Analysis
-
max time kernel
138s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-02-2022 21:26
Static task
static1
Behavioral task
behavioral1
Sample
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe
Resource
win10v2004-en-20220112
General
-
Target
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe
-
Size
112KB
-
MD5
65977152d62265c0f46751874bd45767
-
SHA1
3b6aaf8ab4eb82062780202248aad45b916376ab
-
SHA256
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
-
SHA512
c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
http://decrypttozxybarc.onion/0C1C-257D-7431-0006-422B
Signatures
-
Adds policy Run key to start application 2 TTPs 5 IoCs
Processes:
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exeUserAccountControlSettings.exeUserAccountControlSettings.exeUserAccountControlSettings.exeUserAccountControlSettings.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe -
Executes dropped EXE 4 IoCs
Processes:
UserAccountControlSettings.exeUserAccountControlSettings.exeUserAccountControlSettings.exeUserAccountControlSettings.exepid process 1624 UserAccountControlSettings.exe 1120 UserAccountControlSettings.exe 1544 UserAccountControlSettings.exe 972 UserAccountControlSettings.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1740 cmd.exe -
Drops startup file 2 IoCs
Processes:
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exeUserAccountControlSettings.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\UserAccountControlSettings.lnk 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\UserAccountControlSettings.lnk UserAccountControlSettings.exe -
Loads dropped DLL 3 IoCs
Processes:
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exeUserAccountControlSettings.exepid process 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe 1624 UserAccountControlSettings.exe -
Adds Run key to start application 2 TTPs 20 IoCs
Processes:
UserAccountControlSettings.exeUserAccountControlSettings.exe8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exeUserAccountControlSettings.exeUserAccountControlSettings.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1680 taskkill.exe 2024 taskkill.exe -
Modifies Control Panel 10 IoCs
Processes:
UserAccountControlSettings.exeUserAccountControlSettings.exeUserAccountControlSettings.exeUserAccountControlSettings.exe8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop UserAccountControlSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\\UserAccountControlSettings.exe\"" UserAccountControlSettings.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000931485939d6973fdbfdb8d915a3ae0c2afb691f41427e0ce91ad0cfadd056c51000000000e8000000002000020000000a6a3aac148c52871052cd5a865e20e34bf200204f1b7488b56ea2340bf3a683390000000c006f0f8df732c1aaf343b21f9dba2274b6407caf6180035a67c36b12222cd22dfa8f1618c0563f1615bb023d73d169f14de2f81bdc1b93fbf3f5fa7fba13e9b39a8fcd7168b95493b4af0f499ed709d8fee2a614cb45069f2cd9b9c77ee497c229f224208b7883c125e83c9096210e5780d410206bac47b23033744fce00d2cf08823d3330dc92993600b34379149e7400000007e035653e156ac193fe1e7bcaa3a6acd5bfbfd3b1c44591a3d05f13cde9a4e8eb2a41a18564ae82cf188c115ac67548a1fdb7dc131720ced2b0437844a0b52f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "350861380" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A7E84A1-86CA-11EC-94AC-F6A981946521} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000001fe15636c462b99c455c2ab6000425c8658a5702275b7e7b5a8ff25964829e43000000000e8000000002000020000000b2fba99876fb4eb8333ab75fc39527480401616d65f80d23a1181b454abc8c9120000000e3ad459ca1548cc97e969d98fdb2e412c903e712e5654a5ee735160167d892b0400000001afbe8ef3566aca0045134fe11a9be13c56b1643fa5239fab0406c07d53fe75b3f27b7ed45baeb87e4489f8e45fb2f0c3fc554b78e28ac58d479fe6b965f6fe5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0684928d71ad801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
UserAccountControlSettings.exepid process 1624 UserAccountControlSettings.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exeUserAccountControlSettings.exetaskkill.exeUserAccountControlSettings.exeUserAccountControlSettings.exeUserAccountControlSettings.exetaskkill.exedescription pid process Token: SeDebugPrivilege 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe Token: SeDebugPrivilege 1624 UserAccountControlSettings.exe Token: SeIncBasePriorityPrivilege 1624 UserAccountControlSettings.exe Token: SeTakeOwnershipPrivilege 1624 UserAccountControlSettings.exe Token: SeDebugPrivilege 1680 taskkill.exe Token: SeDebugPrivilege 1120 UserAccountControlSettings.exe Token: SeDebugPrivilege 1544 UserAccountControlSettings.exe Token: SeDebugPrivilege 972 UserAccountControlSettings.exe Token: SeDebugPrivilege 2024 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 944 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 944 iexplore.exe 944 iexplore.exe 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.execmd.exeUserAccountControlSettings.exeiexplore.execmd.exedescription pid process target process PID 848 wrote to memory of 1624 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe UserAccountControlSettings.exe PID 848 wrote to memory of 1624 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe UserAccountControlSettings.exe PID 848 wrote to memory of 1624 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe UserAccountControlSettings.exe PID 848 wrote to memory of 1624 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe UserAccountControlSettings.exe PID 848 wrote to memory of 1740 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe cmd.exe PID 848 wrote to memory of 1740 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe cmd.exe PID 848 wrote to memory of 1740 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe cmd.exe PID 848 wrote to memory of 1740 848 8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe cmd.exe PID 1740 wrote to memory of 1680 1740 cmd.exe taskkill.exe PID 1740 wrote to memory of 1680 1740 cmd.exe taskkill.exe PID 1740 wrote to memory of 1680 1740 cmd.exe taskkill.exe PID 1740 wrote to memory of 1680 1740 cmd.exe taskkill.exe PID 1740 wrote to memory of 560 1740 cmd.exe PING.EXE PID 1740 wrote to memory of 560 1740 cmd.exe PING.EXE PID 1740 wrote to memory of 560 1740 cmd.exe PING.EXE PID 1740 wrote to memory of 560 1740 cmd.exe PING.EXE PID 1624 wrote to memory of 1120 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 1624 wrote to memory of 1120 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 1624 wrote to memory of 1120 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 1624 wrote to memory of 1120 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 1624 wrote to memory of 1544 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 1624 wrote to memory of 1544 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 1624 wrote to memory of 1544 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 1624 wrote to memory of 1544 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 1624 wrote to memory of 1964 1624 UserAccountControlSettings.exe NOTEPAD.EXE PID 1624 wrote to memory of 1964 1624 UserAccountControlSettings.exe NOTEPAD.EXE PID 1624 wrote to memory of 1964 1624 UserAccountControlSettings.exe NOTEPAD.EXE PID 1624 wrote to memory of 1964 1624 UserAccountControlSettings.exe NOTEPAD.EXE PID 1624 wrote to memory of 944 1624 UserAccountControlSettings.exe iexplore.exe PID 1624 wrote to memory of 944 1624 UserAccountControlSettings.exe iexplore.exe PID 1624 wrote to memory of 944 1624 UserAccountControlSettings.exe iexplore.exe PID 1624 wrote to memory of 944 1624 UserAccountControlSettings.exe iexplore.exe PID 1624 wrote to memory of 1548 1624 UserAccountControlSettings.exe WScript.exe PID 1624 wrote to memory of 1548 1624 UserAccountControlSettings.exe WScript.exe PID 1624 wrote to memory of 1548 1624 UserAccountControlSettings.exe WScript.exe PID 1624 wrote to memory of 1548 1624 UserAccountControlSettings.exe WScript.exe PID 1624 wrote to memory of 972 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 1624 wrote to memory of 972 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 1624 wrote to memory of 972 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 1624 wrote to memory of 972 1624 UserAccountControlSettings.exe UserAccountControlSettings.exe PID 944 wrote to memory of 856 944 iexplore.exe IEXPLORE.EXE PID 944 wrote to memory of 856 944 iexplore.exe IEXPLORE.EXE PID 944 wrote to memory of 856 944 iexplore.exe IEXPLORE.EXE PID 944 wrote to memory of 856 944 iexplore.exe IEXPLORE.EXE PID 1624 wrote to memory of 708 1624 UserAccountControlSettings.exe cmd.exe PID 1624 wrote to memory of 708 1624 UserAccountControlSettings.exe cmd.exe PID 1624 wrote to memory of 708 1624 UserAccountControlSettings.exe cmd.exe PID 1624 wrote to memory of 708 1624 UserAccountControlSettings.exe cmd.exe PID 708 wrote to memory of 2024 708 cmd.exe taskkill.exe PID 708 wrote to memory of 2024 708 cmd.exe taskkill.exe PID 708 wrote to memory of 2024 708 cmd.exe taskkill.exe PID 708 wrote to memory of 1544 708 cmd.exe PING.EXE PID 708 wrote to memory of 1544 708 cmd.exe PING.EXE PID 708 wrote to memory of 1544 708 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe"C:\Users\Admin\AppData\Local\Temp\8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe" -watchdog3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:1120 -
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe" -stat 1263⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:1544 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵PID:1964
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:944 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:856 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵PID:1548
-
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe"C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe" -stat 1263⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:972 -
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "UserAccountControlSettings.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\system32\taskkill.exetaskkill /t /f /im "UserAccountControlSettings.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2024 -
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
PID:1544 -
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "8f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1680 -
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:560
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1660
-
C:\Windows\system32\taskeng.exetaskeng.exe {B828715E-E055-47A6-A041-3A3B11270774} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]1⤵PID:1816
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VSJJWE3\json[1].json
MD56aae9f9d151f331526525f46fccae36a
SHA11957facf14140ebb1a79409db3754656e11e5653
SHA256c699235148818f9fe1d1b247ec6d81c17741c4d7d10708b94e45a1f92ef14f17
SHA5126da0e8aa7c0f7d19ad4751c00b2a00916cd00c115d8de76c3a63b85218a474a014d8523220e5950f97ad8ff03ef1908e86b776832c0e7c6d5b64aefa27911221
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\34ZL0Q4Z\json[1].json
MD56aae9f9d151f331526525f46fccae36a
SHA11957facf14140ebb1a79409db3754656e11e5653
SHA256c699235148818f9fe1d1b247ec6d81c17741c4d7d10708b94e45a1f92ef14f17
SHA5126da0e8aa7c0f7d19ad4751c00b2a00916cd00c115d8de76c3a63b85218a474a014d8523220e5950f97ad8ff03ef1908e86b776832c0e7c6d5b64aefa27911221
-
MD5
d6445002551e6d9b6813513c586d4834
SHA1f15f1f7dc941cf69e412b35a173f3c31d3c1440a
SHA25646646416e66798340cf55eac9dbce0f939cba496c40e069c5c5e0c5e313af091
SHA51278bf385f07366c8f08620f814b671d8d67e173980e23f9e7aafad1ea147d3c81a3cf45f3e8247d690e57933ea11115a74c874569c05463dbad7906f84445cb13
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\UserAccountControlSettings.lnk
MD5d7c9884aaea3b23e666ae6d9503b5ed8
SHA172866570800fde50d63e6b65d31863c008a9bed0
SHA256013d618171c7a0872f6f71612cbbc09e1ecac3b5954c6aa631a18ae7fdd3d30d
SHA512fd5684a86b59b63b279f7447ceb5c5dc19a861d535b2230d151531e69a6c59f1c310fcab850b11eda290165dca8d874feef65cb6e48dc630d1d6f5c72ac93a0e
-
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe
MD565977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe
MD565977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe
MD565977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe
MD565977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
C:\Users\Admin\AppData\Roaming\{E7B8EC7A-1BC7-9DCC-B44A-6960964FFB54}\UserAccountControlSettings.exe
MD565977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
MD5
eda0d4e64bfcf82267d39fa5689b1eb3
SHA191c4e8aab58139288b10a8708bf5439dfa191e1c
SHA25692d6bb43fd126466ea1273c923e8ad3798837b85f885a829c3f871e488927afb
SHA512c0b74835e84b7f42d34e80d6b45d1686b6238a96a0729c32eaf7961a08316110e00b26250b4b28f1d6f90a13bf89cd876128a4fff60d37c02ca07c8fced88083
-
MD5
bb15712d797872c57e66fc92bec8b128
SHA16ba784999a7ae63ddf4d1472a017beb6d5966cb9
SHA25624e0049c8a00e32b9bbf4eaab93d9c79f98772f7704b907fb578fb0170a85e67
SHA512036f3c6fce9e5b35eaee0283fa53186e5a58f82055623895afeeaf00b97e8835e57b1fc352f4f3a7f1087e6113add7a259a3e03c6bc74dd5dd51b1bc5c057edf
-
MD5
e9ffd9f618cbf36ad6c910c161bb8080
SHA1a702b4220bbded577b4b699611bb73593b12ae71
SHA256020ca4b4574a40418b8aa4c2d74b0488e9d150e8d3f5e56e5c6dcca6f7dfaaac
SHA512ee87264e384579df7b74d7ac08e9a490495efa34f1a99e2d4949cb76b839c165fbb281aacae25f4ab7e911401c7bfa3fba4b0e59dd492566985fb8dbd1cf1bef
-
MD5
65977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
MD5
65977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb
-
MD5
65977152d62265c0f46751874bd45767
SHA13b6aaf8ab4eb82062780202248aad45b916376ab
SHA2568f5be0af938a91d520c9ad6454e4eb8e562d236c6cdaae9cecfe04b28e37f857
SHA512c36f317b7229139f9abaa1cf17b50699d3cab630b95d2fb9b59960c14d2843484378c60bd28bf841f229d23b889e180c278f007fd088948e2535e38cb2a782bb