Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-03-2022 21:30
Static task
static1
Behavioral task
behavioral1
Sample
cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe
-
Size
3.9MB
-
MD5
be9f805802cbb981a2985a642db21f0b
-
SHA1
fcb7cf1d4026ca4cc9a6c040404da65f1d9b7a63
-
SHA256
cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514
-
SHA512
a4b544f58cc6d964994a60c17e44c584ffe027a73be85d21207bb85fccbcb3fb29d2269e8a5eeb2cf571c17f3a540aed79ad83e5fb170bc9d1526b5a04ced385
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT
Ransom Note
Hello!
All your files are encrypted, write to me if you want to return your files - I can do it very quickly!
Contact me by email:
[email protected] or [email protected] [email protected]
The subject line must contain an encryption extension or the name of your company!
Do not rename encrypted files, you may lose them forever.
You may be a victim of fraud. Free decryption as a guarantee.
Send us up to 3 files for free decryption.
The total file size should be no more than 1 MB! (not in the archive), and the files should not contain valuable information. (databases, backups, large Excel spreadsheets, etc.)
!!! Do not turn off or restart the NAS equipment. This will lead to data loss !!!
To contact us, we recommend that you create an email address at protonmail.com or tutanota.com
Because gmail and other public email programs can block our messages!
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 22 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SyncSave.crw => C:\Users\Admin\Pictures\SyncSave.crw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\FormatRemove.raw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File renamed C:\Users\Admin\Pictures\EnableAssert.tiff => C:\Users\Admin\Pictures\EnableAssert.tiff.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\EnterRestore.tiff.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File renamed C:\Users\Admin\Pictures\MountClear.raw => C:\Users\Admin\Pictures\MountClear.raw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\MountClear.raw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File renamed C:\Users\Admin\Pictures\WatchCheckpoint.raw => C:\Users\Admin\Pictures\WatchCheckpoint.raw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File renamed C:\Users\Admin\Pictures\RevokeResolve.raw => C:\Users\Admin\Pictures\RevokeResolve.raw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\EnableAssert.tiff cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File renamed C:\Users\Admin\Pictures\ConvertUnprotect.tif => C:\Users\Admin\Pictures\ConvertUnprotect.tif.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\OutPublish.crw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\SyncSave.crw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\WatchCheckpoint.raw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\ConvertUnprotect.tif.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File renamed C:\Users\Admin\Pictures\FormatRemove.raw => C:\Users\Admin\Pictures\FormatRemove.raw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File renamed C:\Users\Admin\Pictures\EnterRestore.tiff => C:\Users\Admin\Pictures\EnterRestore.tiff.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File renamed C:\Users\Admin\Pictures\OutPublish.crw => C:\Users\Admin\Pictures\OutPublish.crw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\EnableAssert.tiff.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\EnterRestore.tiff cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File renamed C:\Users\Admin\Pictures\ExportStep.png => C:\Users\Admin\Pictures\ExportStep.png.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\ExportStep.png.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Users\Admin\Pictures\RevokeResolve.raw.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO RESTORE YOUR FILES.TXT cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Barbados cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate.css.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00610_.WMF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14533_.GIF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00441_.WMF.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00586_.WMF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR00.GIF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR29F.GIF.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00559_.WMF.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00686_.WMF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert.css cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR15F.GIF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRMV.XML.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\HOW TO RESTORE YOUR FILES.TXT cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02439_.WMF.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00560_.WMF.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Oriel.thmx.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14582_.GIF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01630_.WMF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02269_.WMF.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\MAIL.ICO cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_06.MID.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233312.WMF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME24.CSS.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\HOW TO RESTORE YOUR FILES.TXT cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGMASTHD.DPV.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Taipei.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21427_.GIF.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_italic.gif cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115863.GIF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15133_.GIF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287645.JPG.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01140_.WMF.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZMAIN.ACCDE cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN090.XML.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02369_.WMF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST7MDT cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01866_.WMF.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\OliveGreen.css.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ORG97.SAM cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ta.pak.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00527_.WMF.qsayebk cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewFrame.html cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237228.WMF cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\HOW TO RESTORE YOUR FILES.TXT cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1440 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1960 vssvc.exe Token: SeRestorePrivilege 1960 vssvc.exe Token: SeAuditPrivilege 1960 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 792 wrote to memory of 956 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 27 PID 792 wrote to memory of 956 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 27 PID 792 wrote to memory of 956 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 27 PID 792 wrote to memory of 956 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 27 PID 956 wrote to memory of 560 956 cmd.exe 29 PID 956 wrote to memory of 560 956 cmd.exe 29 PID 956 wrote to memory of 560 956 cmd.exe 29 PID 956 wrote to memory of 560 956 cmd.exe 29 PID 956 wrote to memory of 268 956 cmd.exe 30 PID 956 wrote to memory of 268 956 cmd.exe 30 PID 956 wrote to memory of 268 956 cmd.exe 30 PID 956 wrote to memory of 268 956 cmd.exe 30 PID 792 wrote to memory of 760 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 31 PID 792 wrote to memory of 760 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 31 PID 792 wrote to memory of 760 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 31 PID 792 wrote to memory of 760 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 31 PID 792 wrote to memory of 1788 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 33 PID 792 wrote to memory of 1788 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 33 PID 792 wrote to memory of 1788 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 33 PID 792 wrote to memory of 1788 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 33 PID 1788 wrote to memory of 1440 1788 cmd.exe 35 PID 1788 wrote to memory of 1440 1788 cmd.exe 35 PID 1788 wrote to memory of 1440 1788 cmd.exe 35 PID 1788 wrote to memory of 1440 1788 cmd.exe 35 PID 792 wrote to memory of 1008 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 40 PID 792 wrote to memory of 1008 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 40 PID 792 wrote to memory of 1008 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 40 PID 792 wrote to memory of 1008 792 cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe"C:\Users\Admin\AppData\Local\Temp\cb141f7346b20cf67b80b5f05ec27fffba0e83cc74b33c091a01c96f27a2a514.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\esehtqayicqadyfrenpn.bat2⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\sc.exeSC QUERY3⤵PID:560
-
-
C:\Windows\SysWOW64\findstr.exeFINDSTR SERVICE_NAME3⤵PID:268
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\lfutuga.bat2⤵PID:760
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\rpllrjgdft.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1440
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\iacges.bat2⤵PID:1008
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960