Analysis
-
max time kernel
4294244s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
24-03-2022 16:03
Static task
static1
Behavioral task
behavioral1
Sample
950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe
Resource
win10v2004-en-20220113
General
-
Target
950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe
-
Size
30KB
-
MD5
ed0413e7e8a4280fe74f5afb87054b52
-
SHA1
92f8eca9aaad091ed525d52565932843097cc36e
-
SHA256
950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e
-
SHA512
55ccdcb90e556c83afdfcd1fb2106518d35c719ff199f8430377293a297223e14cccdc29add9b3c9b08221f9268f55d56f0ca17ab21cb898a9a1224daea6c8c4
Malware Config
Signatures
-
T1Happy
T1Happy ransomware is a cryptovirus that behaves different than its counterparts.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Disables RegEdit via registry modification
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Users\\Admin\\AppData\\Local\\Temp\\950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe" 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Users\\Admin\\AppData\\Local\\Temp\\950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe" 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe -
Drops desktop.ini file(s) 14 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\Desktop\desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 4 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.swf 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\TipBand.dll.mui 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STP 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DBGHELP.DLL 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SecStoreFile.ico 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.JPG 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PNG32.FLT 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\journal.dll 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\CsiSoap.dll 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PICTIM32.FLT 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\pencht.dll 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.EPS 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.WPG 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.SYD 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STC 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\NamedURLs.HxK 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1876 wrote to memory of 1292 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 29 PID 1876 wrote to memory of 1292 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 29 PID 1876 wrote to memory of 1292 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 29 PID 1876 wrote to memory of 1292 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 29 PID 1876 wrote to memory of 1680 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 30 PID 1876 wrote to memory of 1680 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 30 PID 1876 wrote to memory of 1680 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 30 PID 1876 wrote to memory of 1680 1876 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe 30 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe"C:\Users\Admin\AppData\Local\Temp\950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1876 -
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:1292
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\"."2⤵PID:1680
-