0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256

General

Target

0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
Size

604KB
MD5

5836ef38d2aa4152f5787e506951048c
SHA1

72e36c98291f7dad95fa2a77f0d843e6b931f0dd
SHA256

0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256
SHA512

4540097f7cead8f61bc71aed09564fb15da6e6b52dfe97a7e47431790241c5f13be5c6e7120326162fb54ed06b0a2618896cd91809595b04c519381121df71a2

Score

10^/10

evasion persistence ransomware suricata

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\_H_e_l_p_RECOVER_INSTRUCTIONS+ctn.txt

Ransom Note

__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/4195E03EE465B15B 2. http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/4195E03EE465B15B 3. http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/4195E03EE465B15B If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/4195E03EE465B15B 4. Follow the instructions on the site. !!! IMPORTANT INFORMATION: !!! Your personal pages: http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/4195E03EE465B15B http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/4195E03EE465B15B http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/4195E03EE465B15B !!! Your personal page Tor-Browser: fwgrhsao3aoml7ej.onion/4195E03EE465B15B !!! Your personal identification ID: 4195E03EE465B15B

URLs

http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/4195E03EE465B15B

http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/4195E03EE465B15B

http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/4195E03EE465B15B

http://fwgrhsao3aoml7ej.onion/4195E03EE465B15B

Signatures

suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

1748 bcdedit.exe
876 bcdedit.exe
612 bcdedit.exe
1604 bcdedit.exe
1620 bcdedit.exe

pid	process
1748	bcdedit.exe
876	bcdedit.exe
612	bcdedit.exe
1604	bcdedit.exe
1620	bcdedit.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

podnkea.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\addon_v57 = "C:\\Users\\Admin\\AppData\\Roaming\\podnkea.exe"	podnkea.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	podnkea.exe

Executes dropped EXE 2 IoCs

Processes:

podnkea.exepodnkea.exe

pid process

1524 podnkea.exe
1168 podnkea.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

320 cmd.exe

pid	process
1524	podnkea.exe
1168	podnkea.exe

pid	process
320	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe

pid	process
1580	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
1580	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exepodnkea.exe

description	pid	process	target process
PID 904 set thread context of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 1524 set thread context of 1168	1524	podnkea.exe	podnkea.exe

Drops file in Program Files directory 1 IoCs

Processes:

podnkea.exe

description ioc process

File opened for modification C:\Program Files\7-Zip\History.txt podnkea.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1744 vssadmin.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\History.txt	podnkea.exe

pid	process
1744	vssadmin.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

podnkea.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	podnkea.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	podnkea.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

podnkea.exe

pid	process
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe
1168	podnkea.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exepodnkea.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1580	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
Token: SeDebugPrivilege	1168	podnkea.exe
Token: SeBackupPrivilege	1352	vssvc.exe
Token: SeRestorePrivilege	1352	vssvc.exe
Token: SeAuditPrivilege	1352	vssvc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exepodnkea.exe

pid process

904 0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
1524 podnkea.exe

pid	process
904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
1524	podnkea.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exepodnkea.exepodnkea.exe

description	pid	process	target process
PID 904 wrote to memory of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 904 wrote to memory of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 904 wrote to memory of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 904 wrote to memory of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 904 wrote to memory of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 904 wrote to memory of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 904 wrote to memory of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 904 wrote to memory of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 904 wrote to memory of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 904 wrote to memory of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 904 wrote to memory of 1580	904	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
PID 1580 wrote to memory of 1524	1580	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	podnkea.exe
PID 1580 wrote to memory of 1524	1580	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	podnkea.exe
PID 1580 wrote to memory of 1524	1580	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	podnkea.exe
PID 1580 wrote to memory of 1524	1580	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	podnkea.exe
PID 1580 wrote to memory of 320	1580	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	cmd.exe
PID 1580 wrote to memory of 320	1580	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	cmd.exe
PID 1580 wrote to memory of 320	1580	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	cmd.exe
PID 1580 wrote to memory of 320	1580	0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe	cmd.exe
PID 1524 wrote to memory of 1168	1524	podnkea.exe	podnkea.exe
PID 1524 wrote to memory of 1168	1524	podnkea.exe	podnkea.exe
PID 1524 wrote to memory of 1168	1524	podnkea.exe	podnkea.exe
PID 1524 wrote to memory of 1168	1524	podnkea.exe	podnkea.exe
PID 1524 wrote to memory of 1168	1524	podnkea.exe	podnkea.exe
PID 1524 wrote to memory of 1168	1524	podnkea.exe	podnkea.exe
PID 1524 wrote to memory of 1168	1524	podnkea.exe	podnkea.exe
PID 1524 wrote to memory of 1168	1524	podnkea.exe	podnkea.exe
PID 1524 wrote to memory of 1168	1524	podnkea.exe	podnkea.exe
PID 1524 wrote to memory of 1168	1524	podnkea.exe	podnkea.exe
PID 1524 wrote to memory of 1168	1524	podnkea.exe	podnkea.exe
PID 1168 wrote to memory of 1748	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1748	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1748	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1748	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1744	1168	podnkea.exe	vssadmin.exe
PID 1168 wrote to memory of 1744	1168	podnkea.exe	vssadmin.exe
PID 1168 wrote to memory of 1744	1168	podnkea.exe	vssadmin.exe
PID 1168 wrote to memory of 1744	1168	podnkea.exe	vssadmin.exe
PID 1168 wrote to memory of 876	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 876	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 876	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 876	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 612	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 612	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 612	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 612	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1604	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1604	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1604	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1604	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1620	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1620	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1620	1168	podnkea.exe	bcdedit.exe
PID 1168 wrote to memory of 1620	1168	podnkea.exe	bcdedit.exe

C:\Users\Admin\AppData\Local\Temp\0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
"C:\Users\Admin\AppData\Local\Temp\0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
  "C:\Users\Admin\AppData\Local\Temp\0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Users\Admin\AppData\Roaming\podnkea.exe
    C:\Users\Admin\AppData\Roaming\podnkea.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Users\Admin\AppData\Roaming\podnkea.exe
      C:\Users\Admin\AppData\Roaming\podnkea.exe
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} bootems off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1748
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:1744
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} advancedoptions off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:876
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} optionsedit off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:612
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1604
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} recoveryenabled off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\0E3EEE~1.EXE
    3⤵
    - Deletes itself
    PID:320

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Install Root Certificate

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\podnkea.exe

Filesize
604KB

MD5
5836ef38d2aa4152f5787e506951048c

SHA1
72e36c98291f7dad95fa2a77f0d843e6b931f0dd

SHA256
0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256

SHA512
4540097f7cead8f61bc71aed09564fb15da6e6b52dfe97a7e47431790241c5f13be5c6e7120326162fb54ed06b0a2618896cd91809595b04c519381121df71a2

Download Submit
C:\Users\Admin\AppData\Roaming\podnkea.exe

Filesize
604KB

MD5
5836ef38d2aa4152f5787e506951048c

SHA1
72e36c98291f7dad95fa2a77f0d843e6b931f0dd

SHA256
0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256

SHA512
4540097f7cead8f61bc71aed09564fb15da6e6b52dfe97a7e47431790241c5f13be5c6e7120326162fb54ed06b0a2618896cd91809595b04c519381121df71a2

Download Submit
C:\Users\Admin\AppData\Roaming\podnkea.exe

Filesize
604KB

MD5
5836ef38d2aa4152f5787e506951048c

SHA1
72e36c98291f7dad95fa2a77f0d843e6b931f0dd

SHA256
0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256

SHA512
4540097f7cead8f61bc71aed09564fb15da6e6b52dfe97a7e47431790241c5f13be5c6e7120326162fb54ed06b0a2618896cd91809595b04c519381121df71a2

Download Submit
\Users\Admin\AppData\Roaming\podnkea.exe

Filesize
604KB

MD5
5836ef38d2aa4152f5787e506951048c

SHA1
72e36c98291f7dad95fa2a77f0d843e6b931f0dd

SHA256
0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256

SHA512
4540097f7cead8f61bc71aed09564fb15da6e6b52dfe97a7e47431790241c5f13be5c6e7120326162fb54ed06b0a2618896cd91809595b04c519381121df71a2

Download Submit
\Users\Admin\AppData\Roaming\podnkea.exe

Filesize
604KB

MD5
5836ef38d2aa4152f5787e506951048c

SHA1
72e36c98291f7dad95fa2a77f0d843e6b931f0dd

SHA256
0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256

SHA512
4540097f7cead8f61bc71aed09564fb15da6e6b52dfe97a7e47431790241c5f13be5c6e7120326162fb54ed06b0a2618896cd91809595b04c519381121df71a2

Download Submit
memory/320-78-0x0000000000000000-mapping.dmp

Download
memory/612-102-0x0000000000000000-mapping.dmp

Download
memory/876-101-0x0000000000000000-mapping.dmp

Download
memory/904-54-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/904-55-0x0000000000260000-0x0000000000263000-memory.dmp

Filesize
12KB

Download
memory/904-69-0x0000000000260000-0x0000000000263000-memory.dmp

Filesize
12KB

Download
memory/1168-97-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1168-98-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1168-96-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1168-92-0x000000000045A736-mapping.dmp

Download
memory/1524-75-0x0000000000000000-mapping.dmp

Download
memory/1580-61-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1580-72-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1580-79-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1580-56-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1580-71-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1580-66-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1580-67-0x000000000045A736-mapping.dmp

Download
memory/1580-57-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1580-59-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1580-63-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1580-64-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1604-103-0x0000000000000000-mapping.dmp

Download
memory/1620-104-0x0000000000000000-mapping.dmp

Download
memory/1744-100-0x0000000000000000-mapping.dmp

Download
memory/1748-99-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads