Analysis
-
max time kernel
155s -
max time network
138s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-02-2022 00:27
Static task
static1
Behavioral task
behavioral1
Sample
8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe
-
Size
994KB
-
MD5
21a69dfb179a807024a0b8d5838c945c
-
SHA1
78e680ace5f3c0c226a12210f093f0c5b0e85542
-
SHA256
8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc
-
SHA512
55567a6859f33f2d18a59136cd87458a9219eb9ef9585a305e08ea8f42508460b36b95ef3b5474d5e6eddd64e691cd45fbd9ccb755825a1e336815fe45a04c0a
Score
10/10
Malware Config
Signatures
-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
Modifies Windows Firewall 1 TTPs
-
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2329389628-4064185017-3901522362-1000\desktop.ini 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\$Recycle.Bin\S-1-5-21-2329389628-4064185017-3901522362-1000\desktop.ini 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\desktop.ini 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\desktop.ini 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
description flow ioc HTTP URL 3 http://www.sfml-dev.org/ip-provider.php -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\Lang\hu.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\7z.sfx.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\SelectSkip.sys.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\descript.ion.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\Lang\mng.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\History.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\Lang\is.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\History.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\Lang\sl.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\Lang\de.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\7z.dll 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\desktop.ini.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\Lang\eu.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File created C:\Program Files\7-Zip\Lang\fa.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx.[[email protected]][0Q3OVH92LSU54YC].Spade 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe -
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Documents and Settings\S-1-5-21-2329389628-4064185017-3901522362-1000\"쀀ȁ\:쀀═ ═ ꨚ疎\:쀀➐ ➐ ꨚ疎\3쀀⒐ ⒐ ꨚ疎\3쀀≰ ≰ ꨚ疎\3쀀Ѐ\3쀀얰← ꨚ疎 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Documents and Settings\S-1-5-21-2329389628-4064185017-3901522362-1000\ꞔ疎"쀀\ꞔ疎:쀀 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe File opened for modification C:\Documents and Settings\S-1-5-21-2329389628-4064185017-3901522362-1000\ꞔ疎"쀀\ꞔ疎:쀀\ꞔ疎:쀀 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 732 wrote to memory of 1628 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 28 PID 732 wrote to memory of 1628 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 28 PID 732 wrote to memory of 1628 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 28 PID 732 wrote to memory of 1628 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 28 PID 1628 wrote to memory of 1444 1628 cmd.exe 30 PID 1628 wrote to memory of 1444 1628 cmd.exe 30 PID 1628 wrote to memory of 1444 1628 cmd.exe 30 PID 1628 wrote to memory of 1444 1628 cmd.exe 30 PID 1444 wrote to memory of 1124 1444 net.exe 31 PID 1444 wrote to memory of 1124 1444 net.exe 31 PID 1444 wrote to memory of 1124 1444 net.exe 31 PID 1444 wrote to memory of 1124 1444 net.exe 31 PID 732 wrote to memory of 288 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 32 PID 732 wrote to memory of 288 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 32 PID 732 wrote to memory of 288 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 32 PID 732 wrote to memory of 288 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 32 PID 288 wrote to memory of 1372 288 cmd.exe 34 PID 288 wrote to memory of 1372 288 cmd.exe 34 PID 288 wrote to memory of 1372 288 cmd.exe 34 PID 288 wrote to memory of 1372 288 cmd.exe 34 PID 1372 wrote to memory of 1600 1372 net.exe 35 PID 1372 wrote to memory of 1600 1372 net.exe 35 PID 1372 wrote to memory of 1600 1372 net.exe 35 PID 1372 wrote to memory of 1600 1372 net.exe 35 PID 732 wrote to memory of 564 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 36 PID 732 wrote to memory of 564 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 36 PID 732 wrote to memory of 564 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 36 PID 732 wrote to memory of 564 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 36 PID 564 wrote to memory of 676 564 cmd.exe 38 PID 564 wrote to memory of 676 564 cmd.exe 38 PID 564 wrote to memory of 676 564 cmd.exe 38 PID 564 wrote to memory of 676 564 cmd.exe 38 PID 676 wrote to memory of 960 676 net.exe 39 PID 676 wrote to memory of 960 676 net.exe 39 PID 676 wrote to memory of 960 676 net.exe 39 PID 676 wrote to memory of 960 676 net.exe 39 PID 732 wrote to memory of 1148 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 40 PID 732 wrote to memory of 1148 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 40 PID 732 wrote to memory of 1148 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 40 PID 732 wrote to memory of 1148 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 40 PID 1148 wrote to memory of 1472 1148 cmd.exe 42 PID 1148 wrote to memory of 1472 1148 cmd.exe 42 PID 1148 wrote to memory of 1472 1148 cmd.exe 42 PID 1148 wrote to memory of 1472 1148 cmd.exe 42 PID 1472 wrote to memory of 420 1472 net.exe 43 PID 1472 wrote to memory of 420 1472 net.exe 43 PID 1472 wrote to memory of 420 1472 net.exe 43 PID 1472 wrote to memory of 420 1472 net.exe 43 PID 732 wrote to memory of 968 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 44 PID 732 wrote to memory of 968 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 44 PID 732 wrote to memory of 968 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 44 PID 732 wrote to memory of 968 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 44 PID 968 wrote to memory of 1176 968 cmd.exe 46 PID 968 wrote to memory of 1176 968 cmd.exe 46 PID 968 wrote to memory of 1176 968 cmd.exe 46 PID 968 wrote to memory of 1176 968 cmd.exe 46 PID 1176 wrote to memory of 1152 1176 net.exe 47 PID 1176 wrote to memory of 1152 1176 net.exe 47 PID 1176 wrote to memory of 1152 1176 net.exe 47 PID 1176 wrote to memory of 1152 1176 net.exe 47 PID 732 wrote to memory of 1044 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 48 PID 732 wrote to memory of 1044 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 48 PID 732 wrote to memory of 1044 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 48 PID 732 wrote to memory of 1044 732 8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe"C:\Users\Admin\AppData\Local\Temp\8dff91cfab0e19c504ff9e9f207ce1e4a4ca5ef8585513e008ffe02bca9075cc.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLWriter2⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\net.exenet stop SQLWriter3⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter4⤵PID:1124
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLBrowser2⤵
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Windows\SysWOW64\net.exenet stop SQLBrowser3⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser4⤵PID:1600
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵PID:960
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO12⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\net.exenet stop MSSQL$CONTOSO13⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$CONTOSO14⤵PID:420
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSDTC2⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\net.exenet stop MSDTC3⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSDTC4⤵PID:1152
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵PID:1044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no2⤵PID:1476
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet2⤵PID:1448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT2⤵PID:1432
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT3⤵PID:1160
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT4⤵PID:856
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵PID:972
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵PID:1060
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵PID:1284
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop vds2⤵PID:1912
-
C:\Windows\SysWOW64\net.exenet stop vds3⤵PID:1732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vds4⤵PID:1768
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off2⤵PID:812
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off3⤵PID:1880
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable2⤵PID:1580
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵PID:1588
-
-