Analysis
-
max time kernel
121s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
08-12-2021 15:38
Static task
static1
Behavioral task
behavioral1
Sample
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe
Resource
win10-en-20211208
General
-
Target
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe
-
Size
314KB
-
MD5
d9481d4ba2b1ebc97ad093c80ece1f04
-
SHA1
79f216e401f1ad2f9b10bbce24c90e56139e0871
-
SHA256
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141
-
SHA512
28575088373f5c23599926f0c63df4b80bc651e420e7c9b2fa3de44c9eb04cb7166a91f995e1f3fecffcac3c3093bbc7a35a587c78c7b602025c888121f3a90b
Malware Config
Extracted
\??\c:\_READ_THI$_FILE_FL23_.txt
http://hjhqmbxyinislkkt.onion/C92F-5A1E-877D-05C4-06F7
http://hjhqmbxyinislkkt.13kn4l.top/C92F-5A1E-877D-05C4-06F7
http://hjhqmbxyinislkkt.14klmz.top/C92F-5A1E-877D-05C4-06F7
http://hjhqmbxyinislkkt.13eymq.top/C92F-5A1E-877D-05C4-06F7
http://hjhqmbxyinislkkt.1eeyaj.top/C92F-5A1E-877D-05C4-06F7
http://hjhqmbxyinislkkt.1eagrj.top/C92F-5A1E-877D-05C4-06F7
Extracted
C:\Users\Admin\Desktop\_READ_THI$_FILE_260T_.hta
http://hjhqmbxyinislkkt.13kn4l.top/C92F-5A1E-877D-05C4-06F7http://hjhqmbxyinislkkt.14klmz.top/C92F-5A1E-877D-05C4-06F7http://hjhqmbxyinislkkt.13eymq.top/C92F-5A1E-877D-05C4-06F7http://hjhqmbxyinislkkt.1eeyaj.top/C92F-5A1E-877D-05C4-06F7http://hjhqmbxyinislkkt.1eagrj.top/C92F-5A1E-877D-05C4-06F7
http://hjhqmbxyinislkkt.onion/C92F-5A1E-877D-05C4-06F7
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3608 created 948 3608 WerFault.exe mshta.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 1 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Drops file in System32 directory 38 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpBFE1.bmp" f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription pid process target process PID 4036 set thread context of 872 4036 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Drops file in Program Files directory 20 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription ioc process File opened for modification \??\c:\program files (x86)\ f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files\ f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\program files (x86)\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Drops file in Windows directory 64 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\ f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3608 948 WerFault.exe mshta.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3160 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exeWerFault.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe Token: SeCreatePagefilePrivilege 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe Token: SeRestorePrivilege 3608 WerFault.exe Token: SeBackupPrivilege 3608 WerFault.exe Token: SeDebugPrivilege 3608 WerFault.exe Token: SeDebugPrivilege 3160 taskkill.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exef5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.execmd.exedescription pid process target process PID 4036 wrote to memory of 872 4036 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 4036 wrote to memory of 872 4036 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 4036 wrote to memory of 872 4036 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 4036 wrote to memory of 872 4036 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 4036 wrote to memory of 872 4036 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 4036 wrote to memory of 872 4036 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 4036 wrote to memory of 872 4036 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 4036 wrote to memory of 872 4036 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 4036 wrote to memory of 872 4036 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 4036 wrote to memory of 872 4036 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe PID 872 wrote to memory of 1244 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 872 wrote to memory of 1244 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 872 wrote to memory of 1244 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 872 wrote to memory of 528 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 872 wrote to memory of 528 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 872 wrote to memory of 528 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe netsh.exe PID 872 wrote to memory of 948 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe mshta.exe PID 872 wrote to memory of 948 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe mshta.exe PID 872 wrote to memory of 948 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe mshta.exe PID 872 wrote to memory of 1064 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe NOTEPAD.EXE PID 872 wrote to memory of 1064 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe NOTEPAD.EXE PID 872 wrote to memory of 1064 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe NOTEPAD.EXE PID 872 wrote to memory of 612 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe cmd.exe PID 872 wrote to memory of 612 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe cmd.exe PID 872 wrote to memory of 612 872 f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe cmd.exe PID 612 wrote to memory of 3160 612 cmd.exe taskkill.exe PID 612 wrote to memory of 3160 612 cmd.exe taskkill.exe PID 612 wrote to memory of 3160 612 cmd.exe taskkill.exe PID 612 wrote to memory of 2220 612 cmd.exe PING.EXE PID 612 wrote to memory of 2220 612 cmd.exe PING.EXE PID 612 wrote to memory of 2220 612 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exeC:\Users\Admin\AppData\Local\Temp\f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe2⤵
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on3⤵
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THI$_FILE_260T_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 17524⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THI$_FILE_GRSR_.txt3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "f5d5fd18cf82bd98cd422ff5855d298d9da02c1461cfcfcac0d08da3dd2fb141.bin.sample.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_260T_.htaMD5
7722699dd1c98db1f39e15915610e5ce
SHA1863938c3b93f79d4b5d7336dcdfe4dcd5d3224e2
SHA25634bc5802dd601b69984cdbd57110c04a941709983dadce8b8be129aef9c88cad
SHA512db63d672ce92384581a0923c53ba73dde0bda8502913c4fbc47437b92fa6f68341fda6a95fbb591538f676868f011e6307ee1dbeb385483a2103c5efe312fa79
-
C:\Users\Admin\Desktop\_READ_THI$_FILE_GRSR_.txtMD5
1c530c87d645c237cbe471fa9fc53778
SHA1920c37b75cdb6e4332eee88494904752a4197b4d
SHA2562ca5a98653db696b5408706c37b4841471e8761d9d8ff824c62e03d5ddd90510
SHA51246893117d496ddb5e75926d23c950bbfdf71305bb65400d22ff55c85208b2c52d68e797b48926ebce6a283e155951e0739d8cfca7bb11d76e5f2ce31bc1c4a3b
-
memory/528-119-0x0000000000000000-mapping.dmp
-
memory/612-124-0x0000000000000000-mapping.dmp
-
memory/872-116-0x000000000040A7A8-mapping.dmp
-
memory/872-115-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/872-117-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/948-120-0x0000000000000000-mapping.dmp
-
memory/1064-121-0x0000000000000000-mapping.dmp
-
memory/1244-118-0x0000000000000000-mapping.dmp
-
memory/2220-126-0x0000000000000000-mapping.dmp
-
memory/3160-125-0x0000000000000000-mapping.dmp