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess.exe
PID 1684 wrote to memory of 1544	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess.exe
PID 1684 wrote to memory of 1544	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess.exe
PID 1684 wrote to memory of 1544	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess.exe
PID 1684 wrote to memory of 1544	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess.exe
PID 1684 wrote to memory of 1232	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess32.exe
PID 1684 wrote to memory of 1232	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess32.exe
PID 1684 wrote to memory of 1232	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess32.exe
PID 1684 wrote to memory of 1232	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess32.exe
PID 1684 wrote to memory of 1232	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess32.exe
PID 1684 wrote to memory of 1232	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess32.exe
PID 1684 wrote to memory of 1232	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess32.exe
PID 1684 wrote to memory of 1232	1684	656a5cfc0f176a53f5da1635497c886e.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\656a5cfc0f176a53f5da1635497c886e.exe
"C:\Users\Admin\AppData\Local\Temp\656a5cfc0f176a53f5da1635497c886e.exe"
1⤵
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\D7B4D56CF88F2C9AD204F39DF651A704\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\656a5cfc0f176a53f5da1635497c886e.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\D7B4D56CF88F2C9AD204F39DF651A704\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
2⤵
PID:1544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
PID:1232

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
538ab7aef854049292ff38f0b9e50e4c

SHA1
e570c23e99b3f86520756d5d4bdd4f860056b9c4

SHA256
2449580824c46cbc2c88b40193afeaae73db41b62cf20f9d44c04586a42274f6

SHA512
53e4dc271d2c9051153f21e23e8171f5ee1d3e47fd6ff483f26023c329763a7e25a7e53801d68fdcec22afd998ef5f9898953a383805d573cf3ded261bf830cb

Download Submit
memory/1228-67-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/1228-77-0x0000000002632000-0x0000000002634000-memory.dmp

Filesize
8KB

Download
memory/1228-74-0x0000000002631000-0x0000000002632000-memory.dmp

Filesize
4KB

Download
memory/1228-62-0x0000000000000000-mapping.dmp

Download
memory/1232-73-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1232-71-0x0000000000409F20-mapping.dmp

Download
memory/1232-70-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1472-60-0x0000000000000000-mapping.dmp

Download
memory/1472-68-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/1472-75-0x00000000022C1000-0x00000000022C2000-memory.dmp

Filesize
4KB

Download
memory/1472-76-0x00000000022C2000-0x00000000022C4000-memory.dmp

Filesize
8KB

Download
memory/1684-55-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/1684-59-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1684-58-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/1684-57-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1928-69-0x0000000002450000-0x000000000309A000-memory.dmp

Filesize
12.3MB

Download
memory/1928-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads