Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 21:16
Static task
static1
Behavioral task
behavioral1
Sample
ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe
-
Size
30KB
-
MD5
910635e580fd5de4759968959f6d0bb4
-
SHA1
934fbaeebdfe9c7c5c21696bd4e288094c44eef0
-
SHA256
ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a
-
SHA512
76411000d85d8634e1efefd533fac7defb65a7278820c2df64c8b6eb6d92d03f382025afeb5e8a6e99f9de5b8b36a25106b279818c2221fae4c187c5774fd4be
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\HIT BY RANSOMWARE.txt
Ransom Note
---YOU'VE BEEN HIT BY A RANSOMWARE---
In order to decrypt your files, you must decompile the ransomware (which is easy) and find out the encryption method (easy aswell).
Next time, think before you execute. Your next ransomware could'nt be that easy to crack and you would lose all your files :(
The following parts of your disk have been encrypted:
- Program Files & Program Files (x86)
- System Root (Main Drive)
- Application Data
- Userprofile Files
You don't have to send any money to anybody, so be happy :)
You're still able to use your computer but you'll need to reinstall all programs.
---YOU'VE BEEN HIT BY A RANSOMWARE---
Signatures
-
T1Happy
T1Happy ransomware is a cryptovirus that behaves different than its counterparts.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Disables RegEdit via registry modification
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1088 takeown.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe" ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe" ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe -
Drops desktop.ini file(s) 17 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\Desktop\desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 4 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OISGRAPH.DLL ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\TWORIENT.DLL ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.CNT ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_te.dll ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA000C.DLL ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Modern.dotx ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\TAB_ON.GIF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187815.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\LATIN1.SHP ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_K_COL.HXK ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OWSCLT.DLL ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01141_.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02748G.GIF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21375_.GIF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIcon.jpg ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BANNER.DPV ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Foundry.thmx ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47B.GIF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212219.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\UserControl.zip ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_settings.png ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02280_.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\gadget.xml ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.SharePoint.BusinessData.Administration.Client.xml ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_GreenTea.gif ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00255_.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\PREVIEW.GIF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107154.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292278.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDCNCL.CFG ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.JP.XML ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\picturePuzzle.js ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\PREVIEW.GIF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341653.JPG ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400003.PNG ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151041.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-down.png ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099171.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00238_.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Apex.thmx ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImages.jpg ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00902_.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187647.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MLSHEXT.DLL ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV.HXS ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\APA.XSL ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.HTM ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianMergeLetter.Dotx ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152698.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196354.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0234376.WMF ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe Token: SeIncreaseQuotaPrivilege 1980 WMIC.exe Token: SeSecurityPrivilege 1980 WMIC.exe Token: SeTakeOwnershipPrivilege 1980 WMIC.exe Token: SeLoadDriverPrivilege 1980 WMIC.exe Token: SeSystemProfilePrivilege 1980 WMIC.exe Token: SeSystemtimePrivilege 1980 WMIC.exe Token: SeProfSingleProcessPrivilege 1980 WMIC.exe Token: SeIncBasePriorityPrivilege 1980 WMIC.exe Token: SeCreatePagefilePrivilege 1980 WMIC.exe Token: SeBackupPrivilege 1980 WMIC.exe Token: SeRestorePrivilege 1980 WMIC.exe Token: SeShutdownPrivilege 1980 WMIC.exe Token: SeDebugPrivilege 1980 WMIC.exe Token: SeSystemEnvironmentPrivilege 1980 WMIC.exe Token: SeRemoteShutdownPrivilege 1980 WMIC.exe Token: SeUndockPrivilege 1980 WMIC.exe Token: SeManageVolumePrivilege 1980 WMIC.exe Token: 33 1980 WMIC.exe Token: 34 1980 WMIC.exe Token: 35 1980 WMIC.exe Token: SeIncreaseQuotaPrivilege 1980 WMIC.exe Token: SeSecurityPrivilege 1980 WMIC.exe Token: SeTakeOwnershipPrivilege 1980 WMIC.exe Token: SeLoadDriverPrivilege 1980 WMIC.exe Token: SeSystemProfilePrivilege 1980 WMIC.exe Token: SeSystemtimePrivilege 1980 WMIC.exe Token: SeProfSingleProcessPrivilege 1980 WMIC.exe Token: SeIncBasePriorityPrivilege 1980 WMIC.exe Token: SeCreatePagefilePrivilege 1980 WMIC.exe Token: SeBackupPrivilege 1980 WMIC.exe Token: SeRestorePrivilege 1980 WMIC.exe Token: SeShutdownPrivilege 1980 WMIC.exe Token: SeDebugPrivilege 1980 WMIC.exe Token: SeSystemEnvironmentPrivilege 1980 WMIC.exe Token: SeRemoteShutdownPrivilege 1980 WMIC.exe Token: SeUndockPrivilege 1980 WMIC.exe Token: SeManageVolumePrivilege 1980 WMIC.exe Token: 33 1980 WMIC.exe Token: 34 1980 WMIC.exe Token: 35 1980 WMIC.exe Token: SeBackupPrivilege 1124 vssvc.exe Token: SeRestorePrivilege 1124 vssvc.exe Token: SeAuditPrivilege 1124 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1100 wrote to memory of 1980 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 27 PID 1100 wrote to memory of 1980 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 27 PID 1100 wrote to memory of 1980 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 27 PID 1100 wrote to memory of 1980 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 27 PID 1100 wrote to memory of 240 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 29 PID 1100 wrote to memory of 240 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 29 PID 1100 wrote to memory of 240 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 29 PID 1100 wrote to memory of 240 1100 ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe 29 PID 240 wrote to memory of 1088 240 cmd.exe 31 PID 240 wrote to memory of 1088 240 cmd.exe 31 PID 240 wrote to memory of 1088 240 cmd.exe 31 PID 240 wrote to memory of 1088 240 cmd.exe 31 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe"C:\Users\Admin\AppData\Local\Temp\ef0b62c34bac3ea9c196ce4f96ac4aca30d91378dc465abf44a7871aa9e6775a.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1100 -
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\"."2⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\"."3⤵
- Modifies file permissions
PID:1088
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1124