Analysis
-
max time kernel
4294179s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
06-03-2022 00:33
Static task
static1
Behavioral task
behavioral1
Sample
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe
Resource
win10v2004-en-20220113
General
-
Target
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe
-
Size
69KB
-
MD5
3229e2489dde524195cf0ccbbf5f7d40
-
SHA1
a257fc0b117fb9e0a6df128213e11de5cee21129
-
SHA256
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d
-
SHA512
d719fcf974a9304154daf95f0c80805b9a720a1db1289aa4fd189494cb0c29820a1b999d26fb38378d3a47602b26ff8375189ed9586a9c94c19fae0f4e0c650e
Malware Config
Extracted
C:\Users\Admin\Desktop\5F3197-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exedescription ioc process File renamed C:\Users\Admin\Pictures\SkipBlock.tiff => C:\Users\Admin\Pictures\SkipBlock.tiff.5f3197 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Users\Admin\Pictures\SkipBlock.tiff 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File renamed C:\Users\Admin\Pictures\ReadOpen.png => C:\Users\Admin\Pictures\ReadOpen.png.5f3197 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File renamed C:\Users\Admin\Pictures\RepairEdit.tif => C:\Users\Admin\Pictures\RepairEdit.tif.5f3197 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3408 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left_over.gif 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105388.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107328.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00211_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieResume.dotx 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\5F3197-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\MergeSend.7z 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02417_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01563_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Northwind.accdt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00116_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File created C:\Program Files\Java\jre7\bin\server\5F3197-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIconsMask.bmp 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_K_COL.HXK 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199423.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0234687.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jre7\README.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\TAB_ON.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01682_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jre7\lib\security\trusted.libraries 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105380.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00177_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\5F3197-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\am.pak 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01294_.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\TAB_ON.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WHIRL1.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00918_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00633_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\form_edit.js 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01066_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188669.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\5F3197-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099193.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14711_.GIF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\5F3197-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01183_.WMF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_bullets.gif 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\5F3197-Readme.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 516 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3240 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exepid process 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe Token: SeImpersonatePrivilege 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe Token: SeBackupPrivilege 5780 vssvc.exe Token: SeRestorePrivilege 5780 vssvc.exe Token: SeAuditPrivilege 5780 vssvc.exe Token: SeDebugPrivilege 3240 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.execmd.exedescription pid process target process PID 1104 wrote to memory of 516 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe vssadmin.exe PID 1104 wrote to memory of 516 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe vssadmin.exe PID 1104 wrote to memory of 516 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe vssadmin.exe PID 1104 wrote to memory of 516 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe vssadmin.exe PID 1104 wrote to memory of 1548 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe notepad.exe PID 1104 wrote to memory of 1548 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe notepad.exe PID 1104 wrote to memory of 1548 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe notepad.exe PID 1104 wrote to memory of 1548 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe notepad.exe PID 1104 wrote to memory of 3408 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe cmd.exe PID 1104 wrote to memory of 3408 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe cmd.exe PID 1104 wrote to memory of 3408 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe cmd.exe PID 1104 wrote to memory of 3408 1104 488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe cmd.exe PID 3408 wrote to memory of 3240 3408 cmd.exe taskkill.exe PID 3408 wrote to memory of 3240 3408 cmd.exe taskkill.exe PID 3408 wrote to memory of 3240 3408 cmd.exe taskkill.exe PID 3408 wrote to memory of 3240 3408 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe"C:\Users\Admin\AppData\Local\Temp\488261e1e0793e6830f68c572db7e229af1d9403bbc8e61b9da707b1b63a137d.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\5F3197-Readme.txt"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\1DAE.tmp.bat"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 11043⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp.batMD5
d5dfea5e35f139c35394e02f699cb574
SHA1316a3e7ed05a1f9144162e814483c73df3e77b61
SHA2568294d07f0dd5d6349a0aad3c0c587e30deee41bfef21e32b433561ab5d0c1c85
SHA512d5cd09caaed8273ca6fbda3f528c0aaad758fbbb94611d2f64641449713342bad1ec4b80ef2ac368281aeca48939a00f5a8e00b91e4ba649a74599459ca90f7b
-
C:\Users\Admin\Desktop\5F3197-Readme.txtMD5
9bd5867572d0b832669a080b79b7e1f5
SHA1ee449f0f4bd1c7d8fd116b299a525ab7dc8fb376
SHA256d2318ac67d8af74c68b422e21212b357178e2f4ef7a632a05ba9ecb098876b40
SHA512d57bcac7a74cc1b39642b7cd10386b2c814247eab968a0566c1bdc65723ca4e4816ddfe3d92521449579270862cc325898886b0be421ec01f1f422b53d30bb81
-
memory/1104-54-0x0000000075CC1000-0x0000000075CC3000-memory.dmpFilesize
8KB