Analysis
-
max time kernel
121s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
08-12-2021 15:38
Static task
static1
Behavioral task
behavioral1
Sample
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe
Resource
win10-en-20211208
General
-
Target
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe
-
Size
314KB
-
MD5
d9481d4ba2b1ebc97ad093c80ece1f04
-
SHA1
79f216e401f1ad2f9b10bbce24c90e56139e0871
-
SHA256
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141
-
SHA512
28575088373f5c23599926f0c63df4b80bc651e420e7c9b2fa3de44c9eb04cb7166a91f995e1f3fecffcac3c3093bbc7a35a587c78c7b602025c888121f3a90b
Malware Config
Extracted
\??\c:\_READ_THI$_FILE_PNU7IW0_.txt
http://hjhqmbxyinislkkt.onion/613C-C8C4-4A6E-05C4-05FC
http://hjhqmbxyinislkkt.13kn4l.top/613C-C8C4-4A6E-05C4-05FC
http://hjhqmbxyinislkkt.14klmz.top/613C-C8C4-4A6E-05C4-05FC
http://hjhqmbxyinislkkt.13eymq.top/613C-C8C4-4A6E-05C4-05FC
http://hjhqmbxyinislkkt.1eeyaj.top/613C-C8C4-4A6E-05C4-05FC
http://hjhqmbxyinislkkt.1eagrj.top/613C-C8C4-4A6E-05C4-05FC
Extracted
C:\Users\Admin\Desktop\_READ_THI$_FILE_SE3MGHER_.hta
http://hjhqmbxyinislkkt.13kn4l.top/613C-C8C4-4A6E-05C4-05FChttp://hjhqmbxyinislkkt.14klmz.top/613C-C8C4-4A6E-05C4-05FChttp://hjhqmbxyinislkkt.13eymq.top/613C-C8C4-4A6E-05C4-05FChttp://hjhqmbxyinislkkt.1eeyaj.top/613C-C8C4-4A6E-05C4-05FChttp://hjhqmbxyinislkkt.1eagrj.top/613C-C8C4-4A6E-05C4-05FC
http://hjhqmbxyinislkkt.onion/613C-C8C4-4A6E-05C4-05FC
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 1 IoCs
Processes:
mshta.exeflow pid process 2181 1660 mshta.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1684 cmd.exe -
Drops file in System32 directory 38 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpEEF1.bmp" f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription pid process target process PID 1180 set thread context of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Drops file in Program Files directory 20 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription ioc process File opened for modification \??\c:\program files (x86)\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\ f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files\ f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Drops file in Windows directory 64 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 564 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe Token: SeDebugPrivilege 564 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 1560 DllHost.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exef5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.execmd.exedescription pid process target process PID 1180 wrote to memory of 1204 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 1204 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 1204 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 1204 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 1180 wrote to memory of 764 1180 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 764 wrote to memory of 1888 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 764 wrote to memory of 1888 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 764 wrote to memory of 1888 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 764 wrote to memory of 1888 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 764 wrote to memory of 696 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 764 wrote to memory of 696 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 764 wrote to memory of 696 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 764 wrote to memory of 696 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 764 wrote to memory of 1660 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe mshta.exe PID 764 wrote to memory of 1660 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe mshta.exe PID 764 wrote to memory of 1660 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe mshta.exe PID 764 wrote to memory of 1660 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe mshta.exe PID 764 wrote to memory of 1568 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe NOTEPAD.EXE PID 764 wrote to memory of 1568 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe NOTEPAD.EXE PID 764 wrote to memory of 1568 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe NOTEPAD.EXE PID 764 wrote to memory of 1568 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe NOTEPAD.EXE PID 764 wrote to memory of 1684 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe cmd.exe PID 764 wrote to memory of 1684 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe cmd.exe PID 764 wrote to memory of 1684 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe cmd.exe PID 764 wrote to memory of 1684 764 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe cmd.exe PID 1684 wrote to memory of 564 1684 cmd.exe taskkill.exe PID 1684 wrote to memory of 564 1684 cmd.exe taskkill.exe PID 1684 wrote to memory of 564 1684 cmd.exe taskkill.exe PID 1684 wrote to memory of 564 1684 cmd.exe taskkill.exe PID 1684 wrote to memory of 1744 1684 cmd.exe PING.EXE PID 1684 wrote to memory of 1744 1684 cmd.exe PING.EXE PID 1684 wrote to memory of 1744 1684 cmd.exe PING.EXE PID 1684 wrote to memory of 1744 1684 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exeC:\Users\Admin\AppData\Local\Temp\f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exeC:\Users\Admin\AppData\Local\Temp\f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe2⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on3⤵
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THI$_FILE_SE3MGHER_.hta"3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THI$_FILE_CVVO2_.txt3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_CVVO2_.txtMD5
9b2dabe49e6cb446f31bdbd65f2d1c1a
SHA11d981eb6504ac3eeebbf11087ea763cd01df81c9
SHA256088696780d361154d9bb0d956dc5371a4eacd192e742d8c8d42658dd6568e6ec
SHA5127a72471cdbd860663900ab11426ab95b6c73d5ced66d572cfcbb449c278391396882edf1f6a557eb84059afdb6b1fa289b824c47f83373c582bda4547a50e396
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_GO6RA_.jpegMD5
f24082de0c5b83737a0a5cea26cff71d
SHA1ba9d011bd0ad03c27ddc690ade66d337f35227a3
SHA2561524d4db90fcfeddf67f01aa677a04f15ce804946b42baa587ebb7a87e7bf43a
SHA5125772f6cdce4b8f015e0ca5291728e58b4179d2e941394bcadc307514ce65ae8ea38f03552bfaf69de501c2d525755f2c01b528bc50c565357cfb958e2f7b9724
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_SE3MGHER_.htaMD5
a109bda7509add5996aa0907fe7cadfd
SHA1cad0469a69e74d421e0c74c437dc6011fea43292
SHA256e97a86269c4c67af75f8ca5f00d063e69c8616e83635f6c30234ea0bfec441fe
SHA5121194b5bc21b7ecc6b73adaa9a9f8d52a373605f223e5b86079a248dafb0932f10fed8ac7a095ca857094b9762a99aa565631717dffb8b75fb50a36aef5a33b25
-
memory/564-72-0x0000000000000000-mapping.dmp
-
memory/696-60-0x0000000000000000-mapping.dmp
-
memory/764-56-0x000000000040A7A8-mapping.dmp
-
memory/764-57-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/764-55-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/764-58-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1560-67-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/1560-68-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1568-63-0x0000000000000000-mapping.dmp
-
memory/1660-62-0x0000000000000000-mapping.dmp
-
memory/1684-71-0x0000000000000000-mapping.dmp
-
memory/1744-73-0x0000000000000000-mapping.dmp
-
memory/1888-59-0x0000000000000000-mapping.dmp