Analysis
-
max time kernel
157s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 22:45
Static task
static1
Behavioral task
behavioral1
Sample
007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe
-
Size
139KB
-
MD5
d968a6bab562d04e73a773dece109f80
-
SHA1
12e939054039c0b114f278231693a9fd1fdb1b2e
-
SHA256
007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286
-
SHA512
6e14eea3551bec5aae46535296ecab9390388bbb8f589d9d15dec3f8580bb6442ea1f791d468f806276b541972673df74b5d24d0553b03ec3274aee91e743f13
Score
10/10
Malware Config
Extracted
Path
C:\HTKXWWXAYM-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.0.4 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .HTKXWWXAYM
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/a258e38864976688
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAIqwwwsrleO2i4m00d5ZA04iGihlcgslFT/rb2ZXC1C8LhySGemEh+lhClwX/kNVqUD5Doi3k60pOB4xe3nbujj5M2pyLnw6XLOtXiUuGQbETu57KSCzlnJlnuaxlzCQVfYLihkIOeHcoS1hmT5ciAliJaiLoqzg5eN/k8ShsS19YJQlaUR3dnp3w8Xxx1Hq955W1E+i8HkNAs+an5ohYWUeuvx2kN9YlFYPAeosCJGAV+aHnf1WbysiCJ3DWDnqs4ehrtsxG8UvDRfCZfIUCqtc6hTzcPC1V6EQ7WdmeFMil3Y38TW79Ab5K3o8hqYLSG1AwZMu/rG2AM5o1pRbljN5eTn2pI287SeCZbCuAFwfqpEZnoHYSSVHkMutTpyhQdMnJ8WMMA2InqQ5JlPKlWnHhvPtIRmsj+dd7IveTX/vXf/csAXFU1/sgiHkGOriq7/6kNsbIP0SdHJU2TGKqw6FgN69HqaXpo0nHyyCLYsHZO0hBmSIj9Gt+GEufEl/Nmm+0/cN0rzp12taQw78WFwDph93PdfOQDIih3tCwu6KPfbunDZRtPE5FpF3n1kfzwUKBtBxGc2t38KhuBSWZtpZ7GuZOnZg7zykpzpPMMWqiC2pyC0xsOvOVN6KlU5P7abLgzqPRvfYpKV1vVC9C669brOsRiBNj262xGFkzl9LC/tIYvP0wGCdN7UU/A1wJMF0LUiz2sv9hk5KTeI89ZGqnHrBXoJK0wC/60bJwu25QNSWO5i7o5U/Z6wnrQtxuoG2TCX17G8OlsD0fjXRCbw4LOT4cMGWUR+RylK/39ao8AF1MWzGR4XuiPHT61vye00EdiM6gfY36TQb9xGclKhRWCu0/RR/Jucf2tMLSTnKYkqF4yvVyxEILoro6uq9krhj0jjNX62500DvrJNfRxrQIQIty5k85ib4099t6B3f71AwieWOIxHYCKePOARqM6AjT/GqIRnRT9cpPnxAQZOJ+70DUrRm495fkleSb0cS7Aj8BXlG/HOutgjE+iy9GwukFZc622AQQyQcxEYczbzj5psu9TzOL+G4pg/HSSOn8Z9UVpYpubhPUiGVxohw178aYTez0LYKtu0Yj9MlNBMSz/bgr3/OQrERSnvS1dLOS6jsgMapFFCJlvzGjPF43r6mBenizuiJ52QHiK2+l/zaN3VD0uFk1r8vBWyqRa1Gh+FxcYeBNvThb9kfKDD6s5k30g1XY4wyIzwwDsmBRTSjOeJd53J61Q8Cfvw+nY41K0dR03lUeLQQ0U101L6WgD5exNufsIZuAbm2U+n7hUSQldQqZgIJHAhBmb9ONCJKDEgKedNwpNdoQX6K2QMfN/S+xaUEUUUAk534oyuGeqj8RUCEHNaYPb+3NYutq8URX6NtEmqSD7/+pBMp0YqacpJzSfwJYS0U4G6N8MuBN5vKAS7QZUv9ruTYXsaG2BfsFZaHxHlKxwhhdvAiJ0MW0FHzcNvZmfR1cJ3q3ODrPigoQQ3TAltl85V7ccqzza9pCGRvTpyzajasdCWm8Q1M1hHu4tlNzBNnn2Vzdz3cCobajBoczCW8HaD2Se6FaTZf7R/WsvXewmkn1xrDsWuXvCQK/j1VE3ZF7mC7o8vOIxVi3vjJLbROAUvv726BkmA74ONigYhw6BrvK3ETfZs3cNgLoNPhHAzdvryYkN5IBUsuatg0epihyt9cmtuXBjYPbWYogsOp69XVeGFs3loKUd2WbloJlX0BUHWDi93uRMLRNHZAFhADawizIPhHTJf3wl4TRWKiZZZisKVITgcetpmH9Oi6dRxOqbptrIV8LyyCPkO3/8yOS7gHqEM/zN0I2NUJcRw8rjhCUq44il6mKTOJUkfkABJrn4MVZQVc9hvnCcXFIpyDyfMh9ZEod6c1CGhkTVX5WTXp1zxlgtGmQ+naaW4g7P09wCM8E6XjVqbkfiv8KjAUvj32/Nnoolu7kvMulWT1poFQZW5b14v8us4KjXFnw1h4XfiHYjxudJg8fFiyDc0EA/oHyONAMXii9zYsk0zW3G6yZbQ/FG0OUzjOpobxEjHmLXwiOvx5pgY4sz3IzTLT/cI/kzYrIuPAvzH6+44kJ/ZOJ6uLjDrDWKu9u+wMUUHDUbNGbLsyzUJsyp7uw/4RcrTK1bFjxjFCHwawiaewyI6XPOSqS/KLGuTSsyx5BcMSxvSlsOII63xa6qcCIjf4IEY7yLdQfULWgpDi8+0ftFhh0ptx1M68Wkf9WFE=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZaTp9RtXYU7nBWsLfMTGiHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZdP6U/VvqF1shzlzbajc1AHXg7l8xnT91gCFUxMg7ADMEr7316SnTFUg/DkeItL9jgqc6n8rqt5+VitrFxkUDB6OKi/2I2GOshGt1YalqLBi/tuxGOEY0b9Scf4qq4MaaXY7JyAYzW2Q+irpQZTWgqalO6JIQJopFqwNEoBhPAnKY+DO5AAL2fiGE1g6xrIA3txAdKwQ70ZinpDxFJ3uPLaOb91wsZOHQfRkOKPzmU1gPgG39UmRzflSz1QU9nmbI4lomwvnJMVc3pJTerfEocccBmP2hNgn9IQ3XCzaYTErDtaEjxBdZMM5H4HskOLb+SRYUP
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/a258e38864976688
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ShowMount.png => C:\Users\Admin\Pictures\ShowMount.png.htkxwwxaym 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File renamed C:\Users\Admin\Pictures\InvokeLimit.crw => C:\Users\Admin\Pictures\InvokeLimit.crw.htkxwwxaym 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File renamed C:\Users\Admin\Pictures\ReceiveExpand.raw => C:\Users\Admin\Pictures\ReceiveExpand.raw.htkxwwxaym 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File renamed C:\Users\Admin\Pictures\ReceiveRedo.tif => C:\Users\Admin\Pictures\ReceiveRedo.tif.htkxwwxaym 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File renamed C:\Users\Admin\Pictures\SendUnblock.png => C:\Users\Admin\Pictures\SendUnblock.png.htkxwwxaym 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File renamed C:\Users\Admin\Pictures\ShowDisable.raw => C:\Users\Admin\Pictures\ShowDisable.raw.htkxwwxaym 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HTKXWWXAYM-DECRYPT.txt 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6497616b6497668f617.lock 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\Z: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\A: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\I: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\M: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\P: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\R: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\S: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\U: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\W: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\B: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\E: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\H: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\K: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\N: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\O: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\Y: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\F: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\J: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\Q: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\V: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\X: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\G: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened (read-only) \??\L: 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp" 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe -
Drops file in Program Files directory 39 IoCs
description ioc Process File opened for modification C:\Program Files\CloseClear.3g2 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\CloseUse.gif 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\EnableDeny.mht 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\SuspendExpand.TTS 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\UpdatePublish.txt 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File created C:\Program Files (x86)\6497616b6497668f617.lock 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\StepTest.potx 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\WaitPush.wm 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\WatchRestore.mhtml 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\StepCheckpoint.docx 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File created C:\Program Files\HTKXWWXAYM-DECRYPT.txt 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\BlockExpand.wav 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\CheckpointRename.asp 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\MeasureImport.gif 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\OutStop.gif 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\ResizeDismount.ppsm 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\SaveConvert.html 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\CompareUninstall.vstm 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\ExportFormat.mp4 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\JoinUse.vsd 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\OpenComplete.mp3 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\ReadSync.wdp 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\RepairConnect.eprtx 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\TestMove.ADTS 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File created C:\Program Files\6497616b6497668f617.lock 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\CheckpointBackup.TTS 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\GrantPop.gif 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\LimitAdd.png 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\PingOptimize.jfif 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\RestartRemove.gif 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\CheckpointDisconnect.mpg 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\CopyClear.ini 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\HideSubmit.mht 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\SkipUnlock.tif 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File created C:\Program Files (x86)\HTKXWWXAYM-DECRYPT.txt 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\UnregisterReceive.wmv 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\DisconnectShow.ps1xml 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\EnableGroup.reg 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe File opened for modification C:\Program Files\SaveGet.htm 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 0f0000000100000010000000824bae7c7cb3a15ce851a396760574a30b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000006200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c07090000000100000020000000301e06082b0601050507030306082b0601050507030406082b06010505070301140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c1d0000000100000010000000d06bc27453aa4f6d586437e5d3b377986800000001000000080000000000876ace99d1010300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a194520000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 0400000001000000100000008f5d770627c4983c5b9378e7d77d9bcc0300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a19456800000001000000080000000000876ace99d1011d0000000100000010000000d06bc27453aa4f6d586437e5d3b37798140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c090000000100000020000000301e06082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c070b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000000f0000000100000010000000824bae7c7cb3a15ce851a396760574a320000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 190000000100000010000000e559465e28a60e5499846f194087b0e50f0000000100000010000000824bae7c7cb3a15ce851a396760574a30b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000006200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c07090000000100000020000000301e06082b0601050507030306082b0601050507030406082b06010505070301140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c1d0000000100000010000000d06bc27453aa4f6d586437e5d3b377986800000001000000080000000000876ace99d1010300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a19450400000001000000100000008f5d770627c4983c5b9378e7d77d9bcc20000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 5c0000000100000004000000000400000400000001000000100000008f5d770627c4983c5b9378e7d77d9bcc0300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a19456800000001000000080000000000876ace99d1011d0000000100000010000000d06bc27453aa4f6d586437e5d3b37798140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c090000000100000020000000301e06082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c070b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000000f0000000100000010000000824bae7c7cb3a15ce851a396760574a3190000000100000010000000e559465e28a60e5499846f194087b0e520000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2748 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe 2748 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe 2748 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe 2748 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 976 wmic.exe Token: SeSecurityPrivilege 976 wmic.exe Token: SeTakeOwnershipPrivilege 976 wmic.exe Token: SeLoadDriverPrivilege 976 wmic.exe Token: SeSystemProfilePrivilege 976 wmic.exe Token: SeSystemtimePrivilege 976 wmic.exe Token: SeProfSingleProcessPrivilege 976 wmic.exe Token: SeIncBasePriorityPrivilege 976 wmic.exe Token: SeCreatePagefilePrivilege 976 wmic.exe Token: SeBackupPrivilege 976 wmic.exe Token: SeRestorePrivilege 976 wmic.exe Token: SeShutdownPrivilege 976 wmic.exe Token: SeDebugPrivilege 976 wmic.exe Token: SeSystemEnvironmentPrivilege 976 wmic.exe Token: SeRemoteShutdownPrivilege 976 wmic.exe Token: SeUndockPrivilege 976 wmic.exe Token: SeManageVolumePrivilege 976 wmic.exe Token: 33 976 wmic.exe Token: 34 976 wmic.exe Token: 35 976 wmic.exe Token: 36 976 wmic.exe Token: SeIncreaseQuotaPrivilege 976 wmic.exe Token: SeSecurityPrivilege 976 wmic.exe Token: SeTakeOwnershipPrivilege 976 wmic.exe Token: SeLoadDriverPrivilege 976 wmic.exe Token: SeSystemProfilePrivilege 976 wmic.exe Token: SeSystemtimePrivilege 976 wmic.exe Token: SeProfSingleProcessPrivilege 976 wmic.exe Token: SeIncBasePriorityPrivilege 976 wmic.exe Token: SeCreatePagefilePrivilege 976 wmic.exe Token: SeBackupPrivilege 976 wmic.exe Token: SeRestorePrivilege 976 wmic.exe Token: SeShutdownPrivilege 976 wmic.exe Token: SeDebugPrivilege 976 wmic.exe Token: SeSystemEnvironmentPrivilege 976 wmic.exe Token: SeRemoteShutdownPrivilege 976 wmic.exe Token: SeUndockPrivilege 976 wmic.exe Token: SeManageVolumePrivilege 976 wmic.exe Token: 33 976 wmic.exe Token: 34 976 wmic.exe Token: 35 976 wmic.exe Token: 36 976 wmic.exe Token: SeBackupPrivilege 3188 vssvc.exe Token: SeRestorePrivilege 3188 vssvc.exe Token: SeAuditPrivilege 3188 vssvc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2748 wrote to memory of 976 2748 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe 71 PID 2748 wrote to memory of 976 2748 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe 71 PID 2748 wrote to memory of 976 2748 007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe"C:\Users\Admin\AppData\Local\Temp\007988b1ffdce1e161071f92a130b64650735a5eed6445806c2c967d0902c286.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:976
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3188