ouroboros | 0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-en-20211208
submitted
12-02-2022 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
Size

994KB
MD5

59121158ef88411544355a5bf293297c
SHA1

636510582fb27d2a23da35eeb55ef577f52caf68
SHA256

0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c
SHA512

fefbe9c3289f3cb410ddd8e742b3d27fba035827764aad47d304b9f0f23aef89a7215d85c6371c9900898b2b332b8b3a45a7fc117e33c43928f22b695609d4e2

Score

10^/10

ouroboros evasion ransomware

Malware Config

Signatures

Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
ransomware ouroboros
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3846991908-3261386348-1409841751-1000\desktop.ini	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\desktop.ini	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File created	C:\$Recycle.Bin\S-1-5-21-3846991908-3261386348-1409841751-1000\desktop.ini	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File created	C:\Program Files\desktop.ini	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

description	flow	ioc
HTTP URL	3	http://www.sfml-dev.org/ip-provider.php

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\SkipHide.exe.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\sv.pak.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Internet Explorer\pdmproxy100.dll	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.[[email protected]][8O3VUAI0PTE2ZMR].Spade	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	1500	WerFault.exe	20

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\S-1-5-21-3846991908-3261386348-1409841751-1000\ꞔ瓦"쀀\ꞔ瓦:쀀\ꞔ瓦:쀀	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
1700	WerFault.exe
1700	WerFault.exe
1700	WerFault.exe
1700	WerFault.exe
1700	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 784	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	28
PID 1500 wrote to memory of 784	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	28
PID 1500 wrote to memory of 784	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	28
PID 1500 wrote to memory of 784	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	28
PID 784 wrote to memory of 1408	784	cmd.exe	30
PID 784 wrote to memory of 1408	784	cmd.exe	30
PID 784 wrote to memory of 1408	784	cmd.exe	30
PID 784 wrote to memory of 1408	784	cmd.exe	30
PID 1408 wrote to memory of 616	1408	net.exe	31
PID 1408 wrote to memory of 616	1408	net.exe	31
PID 1408 wrote to memory of 616	1408	net.exe	31
PID 1408 wrote to memory of 616	1408	net.exe	31
PID 1500 wrote to memory of 1184	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	33
PID 1500 wrote to memory of 1184	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	33
PID 1500 wrote to memory of 1184	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	33
PID 1500 wrote to memory of 1184	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	33
PID 1184 wrote to memory of 1672	1184	cmd.exe	34
PID 1184 wrote to memory of 1672	1184	cmd.exe	34
PID 1184 wrote to memory of 1672	1184	cmd.exe	34
PID 1184 wrote to memory of 1672	1184	cmd.exe	34
PID 1672 wrote to memory of 1660	1672	net.exe	35
PID 1672 wrote to memory of 1660	1672	net.exe	35
PID 1672 wrote to memory of 1660	1672	net.exe	35
PID 1672 wrote to memory of 1660	1672	net.exe	35
PID 1500 wrote to memory of 896	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	36
PID 1500 wrote to memory of 896	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	36
PID 1500 wrote to memory of 896	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	36
PID 1500 wrote to memory of 896	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	36
PID 896 wrote to memory of 1112	896	cmd.exe	38
PID 896 wrote to memory of 1112	896	cmd.exe	38
PID 896 wrote to memory of 1112	896	cmd.exe	38
PID 896 wrote to memory of 1112	896	cmd.exe	38
PID 1112 wrote to memory of 636	1112	net.exe	39
PID 1112 wrote to memory of 636	1112	net.exe	39
PID 1112 wrote to memory of 636	1112	net.exe	39
PID 1112 wrote to memory of 636	1112	net.exe	39
PID 1500 wrote to memory of 1308	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	41
PID 1500 wrote to memory of 1308	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	41
PID 1500 wrote to memory of 1308	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	41
PID 1500 wrote to memory of 1308	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	41
PID 1308 wrote to memory of 764	1308	cmd.exe	42
PID 1308 wrote to memory of 764	1308	cmd.exe	42
PID 1308 wrote to memory of 764	1308	cmd.exe	42
PID 1308 wrote to memory of 764	1308	cmd.exe	42
PID 764 wrote to memory of 396	764	net.exe	43
PID 764 wrote to memory of 396	764	net.exe	43
PID 764 wrote to memory of 396	764	net.exe	43
PID 764 wrote to memory of 396	764	net.exe	43
PID 1500 wrote to memory of 1864	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	44
PID 1500 wrote to memory of 1864	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	44
PID 1500 wrote to memory of 1864	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	44
PID 1500 wrote to memory of 1864	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	44
PID 1864 wrote to memory of 1948	1864	cmd.exe	46
PID 1864 wrote to memory of 1948	1864	cmd.exe	46
PID 1864 wrote to memory of 1948	1864	cmd.exe	46
PID 1864 wrote to memory of 1948	1864	cmd.exe	46
PID 1948 wrote to memory of 1620	1948	net.exe	47
PID 1948 wrote to memory of 1620	1948	net.exe	47
PID 1948 wrote to memory of 1620	1948	net.exe	47
PID 1948 wrote to memory of 1620	1948	net.exe	47
PID 1500 wrote to memory of 1056	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	48
PID 1500 wrote to memory of 1056	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	48
PID 1500 wrote to memory of 1056	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	48
PID 1500 wrote to memory of 1056	1500	0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe	48

C:\Users\Admin\AppData\Local\Temp\0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe
"C:\Users\Admin\AppData\Local\Temp\0822aba5ae3a202584bcf7289ea3fcac9b4108cd387e7688a2cf6a1d7691327c.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLWriter
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\SysWOW64\net.exe
    net stop SQLWriter
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLWriter
      4⤵
      PID:616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLBrowser
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\net.exe
    net stop SQLBrowser
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLBrowser
      4⤵
      PID:1660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLSERVER
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLSERVER
      4⤵
      PID:636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$CONTOSO1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$CONTOSO1
      4⤵
      PID:396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSDTC
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\SysWOW64\net.exe
    net stop MSDTC
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSDTC
      4⤵
      PID:1620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:1056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
  2⤵
  PID:1552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
  2⤵
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\net.exe
    net stop SQLSERVERAGENT
    3⤵
    PID:1628
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLSERVERAGENT
      4⤵
      PID:1756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
  2⤵
  PID:928
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLSERVER
    3⤵
    PID:1748
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLSERVER
      4⤵
      PID:1724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop vds
  2⤵
  PID:1048
- - C:\Windows\SysWOW64\net.exe
    net stop vds
    3⤵
    PID:1464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop vds
      4⤵
      PID:2024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
  2⤵
  PID:1440
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    PID:688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
  2⤵
  PID:1316
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 228
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/688-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1700-57-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download