2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce

Analysis

max time kernel
159s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
01/02/2022, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe
Size

1.2MB
MD5

66b9f03ccf1b0c4b2dad55d3f60b040c
SHA1

d330988c7baf1ca42ac40a9990a5626894c628c4
SHA256

2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce
SHA512

c61a75ad69165d3ee6140553b945b2739e2380678fc2fbb0b6df4dd71fef3a3cb1d5f8edf306da119c7be36d9f19a1c6aee208b03472d0f5791ae4c591b0c47b

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note

Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: [email protected] [email protected]

Emails

[email protected]

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\calendar.css	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_cloudy.png	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\timeZones.js	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\localizedSettings.css	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pe.dll	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\wmpnetwk.exe.mui	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\TipBand.dll.mui	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\tpcps.dll	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Mail\oeimport.dll	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\service.js	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_PDF.DLL	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\OPHPROXY.DLL	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\localizedStrings.js	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\settings.js	fbdkdchf868.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\clock.css	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\cpu.css	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\To_Do_List.jtp	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\settings.js	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpCom.dll	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Journal\PDIALOG.exe	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\WMPSideShowGadget.exe.mui	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\weather.js	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui	fbdkdchf868.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll	fbdkdchf868.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\slideShow.js	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\localizedSettings.css	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\Wks9Pxy.cnv	fbdkdchf868.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Journal\jnwppr.dll	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\service.js	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\slideShow.css	fbdkdchf868.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer.png	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB	fbdkdchf868.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\THMBNAIL.PNG	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\es-ES\Sidebar.exe.mui	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\picturePuzzle.html	fbdkdchf868.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\WMPDMC.exe.mui	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\timeZones.js	fbdkdchf868.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\cpu.js	fbdkdchf868.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1548	fbdkdchf868.exe
1548	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe
1548	fbdkdchf868.exe
1548	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe
1548	fbdkdchf868.exe
1548	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe
1548	fbdkdchf868.exe
1548	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
1548	fbdkdchf868.exe
1548	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
1548	fbdkdchf868.exe
1548	fbdkdchf868.exe
1548	fbdkdchf868.exe
1548	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe
1548	fbdkdchf868.exe
1548	fbdkdchf868.exe
1064	fbdkdchf868.exe
1064	fbdkdchf868.exe
1548	fbdkdchf868.exe
1548	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe
1104	fbdkdchf868.exe
1104	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe
1104	fbdkdchf868.exe
1104	fbdkdchf868.exe
564	fbdkdchf868.exe
564	fbdkdchf868.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1028	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe
Token: SeBackupPrivilege	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe
Token: SeRestorePrivilege	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe
Token: SeLockMemoryPrivilege	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe
Token: SeCreateGlobalPrivilege	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe
Token: SeDebugPrivilege	468	fbdkdchf868.exe
Token: SeBackupPrivilege	468	fbdkdchf868.exe
Token: SeRestorePrivilege	468	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	468	fbdkdchf868.exe
Token: SeCreateGlobalPrivilege	468	fbdkdchf868.exe
Token: SeDebugPrivilege	1548	fbdkdchf868.exe
Token: SeBackupPrivilege	1548	fbdkdchf868.exe
Token: SeRestorePrivilege	1548	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	1548	fbdkdchf868.exe
Token: SeCreateGlobalPrivilege	1548	fbdkdchf868.exe
Token: SeDebugPrivilege	564	fbdkdchf868.exe
Token: SeBackupPrivilege	564	fbdkdchf868.exe
Token: SeRestorePrivilege	564	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	564	fbdkdchf868.exe
Token: SeCreateGlobalPrivilege	564	fbdkdchf868.exe
Token: SeDebugPrivilege	1064	fbdkdchf868.exe
Token: SeBackupPrivilege	1064	fbdkdchf868.exe
Token: SeRestorePrivilege	1064	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	1064	fbdkdchf868.exe
Token: SeCreateGlobalPrivilege	1064	fbdkdchf868.exe
Token: SeDebugPrivilege	1104	fbdkdchf868.exe
Token: SeBackupPrivilege	1104	fbdkdchf868.exe
Token: SeRestorePrivilege	1104	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	1104	fbdkdchf868.exe
Token: SeCreateGlobalPrivilege	1104	fbdkdchf868.exe
Token: SeDebugPrivilege	1804	fbdkdchf868.exe
Token: SeBackupPrivilege	1804	fbdkdchf868.exe
Token: SeRestorePrivilege	1804	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	1804	fbdkdchf868.exe
Token: SeCreateGlobalPrivilege	1804	fbdkdchf868.exe
Token: SeDebugPrivilege	952	fbdkdchf868.exe
Token: SeBackupPrivilege	952	fbdkdchf868.exe
Token: SeRestorePrivilege	952	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	952	fbdkdchf868.exe
Token: SeCreateGlobalPrivilege	952	fbdkdchf868.exe
Token: SeDebugPrivilege	1952	fbdkdchf868.exe
Token: SeBackupPrivilege	1952	fbdkdchf868.exe
Token: SeRestorePrivilege	1952	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	1952	fbdkdchf868.exe
Token: SeCreateGlobalPrivilege	1952	fbdkdchf868.exe
Token: SeDebugPrivilege	1656	fbdkdchf868.exe
Token: SeBackupPrivilege	1656	fbdkdchf868.exe
Token: SeRestorePrivilege	1656	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	1656	fbdkdchf868.exe
Token: SeCreateGlobalPrivilege	1656	fbdkdchf868.exe
Token: SeDebugPrivilege	1748	fbdkdchf868.exe
Token: SeBackupPrivilege	1748	fbdkdchf868.exe
Token: SeRestorePrivilege	1748	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	1748	fbdkdchf868.exe
Token: SeCreateGlobalPrivilege	1748	fbdkdchf868.exe
Token: SeDebugPrivilege	1344	fbdkdchf868.exe
Token: SeBackupPrivilege	1344	fbdkdchf868.exe
Token: SeRestorePrivilege	1344	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	1344	fbdkdchf868.exe
Token: SeCreateGlobalPrivilege	1344	fbdkdchf868.exe
Token: SeDebugPrivilege	1612	fbdkdchf868.exe
Token: SeBackupPrivilege	1612	fbdkdchf868.exe
Token: SeRestorePrivilege	1612	fbdkdchf868.exe
Token: SeLockMemoryPrivilege	1612	fbdkdchf868.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1028	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe	27
PID 1592 wrote to memory of 1028	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe	27
PID 1592 wrote to memory of 1028	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe	27
PID 1592 wrote to memory of 1028	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe	27
PID 1592 wrote to memory of 468	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe	29
PID 1592 wrote to memory of 468	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe	29
PID 1592 wrote to memory of 468	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe	29
PID 1592 wrote to memory of 468	1592	2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe	29
PID 468 wrote to memory of 1064	468	fbdkdchf868.exe	32
PID 468 wrote to memory of 1064	468	fbdkdchf868.exe	32
PID 468 wrote to memory of 1064	468	fbdkdchf868.exe	32
PID 468 wrote to memory of 1064	468	fbdkdchf868.exe	32
PID 468 wrote to memory of 1548	468	fbdkdchf868.exe	31
PID 468 wrote to memory of 1548	468	fbdkdchf868.exe	31
PID 468 wrote to memory of 1548	468	fbdkdchf868.exe	31
PID 468 wrote to memory of 1548	468	fbdkdchf868.exe	31
PID 468 wrote to memory of 564	468	fbdkdchf868.exe	30
PID 468 wrote to memory of 564	468	fbdkdchf868.exe	30
PID 468 wrote to memory of 564	468	fbdkdchf868.exe	30
PID 468 wrote to memory of 564	468	fbdkdchf868.exe	30
PID 468 wrote to memory of 1104	468	fbdkdchf868.exe	34
PID 468 wrote to memory of 1104	468	fbdkdchf868.exe	34
PID 468 wrote to memory of 1104	468	fbdkdchf868.exe	34
PID 468 wrote to memory of 1104	468	fbdkdchf868.exe	34
PID 468 wrote to memory of 1804	468	fbdkdchf868.exe	35
PID 468 wrote to memory of 1804	468	fbdkdchf868.exe	35
PID 468 wrote to memory of 1804	468	fbdkdchf868.exe	35
PID 468 wrote to memory of 1804	468	fbdkdchf868.exe	35
PID 468 wrote to memory of 952	468	fbdkdchf868.exe	37
PID 468 wrote to memory of 952	468	fbdkdchf868.exe	37
PID 468 wrote to memory of 952	468	fbdkdchf868.exe	37
PID 468 wrote to memory of 952	468	fbdkdchf868.exe	37
PID 468 wrote to memory of 1952	468	fbdkdchf868.exe	41
PID 468 wrote to memory of 1952	468	fbdkdchf868.exe	41
PID 468 wrote to memory of 1952	468	fbdkdchf868.exe	41
PID 468 wrote to memory of 1952	468	fbdkdchf868.exe	41
PID 468 wrote to memory of 1656	468	fbdkdchf868.exe	42
PID 468 wrote to memory of 1656	468	fbdkdchf868.exe	42
PID 468 wrote to memory of 1656	468	fbdkdchf868.exe	42
PID 468 wrote to memory of 1656	468	fbdkdchf868.exe	42
PID 468 wrote to memory of 1748	468	fbdkdchf868.exe	43
PID 468 wrote to memory of 1748	468	fbdkdchf868.exe	43
PID 468 wrote to memory of 1748	468	fbdkdchf868.exe	43
PID 468 wrote to memory of 1748	468	fbdkdchf868.exe	43
PID 468 wrote to memory of 1344	468	fbdkdchf868.exe	45
PID 468 wrote to memory of 1344	468	fbdkdchf868.exe	45
PID 468 wrote to memory of 1344	468	fbdkdchf868.exe	45
PID 468 wrote to memory of 1344	468	fbdkdchf868.exe	45
PID 468 wrote to memory of 1612	468	fbdkdchf868.exe	46
PID 468 wrote to memory of 1612	468	fbdkdchf868.exe	46
PID 468 wrote to memory of 1612	468	fbdkdchf868.exe	46
PID 468 wrote to memory of 1612	468	fbdkdchf868.exe	46
PID 468 wrote to memory of 1604	468	fbdkdchf868.exe	47
PID 468 wrote to memory of 1604	468	fbdkdchf868.exe	47
PID 468 wrote to memory of 1604	468	fbdkdchf868.exe	47
PID 468 wrote to memory of 1604	468	fbdkdchf868.exe	47
PID 468 wrote to memory of 656	468	fbdkdchf868.exe	48
PID 468 wrote to memory of 656	468	fbdkdchf868.exe	48
PID 468 wrote to memory of 656	468	fbdkdchf868.exe	48
PID 468 wrote to memory of 656	468	fbdkdchf868.exe	48
PID 468 wrote to memory of 544	468	fbdkdchf868.exe	49
PID 468 wrote to memory of 544	468	fbdkdchf868.exe	49
PID 468 wrote to memory of 544	468	fbdkdchf868.exe	49
PID 468 wrote to memory of 544	468	fbdkdchf868.exe	49

C:\Users\Admin\AppData\Local\Temp\2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe
"C:\Users\Admin\AppData\Local\Temp\2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c move /y C:\Users\Admin\AppData\Local\Temp\2ce4984a74a36dcdc380c435c9495241db4ca7e107fc2ba50d2fe775fb6b73ce.exe C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1028
- C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
  C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -m
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:656
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1852
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1460
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1028
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:744
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:316
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1852
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1452
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1304
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    - Drops file in Program Files directory
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:316
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe
    C:\Users\Admin\AppData\Local\Temp\fbdkdchf868.exe -i SM-fbdkdchf -s
    3⤵
    PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1592-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download