Analysis
-
max time kernel
135s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-02-2022 21:17
Static task
static1
Behavioral task
behavioral1
Sample
e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe
Resource
win10v2004-en-20220112
General
-
Target
e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe
-
Size
112KB
-
MD5
9a7f87c91bf7e602055a5503e80e2313
-
SHA1
193f407a2f0c7e1eaa65c54cd9115c418881de42
-
SHA256
e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
-
SHA512
d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d
Malware Config
Extracted
C:\Users\Default\# DECRYPT MY FILES #.txt
http://decrypttozxybarc.onion/294B-5909-31B8-0006-4D08
Signatures
-
Adds policy Run key to start application 2 TTPs 6 IoCs
Processes:
pcaui.exepcaui.exepcaui.exee8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exepcaui.exepcaui.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe -
Executes dropped EXE 5 IoCs
Processes:
pcaui.exepcaui.exepcaui.exepcaui.exepcaui.exepid process 788 pcaui.exe 1960 pcaui.exe 2008 pcaui.exe 944 pcaui.exe 1968 pcaui.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 944 cmd.exe -
Drops startup file 2 IoCs
Processes:
e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exepcaui.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\pcaui.lnk e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\pcaui.lnk pcaui.exe -
Loads dropped DLL 3 IoCs
Processes:
e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exepcaui.exepid process 1448 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe 1448 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe 788 pcaui.exe -
Adds Run key to start application 2 TTPs 24 IoCs
Processes:
pcaui.exepcaui.exepcaui.exepcaui.exepcaui.exee8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pcaui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce pcaui.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1608 taskkill.exe 964 taskkill.exe -
Modifies Control Panel 12 IoCs
Processes:
e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exepcaui.exepcaui.exepcaui.exepcaui.exepcaui.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\pcaui.exe\"" pcaui.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop pcaui.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23008D70-86C9-11EC-B76D-4AB3DBA4690F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0fb4b01d61ad801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000000222ebbd89660089d312414c558362309e946135bb37246d97d5a15668623fc2000000000e8000000002000020000000cf90eaba1c476fdd837f45323022e37c96e06dd1dff0328419d651482b778256900000007e63d69599da5c553087df63093f8dbd58be6d7458663dcf5ef84e2e75698326d93e5de96b79800ad3fc7b1e77fffdcd83bdaf8b74d44da8b30c3dbbf97a4d765bc09d5f44e124513637e1cf86d248183cf3356eba8ccffed0b22f678d3161c7bc4e9380d1ec6e5d29a9d1095215cab413a624a144de53a33f0ea8110cc69b18a644037ebadfb15627049dd5dbf2e8a74000000078cb0c5e73c5d2ca6531e3baad80f2dd7a830204c1835504e1c4d2bfb7859d042ac06aed38134d4c83b90384104a7831620d9f654e7639bd8c32afd81cc8e8cc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "350860884" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000c6551876cbeafcb9935fb2a6acca05d6ef26185ea6ce07aa279578242fd611f2000000000e80000000020000200000004a05409a5fcf524c9678a8b63b179ce702abd6fae61dcec4d06aa65449ff4349200000006c33ae7d1b95ee2a92510aebd14d3ffa1b2ebdabf3f42572726dc5b7bc2ebacd4000000090c25571a0e22241c2cf0449c29d9907897c32af22ed3b9a27f8b3f4ad8c46eb7dc2729ede970ce7405d2eefba82d74e5767339d9c3b282f1e5492504fde63c1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
pcaui.exepid process 788 pcaui.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exepcaui.exetaskkill.exepcaui.exepcaui.exepcaui.exepcaui.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1448 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe Token: SeDebugPrivilege 788 pcaui.exe Token: SeIncBasePriorityPrivilege 788 pcaui.exe Token: SeTakeOwnershipPrivilege 788 pcaui.exe Token: SeDebugPrivilege 1608 taskkill.exe Token: SeDebugPrivilege 1960 pcaui.exe Token: SeDebugPrivilege 2008 pcaui.exe Token: SeDebugPrivilege 944 pcaui.exe Token: SeDebugPrivilege 1968 pcaui.exe Token: SeDebugPrivilege 964 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1548 iexplore.exe 1548 iexplore.exe 1560 IEXPLORE.EXE 1560 IEXPLORE.EXE 1560 IEXPLORE.EXE 1560 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.execmd.exepcaui.exetaskeng.exeiexplore.execmd.exedescription pid process target process PID 1448 wrote to memory of 788 1448 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe pcaui.exe PID 1448 wrote to memory of 788 1448 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe pcaui.exe PID 1448 wrote to memory of 788 1448 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe pcaui.exe PID 1448 wrote to memory of 788 1448 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe pcaui.exe PID 1448 wrote to memory of 944 1448 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe cmd.exe PID 1448 wrote to memory of 944 1448 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe cmd.exe PID 1448 wrote to memory of 944 1448 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe cmd.exe PID 1448 wrote to memory of 944 1448 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe cmd.exe PID 944 wrote to memory of 1608 944 cmd.exe taskkill.exe PID 944 wrote to memory of 1608 944 cmd.exe taskkill.exe PID 944 wrote to memory of 1608 944 cmd.exe taskkill.exe PID 944 wrote to memory of 1608 944 cmd.exe taskkill.exe PID 944 wrote to memory of 1320 944 cmd.exe PING.EXE PID 944 wrote to memory of 1320 944 cmd.exe PING.EXE PID 944 wrote to memory of 1320 944 cmd.exe PING.EXE PID 944 wrote to memory of 1320 944 cmd.exe PING.EXE PID 788 wrote to memory of 1960 788 pcaui.exe pcaui.exe PID 788 wrote to memory of 1960 788 pcaui.exe pcaui.exe PID 788 wrote to memory of 1960 788 pcaui.exe pcaui.exe PID 788 wrote to memory of 1960 788 pcaui.exe pcaui.exe PID 788 wrote to memory of 2008 788 pcaui.exe pcaui.exe PID 788 wrote to memory of 2008 788 pcaui.exe pcaui.exe PID 788 wrote to memory of 2008 788 pcaui.exe pcaui.exe PID 788 wrote to memory of 2008 788 pcaui.exe pcaui.exe PID 788 wrote to memory of 524 788 pcaui.exe NOTEPAD.EXE PID 788 wrote to memory of 524 788 pcaui.exe NOTEPAD.EXE PID 788 wrote to memory of 524 788 pcaui.exe NOTEPAD.EXE PID 788 wrote to memory of 524 788 pcaui.exe NOTEPAD.EXE PID 788 wrote to memory of 1548 788 pcaui.exe iexplore.exe PID 788 wrote to memory of 1548 788 pcaui.exe iexplore.exe PID 788 wrote to memory of 1548 788 pcaui.exe iexplore.exe PID 788 wrote to memory of 1548 788 pcaui.exe iexplore.exe PID 788 wrote to memory of 1072 788 pcaui.exe WScript.exe PID 788 wrote to memory of 1072 788 pcaui.exe WScript.exe PID 788 wrote to memory of 1072 788 pcaui.exe WScript.exe PID 788 wrote to memory of 1072 788 pcaui.exe WScript.exe PID 788 wrote to memory of 944 788 pcaui.exe pcaui.exe PID 788 wrote to memory of 944 788 pcaui.exe pcaui.exe PID 788 wrote to memory of 944 788 pcaui.exe pcaui.exe PID 788 wrote to memory of 944 788 pcaui.exe pcaui.exe PID 1608 wrote to memory of 1968 1608 taskeng.exe pcaui.exe PID 1608 wrote to memory of 1968 1608 taskeng.exe pcaui.exe PID 1608 wrote to memory of 1968 1608 taskeng.exe pcaui.exe PID 1608 wrote to memory of 1968 1608 taskeng.exe pcaui.exe PID 1548 wrote to memory of 1560 1548 iexplore.exe IEXPLORE.EXE PID 1548 wrote to memory of 1560 1548 iexplore.exe IEXPLORE.EXE PID 1548 wrote to memory of 1560 1548 iexplore.exe IEXPLORE.EXE PID 1548 wrote to memory of 1560 1548 iexplore.exe IEXPLORE.EXE PID 788 wrote to memory of 1644 788 pcaui.exe cmd.exe PID 788 wrote to memory of 1644 788 pcaui.exe cmd.exe PID 788 wrote to memory of 1644 788 pcaui.exe cmd.exe PID 788 wrote to memory of 1644 788 pcaui.exe cmd.exe PID 1644 wrote to memory of 964 1644 cmd.exe taskkill.exe PID 1644 wrote to memory of 964 1644 cmd.exe taskkill.exe PID 1644 wrote to memory of 964 1644 cmd.exe taskkill.exe PID 1644 wrote to memory of 1660 1644 cmd.exe PING.EXE PID 1644 wrote to memory of 1660 1644 cmd.exe PING.EXE PID 1644 wrote to memory of 1660 1644 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe"C:\Users\Admin\AppData\Local\Temp\e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\pcaui.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\pcaui.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\pcaui.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\pcaui.exe" -watchdog3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\pcaui.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\pcaui.exe" -stat 1113⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:2008 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵PID:524
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1560 -
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\pcaui.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\pcaui.exe" -stat 1113⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:944 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵PID:1072
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "pcaui.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\pcaui.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\system32\taskkill.exetaskkill /t /f /im "pcaui.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:964 -
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
PID:1660 -
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1608 -
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:1320
-
C:\Windows\system32\taskeng.exetaskeng.exe {5203D1B2-858F-4341-92FC-193EBBE4D509} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\pcaui.exeC:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\pcaui.exe2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1120
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VSJJWE3\json[1].json
MD56aae9f9d151f331526525f46fccae36a
SHA11957facf14140ebb1a79409db3754656e11e5653
SHA256c699235148818f9fe1d1b247ec6d81c17741c4d7d10708b94e45a1f92ef14f17
SHA5126da0e8aa7c0f7d19ad4751c00b2a00916cd00c115d8de76c3a63b85218a474a014d8523220e5950f97ad8ff03ef1908e86b776832c0e7c6d5b64aefa27911221
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\34ZL0Q4Z\json[1].json
MD56aae9f9d151f331526525f46fccae36a
SHA11957facf14140ebb1a79409db3754656e11e5653
SHA256c699235148818f9fe1d1b247ec6d81c17741c4d7d10708b94e45a1f92ef14f17
SHA5126da0e8aa7c0f7d19ad4751c00b2a00916cd00c115d8de76c3a63b85218a474a014d8523220e5950f97ad8ff03ef1908e86b776832c0e7c6d5b64aefa27911221
-
MD5
bafd97738894f2657504c1744e90f461
SHA177b114bde10b2d3289ff2cd7b8125190300a0b7e
SHA256d8f5576e334efe6765646819916660914eeb49f16c8b8669bfaae6c8c11d2ed4
SHA5126440dd61c9f100c49d56404757a60576645f96d4edc8f313fc2bb5c2cccbc55f8bcb583b2c84a5e9ff1dee0cf2cf40caf622d920d030cc6ebab42e327076051a
-
MD5
1474da9e6b2e7975ed57cfb822ab24d6
SHA156b544ede4c72c2d1ee215295b3b26e482c9a893
SHA25637640ed9cec977921757382ef2c93cb3039b608fed801417704886f7ed11b5b0
SHA5128760814420208b308c66dcee068099e575c477b38f9ad27f6bd0f018523a290e2f03674a21dc8168b64eeb60665038a53229d5fa45c1ef1e726c7fddcc373b29
-
MD5
9a7f87c91bf7e602055a5503e80e2313
SHA1193f407a2f0c7e1eaa65c54cd9115c418881de42
SHA256e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
SHA512d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d
-
MD5
9a7f87c91bf7e602055a5503e80e2313
SHA1193f407a2f0c7e1eaa65c54cd9115c418881de42
SHA256e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
SHA512d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d
-
MD5
9a7f87c91bf7e602055a5503e80e2313
SHA1193f407a2f0c7e1eaa65c54cd9115c418881de42
SHA256e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
SHA512d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d
-
MD5
9a7f87c91bf7e602055a5503e80e2313
SHA1193f407a2f0c7e1eaa65c54cd9115c418881de42
SHA256e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
SHA512d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d
-
MD5
9a7f87c91bf7e602055a5503e80e2313
SHA1193f407a2f0c7e1eaa65c54cd9115c418881de42
SHA256e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
SHA512d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d
-
MD5
9a7f87c91bf7e602055a5503e80e2313
SHA1193f407a2f0c7e1eaa65c54cd9115c418881de42
SHA256e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
SHA512d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d
-
MD5
43ec4679616a9faa28fc43bc83e6755b
SHA19174fb72c487af5dbb5805a35d413277087630d6
SHA256e8f2e764af92e835396e60ccae2b4aa6e070899171da166dd10ea4ee9246f42b
SHA512ecddf2e0788872549523a83d09af9bc85cbbdcec2b43b76e53870b0f271e63ef6c08ad5989a423efd15e78d3cd7c376ab7396a831ae0da6488044de69709ff68
-
MD5
2f9cc202c39d3546450680ef0ca7e92c
SHA1ce335f984a58a6e8f107bbec53e3dd8ba9a9937e
SHA256164b6db5486818d78c566a61e4bfcf08c759f65526f530032b558dd1f6bf4608
SHA512efcc7e8a6c6a223efc299419b5f000ebb50cf3e7943f48c0d39d7eb1ff4fa363952905c8351e450051976e010f373e46988cfcd6ac6445c546e046c79e1d87cd
-
MD5
e9ffd9f618cbf36ad6c910c161bb8080
SHA1a702b4220bbded577b4b699611bb73593b12ae71
SHA256020ca4b4574a40418b8aa4c2d74b0488e9d150e8d3f5e56e5c6dcca6f7dfaaac
SHA512ee87264e384579df7b74d7ac08e9a490495efa34f1a99e2d4949cb76b839c165fbb281aacae25f4ab7e911401c7bfa3fba4b0e59dd492566985fb8dbd1cf1bef
-
MD5
9a7f87c91bf7e602055a5503e80e2313
SHA1193f407a2f0c7e1eaa65c54cd9115c418881de42
SHA256e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
SHA512d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d
-
MD5
9a7f87c91bf7e602055a5503e80e2313
SHA1193f407a2f0c7e1eaa65c54cd9115c418881de42
SHA256e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
SHA512d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d
-
MD5
9a7f87c91bf7e602055a5503e80e2313
SHA1193f407a2f0c7e1eaa65c54cd9115c418881de42
SHA256e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
SHA512d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d