Analysis
-
max time kernel
173s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-02-2022 07:12
Static task
static1
Behavioral task
behavioral1
Sample
11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe
-
Size
55KB
-
MD5
e6e504a7a83baf74665413cbae978b0f
-
SHA1
c71172e24f3c7e280e66905cbb95f0f44d58aaa4
-
SHA256
11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29
-
SHA512
2b185be40f2d9210d57e20adb133e7e9a2983e727aa7b87da852ae0c40796829343038c0312c5c052a9bf0f167ea0d1338dc1e0a61e9dfed6dd6b29bd41b86d3
Score
10/10
Malware Config
Extracted
Path
C:\HOW_TO_BACK_FILES.html
Ransom Note
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css">
body {
background-color: #252525;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 5px;
color: #FF0000;
background: #1C1A1B;
}
.letter {
color: #FF0000;
font-weight: 600
}
.tabs1 .identi {
margin-left: 0px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #1C1A1B;
color: #F1EADA;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #F1EADA;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #1C1A1B;
color: #F1EADA;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top:0;
background: #1C1A1B;
color: #E29F12;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head"><h3>Your personal ID</h3></div>
<div class="identi">
<pre><span class="letter">2B DF A5 31 01 77 EC 9D 2C 0D 7A 16 63 8C CE A5
C8 A0 D6 98 4A 5D 2C 7D D6 FD C8 D5 C1 79 04 F9
16 EE 4A A9 0B 5F 81 3D 53 87 F6 97 80 0E F6 92
5A 95 AB 19 59 A0 86 37 26 A5 65 E5 0F 1D 2D 76
E6 27 C3 35 A1 6C 86 30 55 30 02 1A 9D E6 31 52
92 55 7D 8C 68 47 71 10 57 A4 3A 78 5A 85 BC C9
A2 52 92 20 A9 FF 9C 86 F0 7C FE 9C 11 AB F2 CB
C6 CC 08 24 85 21 9E C4 6E E4 3A 33 08 21 44 71
03 05 64 53 4B 10 32 30 76 37 9F 51 79 42 ED 64
10 17 90 D0 EE 74 9B B5 AD E3 D6 7A F1 73 0B E0
DD 1D 2A E8 9B 04 64 AF 6A 74 96 92 54 61 5F B3
98 52 05 67 80 87 E4 C3 F3 A7 CB D9 EE B2 7B 86
44 87 2E 92 E0 9F 9B C6 DC 21 69 7B 04 84 16 AF
7E 25 98 62 9D 8C 13 7D 1F 61 95 A5 D4 C7 26 A9
14 9B C9 44 56 7A 64 78 03 36 A6 0D 93 09 E9 CD
3E C4 7F 4D BD 7C A5 C7 30 1E B9 BD D8 04 A5 1D
</span><p></p>
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input name="tabs" checked="checked" id="tab1" type="radio">
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☣ Your files are encrypted! ☣</h1>
<h3> To decrypt, follow the instructions below. </h3>
<br>
<div class="text">
<!--text data -->
To recover data you need decryptor.<br>
To get the decryptor you should:<br>
<p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br>
(Or alternate mail <span class="letter"> [email protected]</span>)</p><p>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files<p></p>
After we send you instruction how to pay for decrypt and
after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we
have the decoder.<br>
<p>
<hr color="#FF0000">
<center><b><p style="color: #FF0000;">MOST IMPORTANT!!!</p></center>
<center><p style="color: #FF0000;"> You can not decrypt your files cheaper than we offer you.
You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE.
No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center>
<hr color="#FF0000">
<ul>
<li>Only [email protected] can with a guarantee decrypt your files </li>
<li>Do not trust anyone besides [email protected]</li>
<li>Antivirus programs can delete this document and you can not contact us later.</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
<!--tab-->
</body></html>
Emails
URLs
http-equiv="Content-Type"
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\RegisterGroup.raw => C:\Users\Admin\Pictures\RegisterGroup.raw.MENTOS 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File renamed C:\Users\Admin\Pictures\RemoveRegister.crw => C:\Users\Admin\Pictures\RemoveRegister.crw.MENTOS 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File renamed C:\Users\Admin\Pictures\RenameProtect.raw => C:\Users\Admin\Pictures\RenameProtect.raw.MENTOS 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File renamed C:\Users\Admin\Pictures\RestoreLock.png => C:\Users\Admin\Pictures\RestoreLock.png.MENTOS 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Pictures\UnlockBackup.tiff 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File renamed C:\Users\Admin\Pictures\DisableSave.png => C:\Users\Admin\Pictures\DisableSave.png.MENTOS 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Pictures\DismountClear.tiff 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File renamed C:\Users\Admin\Pictures\DismountClear.tiff => C:\Users\Admin\Pictures\DismountClear.tiff.MENTOS 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File renamed C:\Users\Admin\Pictures\ExportMove.tif => C:\Users\Admin\Pictures\ExportMove.tif.MENTOS 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File renamed C:\Users\Admin\Pictures\LockImport.tif => C:\Users\Admin\Pictures\LockImport.tif.MENTOS 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File renamed C:\Users\Admin\Pictures\UnlockBackup.tiff => C:\Users\Admin\Pictures\UnlockBackup.tiff.MENTOS 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File renamed C:\Users\Admin\Pictures\ConvertToLimit.png => C:\Users\Admin\Pictures\ConvertToLimit.png.MENTOS 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe" 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe -
Drops desktop.ini file(s) 23 IoCs
description ioc Process File opened for modification C:\Users\Public\Videos\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Public\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Public\Music\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Music\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Links\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Public\Documents\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2254" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "5767" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5767" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1944" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1944" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5767" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1944" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2254" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2254" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3960 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe 3960 11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 224 svchost.exe Token: SeCreatePagefilePrivilege 224 svchost.exe Token: SeShutdownPrivilege 224 svchost.exe Token: SeCreatePagefilePrivilege 224 svchost.exe Token: SeShutdownPrivilege 224 svchost.exe Token: SeCreatePagefilePrivilege 224 svchost.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe Token: SeRestorePrivilege 2272 TiWorker.exe Token: SeSecurityPrivilege 2272 TiWorker.exe Token: SeBackupPrivilege 2272 TiWorker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2500 SearchApp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe"C:\Users\Admin\AppData\Local\Temp\11f3fa52f394fb2d85c168134302368ae756418c31fa4051a58604cf8e566c29.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
PID:3960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:224
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2500
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:2404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:4492