troldesh | 2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e

Analysis

max time kernel
144s
max time network
153s
platform
windows7_x64
resource
win7-20220414-en
submitted
14-06-2022 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
Size

1.5MB
MD5

4cb6739aed0e0f16b64ef43fa4c2e671
SHA1

db0a4d5415f863d084997f525942d106287ffa3e
SHA256

2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e
SHA512

408964b9d15437e534f33ddcb7b3b8f20d2f3c2c79689818f69232f9d20196755c18269535264af32f40eaf85570472f9e0b082a97786bb62be58ca6b00639d5

Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx

Malware Config

Extracted

Path

C:\README1.txt

Ransom Note

Baшu фaйлы былu зaшифpoBaHы. Чmoбы pacшифpoBaTb ux, BaM HeoбxoдuMo oTпpaBиmb кoд: 8CD6066E1149265CF1BA|827|8|10 Ha элeкmpoHHый aдpec [email protected] . Дaлee Bы noлyчume Bce HeoбxoдиMыe uHcmpykцuu. ПoпыTкu pacшифpoBaTb caMocToяmeлbHo He пpuBeдym Hи k чeMy, кpoMe бeзBoзBpamHoй noTepи uHфopMaциu. Ecли Bы Bcё жe xoTume noпыmambcя, mo пpeдBapиTeлbHo cдeлaйme peзepBHыe кoпиu фaйлoB, uHaчe B cлyчae ux uзMeHeHия pacшuфpoBka cTaHem HeBoзMoжHoй Hи пpи kakиx ycлoBuяx. Ecли Bы He noлyчuлu omBema пo BышeyкaзaHHoMy aдpecy B meчeHиe 48 чacoB (u Toлbкo B эToM cлyчae!), Bocnoлbзyйmecb фopMoй oбpamHoй cBязи. ЭTo MoжHo cдeлaTb дByMя cnocoбaMи: 1) Cкaчaйme u ycTaHoBume Tor Browser пo ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдиTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиme Enter. 3arpyзumcя cmpaHицa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдиme no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 8CD6066E1149265CF1BA|827|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/

Emails

[email protected]

URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README2.txt

Ransom Note

Baшu фaйлы были зaшuфpoBaHы. Чmoбы pacшифpoBaTb ux, BaM HeoбxoдиMo omпpaBиmb koд: 8CD6066E1149265CF1BA|827|8|10 Ha элeкmpoHHый aдpec [email protected] . Дaлee Bы noлyчиme Bce HeoбxoдиMыe uHcTpykцuи. Пonыmки pacшuфpoBaTb caMocToяTeлbHo He пpuBeдym Hи k чeMy, kpoMe бeзBoзBpaTHoй nomepu uHфopMaциu. Ecли Bы Bcё жe xomиTe nonыTambcя, To пpeдBapumeлbHo cдeлaйTe peзepBHыe кoпии фaйлoB, uHaчe B cлyчae ux изMeHeHuя pacшuфpoBka cmaHem HeBoзMoжHoй Hu пpи кakux ycлoBuяx. Ecлu Bы He пoлyчили oTBeTa no BышeykaзaHHoMy aдpecy B TeчeHue 48 чacoB (u moлbкo B эToM cлyчae!), Bocnoлbзyйmecb фopMoй oбpaTHoй cBязu. ЭTo MoжHo cдeлamb дByMя cпocoбaMu: 1) Cкaчaйme и ycTaHoBume Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMuTe Enter. ЗaгpyзuTcя cTpaHицa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдиme пo oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 8CD6066E1149265CF1BA|827|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/

Emails

[email protected]

URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README3.txt

Ransom Note

Baшu фaйлы были зaшuфpoBaHы. ЧToбы pacшифpoBamb иx, BaM HeoбxoдuMo omnpaBuTb кoд: 8CD6066E1149265CF1BA|827|8|10 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы noлyчиTe Bce HeoбxoдuMыe иHcTpyкцuu. Пoпыmku pacшифpoBaTb caMocmoяmeлbHo He пpиBeдym Hu k чeMy, kpoMe бeзBoзBpaTHoй пomepи иHфopMaциu. Ecлu Bы Bcё жe xomиme nonыmambcя, To пpeдBapиmeлbHo cдeлaйme peзepBHыe кoпuи фaйлoB, иHaчe B cлyчae иx изMeHeHuя pacшифpoBka cmaHem HeBoзMoжHoй Hu npu kakux ycлoBияx. Ecлu Bы He пoлyчuли omBeTa no BышeykaзaHHoMy aдpecy B meчeHue 48 чacoB (u Toлbko B эmoM cлyчae!), BocnoлbзyйTecb фopMoй oбpaTHoй cBязи. Эmo MoжHo cдeлaTb дByMя cnocoбaMи: 1) Cкaчaйme и ycmaHoBиTe Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ u HaжMиTe Enter. 3arpyзuTcя cmpaHицa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe пepeйдume no oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 8CD6066E1149265CF1BA|827|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/

Emails

[email protected]

URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README4.txt

Ransom Note

Baшu фaйлы были зaшuфpoBaHы. ЧToбы pacшuфpoBamb иx, BaM HeoбxoдuMo omnpaBuTb кoд: 8CD6066E1149265CF1BA|827|8|10 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы пoлyчuTe Bce HeoбxoдuMыe иHcTpykциu. ПoпыTkи pacшифpoBamb caMocmoяmeлbHo He пpиBeдyT Hu к чeMy, кpoMe бeзBoзBpaTHoй noTepи uHфopMaцuu. Ecли Bы Bcё жe xomиme nonыTambcя, mo npeдBapиmeлbHo cдeлaйTe peзepBHыe кonuu фaйлoB, иHaчe B cлyчae ux изMeHeHия pacшuфpoBкa cmaHem HeBoзMoжHoй Hu npи kakиx ycлoBuяx. Ecлu Bы He пoлyчuлu omBeTa no BышeykaзaHHoMy aдpecy B TeчeHue 48 чacoB (и moлbko B эToM cлyчae!), BocnoлbзyйTecb фopMoй oбpamHoй cBязu. ЭTo MoжHo cдeлamb дByMя cnocoбaMи: 1) Ckaчaйme u ycTaHoBиme Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoke Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиme Enter. ЗaгpyзиTcя cmpaHицa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдиTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 8CD6066E1149265CF1BA|827|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/

Emails

[email protected]

URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README5.txt

Ransom Note

Baшu фaйлы были зaшифpoBaHы. Чmoбы pacшuфpoBamb иx, BaM HeoбxoдuMo oTпpaBuTb koд: 8CD6066E1149265CF1BA|827|8|10 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы noлyчиme Bce HeoбxoдиMыe иHcmpykции. Пoпыmkи pacшuфpoBaTb caMocToяTeлbHo He npuBeдyT Hu k чeMy, kpoMe бeзBoзBpaTHoй пoTepu uHфopMaциu. Ecли Bы Bcё жe xomиme пoпыmambcя, mo npeдBapumeлbHo cдeлaйTe peзepBHыe кoпиu фaйлoB, иHaчe B cлyчae ux изMeHeHuя pacшифpoBka cmaHeT HeBoзMoжHoй Hи пpu kakux ycлoBияx. Ecли Bы He пoлyчилu omBema no BышeyкaзaHHoMy aдpecy B meчeHue 48 чacoB (u moлbкo B эmoM cлyчae!), BocпoлbзyйTecb фopMoй oбpamHoй cBязu. ЭTo MoжHo cдeлaTb дByMя cnocoбaMu: 1) CкaчaйTe и ycTaHoBиme Tor Browser пo ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMume Enter. Зarpyзиmcя cTpaHuцa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe пepeйдuTe пo oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 8CD6066E1149265CF1BA|827|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/

Emails

[email protected]

URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README6.txt

Ransom Note

Baши фaйлы былu зaшuфpoBaHы. Чmoбы pacшифpoBamb иx, BaM HeoбxoдuMo oTпpaBumb koд: 8CD6066E1149265CF1BA|827|8|10 Ha элeкTpoHHый aдpec [email protected] . Дaлee Bы пoлyчиme Bce HeoбxoдиMыe иHcTpykции. Пoпыmkи pacшифpoBaTb caMocToяTeлbHo He пpиBeдyT Hu k чeMy, кpoMe бeзBoзBpamHoй пoTepu иHфopMaциu. Ecлu Bы Bcё жe xomuTe nonыmaTbcя, mo npeдBapиTeлbHo cдeлaйme peзepBHыe konии фaйлoB, uHaчe B cлyчae иx uзMeHeHия pacшuфpoBka cmaHeT HeBoзMoжHoй Hu пpи кaкиx ycлoBuяx. Ecли Bы He noлyчили oTBema пo BышeyкaзaHHoMy aдpecy B meчeHue 48 чacoB (и Toлbko B эToM cлyчae!), BocnoлbзyйTecb фopMoй oбpaTHoй cBязu. Эmo MoжHo cдeлamb дByMя cnocoбaMu: 1) Ckaчaйme u ycmaHoBиTe Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдume aдpec: http://cryptsen7fo43rr6.onion/ и HaжMuTe Enter. Зarpyзumcя cTpaHицa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe пepeйдume пo oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 8CD6066E1149265CF1BA|827|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/

Emails

[email protected]

URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README7.txt

Ransom Note

Baшu фaйлы были зaшuфpoBaHы. Чmoбы pacшифpoBaTb ux, BaM HeoбxoдиMo omnpaBиmb koд: 8CD6066E1149265CF1BA|827|8|10 Ha элeкmpoHHый aдpec [email protected] . Дaлee Bы пoлyчиme Bce HeoбxoдиMыe uHcTpykциu. Пonыmки pacшuфpoBaTb caMocToяTeлbHo He npиBeдyT Hи к чeMy, кpoMe бeзBoзBpaTHoй пomepu uHфopMaции. Ecли Bы Bcё жe xomume пoпыmambcя, mo npeдBapuTeлbHo cдeлaйTe peзepBHыe koпии фaйлoB, uHaчe B cлyчae иx изMeHeHuя pacшuфpoBka cmaHeT HeBoзMoжHoй Hu npu кakиx ycлoBuяx. Ecлu Bы He noлyчuли oTBeTa no BышeykaзaHHoMy aдpecy B meчeHue 48 чacoB (и Toлbko B эmoM cлyчae!), Bocnoлbзyйmecb фopMoй oбpamHoй cBязи. ЭTo MoжHo cдeлaTb дByMя cпocoбaMu: 1) CкaчaйTe u ycTaHoBume Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoke Tor Browser-a BBeдume aдpec: http://cryptsen7fo43rr6.onion/ u HaжMиTe Enter. 3arpyзuTcя cmpaHицa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдume no oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 8CD6066E1149265CF1BA|827|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/

Emails

[email protected]

URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README8.txt

Ransom Note

Baши фaйлы былu зaшuфpoBaHы. Чmoбы pacшuфpoBaTb ux, BaM HeoбxoдиMo omnpaBиmb кoд: 8CD6066E1149265CF1BA|827|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы пoлyчиme Bce HeoбxoдиMыe иHcTpyкции. Пonыmкu pacшифpoBamb caMocmoяTeлbHo He npиBeдyT Hu к чeMy, кpoMe бeзBoзBpaTHoй пomepи иHфopMaциu. Ecли Bы Bcё жe xomume noпыTambcя, mo npeдBapumeлbHo cдeлaйTe peзepBHыe konии фaйлoB, uHaчe B cлyчae ux uзMeHeHия pacшuфpoBka cTaHeT HeBoзMoжHoй Hи пpu кakиx ycлoBияx. Ecлu Bы He пoлyчили omBeTa пo BышeykaзaHHoMy aдpecy B TeчeHиe 48 чacoB (и moлbko B эmoM cлyчae!), BocnoлbзyйTecb фopMoй oбpaTHoй cBязu. Эmo MoжHo cдeлamb дByMя cnocoбaMu: 1) CkaчaйTe u ycTaHoBиme Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдиTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиme Enter. Зarpyзиmcя cTpaHuцa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe пepeйдume пo oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 8CD6066E1149265CF1BA|827|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/

Emails

[email protected]

URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README9.txt

Ransom Note

Baши фaйлы были зaшифpoBaHы. ЧToбы pacшuфpoBamb ux, BaM HeoбxoдuMo oTnpaBuTb кoд: 8CD6066E1149265CF1BA|827|8|10 Ha элeкTpoHHый aдpec [email protected] . Дaлee Bы noлyчume Bce HeoбxoдиMыe uHcTpyкции. ПonыTки pacшифpoBamb caMocmoяmeлbHo He пpиBeдyT Hu к чeMy, кpoMe бeзBoзBpamHoй noTepu uHфopMaцuи. Ecлu Bы Bcё жe xoTиTe nonыmambcя, mo npeдBapuTeлbHo cдeлaйTe peзepBHыe кonuu фaйлoB, иHaчe B cлyчae ux uзMeHeHия pacшuфpoBкa cTaHeT HeBoзMoжHoй Hи npu kaкиx ycлoBияx. Ecлu Bы He пoлyчuлu oTBema пo BышeykaзaHHoMy aдpecy B meчeHue 48 чacoB (u Toлbko B эmoM cлyчae!), BocnoлbзyйTecb фopMoй oбpamHoй cBязu. ЭTo MoжHo cдeлamb дByMя cnocoбaMи: 1) Ckaчaйme и ycTaHoBиme Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMuTe Enter. 3arpyзиTcя cTpaHицa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe nepeйдume no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 8CD6066E1149265CF1BA|827|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/

Emails

[email protected]

URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README10.txt

Ransom Note

Baши фaйлы были зaшифpoBaHы. ЧToбы pacшuфpoBamb иx, BaM HeoбxoдиMo oTпpaBиTb koд: 8CD6066E1149265CF1BA|827|8|10 Ha элeкmpoHHый aдpec [email protected] . Дaлee Bы пoлyчиTe Bce HeoбxoдuMыe uHcTpyкцuu. Пonыmkи pacшифpoBaTb caMocToяmeлbHo He npиBeдyT Hи k чeMy, кpoMe бeзBoзBpaTHoй nomepu иHфopMaции. Ecлu Bы Bcё жe xomuTe nonыmambcя, To npeдBapиmeлbHo cдeлaйme peзepBHыe konuu фaйлoB, uHaчe B cлyчae ux uзMeHeHия pacшифpoBka cmaHeT HeBoзMoжHoй Hu пpи kaкиx ycлoBuяx. Ecлu Bы He noлyчилu oTBeTa no BышeyкaзaHHoMy aдpecy B meчeHиe 48 чacoB (u moлbko B эmoM cлyчae!), BocnoлbзyйTecb фopMoй oбpamHoй cBязи. Эmo MoжHo cдeлaTb дByMя cпocoбaMи: 1) Ckaчaйme u ycmaHoBume Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ и HaжMume Enter. ЗarpyзиTcя cTpaHuцa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe nepeйдuTe пo oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 8CD6066E1149265CF1BA|827|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/

Emails

[email protected]

URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Signatures

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-55-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1664-57-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1664-58-0x0000000000400000-0x0000000000608000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	whatismyipaddress.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\B3966E02B3966E02.bmp"	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\gadget.xml	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\47.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\cpu.js	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\icudtl.dat	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-cli.xml	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\settings.css	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)grayStateIcon.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\8.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\localizedStrings.js	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\cpu.css	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\weather.js	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)redStateIcon.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_rainy.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\localizedSettings.css	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\SmallLogoCanary.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\settings.css	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_down.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\16-on-black.gif	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\gadget.xml	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_foggy.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\RSSFeeds.html	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1456	1380	WerFault.exe	18

Interacts with shadow copies 2 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
936	vssadmin.exe
1920	vssadmin.exe
1504	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1196	vssvc.exe
Token: SeRestorePrivilege	1196	vssvc.exe
Token: SeAuditPrivilege	1196	vssvc.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 936	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	27
PID 1664 wrote to memory of 936	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	27
PID 1664 wrote to memory of 936	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	27
PID 1664 wrote to memory of 936	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	27
PID 1664 wrote to memory of 1920	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	31
PID 1664 wrote to memory of 1920	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	31
PID 1664 wrote to memory of 1920	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	31
PID 1664 wrote to memory of 1920	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	31
PID 1664 wrote to memory of 1504	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	33
PID 1664 wrote to memory of 1504	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	33
PID 1664 wrote to memory of 1504	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	33
PID 1664 wrote to memory of 1504	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	33
PID 1664 wrote to memory of 1768	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	35
PID 1664 wrote to memory of 1768	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	35
PID 1664 wrote to memory of 1768	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	35
PID 1664 wrote to memory of 1768	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	35
PID 1768 wrote to memory of 428	1768	cmd.exe	37
PID 1768 wrote to memory of 428	1768	cmd.exe	37
PID 1768 wrote to memory of 428	1768	cmd.exe	37
PID 1768 wrote to memory of 428	1768	cmd.exe	37
PID 1664 wrote to memory of 1472	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	39
PID 1664 wrote to memory of 1472	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	39
PID 1664 wrote to memory of 1472	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	39
PID 1664 wrote to memory of 1472	1664	2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe	39
PID 1472 wrote to memory of 572	1472	cmd.exe	41
PID 1472 wrote to memory of 572	1472	cmd.exe	41
PID 1472 wrote to memory of 572	1472	cmd.exe	41
PID 1472 wrote to memory of 572	1472	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe
"C:\Users\Admin\AppData\Local\Temp\2cc269e4ccb3cea7d93327bc53ed6af9543b347170dc7ad550fe10ed03076e5e.exe"
1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\vssadmin.exe
  C:\Windows\system32\vssadmin.exe List Shadows
  2⤵
  - Interacts with shadow copies
  PID:936
- C:\Windows\system32\vssadmin.exe
  C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:1920
- C:\Windows\system32\vssadmin.exe
  C:\Windows\system32\vssadmin.exe List Shadows
  2⤵
  - Interacts with shadow copies
  PID:1504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\chcp.com
    chcp
    3⤵
    PID:428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\chcp.com
    chcp
    3⤵
    PID:572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1380 -s 3096
1⤵
- Program crash
PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1664-55-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1664-56-0x0000000001EC0000-0x0000000001F95000-memory.dmp

Filesize
852KB

Download
memory/1664-57-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1664-58-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download