Analysis
-
max time kernel
174s -
max time network
212s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25/06/2022, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe
-
Size
342KB
-
MD5
012427fa5009d5676f160dce7eb80eea
-
SHA1
00d38f07f9fcdd6a8873244d1eb9946935525b7f
-
SHA256
3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c
-
SHA512
defe32114c0ea31638825c001d9b5d4079ba7e6cbb0f65989053b08b9f5785d5d7471ec37dd5fc3d5632d2d858cd98a41319675721cd87c4bc4f1dbb2c9ad72c
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\_RECoVERY_+pjuli.txt
Family
teslacrypt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with AES
More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES
How did this happen ?
!!! Specially for your PC was generated personal AES KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/6E91DEB7F5CC7C6
2. http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/6E91DEB7F5CC7C6
3. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6E91DEB7F5CC7C6
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser
3. Type in the address bar: xlowfznrg4wf7dli.onion/6E91DEB7F5CC7C6
4. Follow the instructions on the site.
---------------- IMPORTANT INFORMATION------------------------
*-*-* Your personal pages:
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/6E91DEB7F5CC7C6
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/6E91DEB7F5CC7C6
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6E91DEB7F5CC7C6
*-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/6E91DEB7F5CC7C6
URLs
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/6E91DEB7F5CC7C6
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/6E91DEB7F5CC7C6
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6E91DEB7F5CC7C6
http://xlowfznrg4wf7dli.ONION/6E91DEB7F5CC7C6
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 1164 mxyusohsacmc.exe -
Deletes itself 1 IoCs
pid Process 1876 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run mxyusohsacmc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\dpvgkfcxemdk = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\mxyusohsacmc.exe\"" mxyusohsacmc.exe -
Drops file in Program Files directory 46 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\fr.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\History.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt mxyusohsacmc.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt mxyusohsacmc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\mxyusohsacmc.exe 3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe File opened for modification C:\Windows\mxyusohsacmc.exe 3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 mxyusohsacmc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 mxyusohsacmc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 mxyusohsacmc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 mxyusohsacmc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 mxyusohsacmc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 mxyusohsacmc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe 1164 mxyusohsacmc.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 1936 3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe Token: SeDebugPrivilege 1164 mxyusohsacmc.exe Token: SeIncreaseQuotaPrivilege 1440 WMIC.exe Token: SeSecurityPrivilege 1440 WMIC.exe Token: SeTakeOwnershipPrivilege 1440 WMIC.exe Token: SeLoadDriverPrivilege 1440 WMIC.exe Token: SeSystemProfilePrivilege 1440 WMIC.exe Token: SeSystemtimePrivilege 1440 WMIC.exe Token: SeProfSingleProcessPrivilege 1440 WMIC.exe Token: SeIncBasePriorityPrivilege 1440 WMIC.exe Token: SeCreatePagefilePrivilege 1440 WMIC.exe Token: SeBackupPrivilege 1440 WMIC.exe Token: SeRestorePrivilege 1440 WMIC.exe Token: SeShutdownPrivilege 1440 WMIC.exe Token: SeDebugPrivilege 1440 WMIC.exe Token: SeSystemEnvironmentPrivilege 1440 WMIC.exe Token: SeRemoteShutdownPrivilege 1440 WMIC.exe Token: SeUndockPrivilege 1440 WMIC.exe Token: SeManageVolumePrivilege 1440 WMIC.exe Token: 33 1440 WMIC.exe Token: 34 1440 WMIC.exe Token: 35 1440 WMIC.exe Token: SeIncreaseQuotaPrivilege 1440 WMIC.exe Token: SeSecurityPrivilege 1440 WMIC.exe Token: SeTakeOwnershipPrivilege 1440 WMIC.exe Token: SeLoadDriverPrivilege 1440 WMIC.exe Token: SeSystemProfilePrivilege 1440 WMIC.exe Token: SeSystemtimePrivilege 1440 WMIC.exe Token: SeProfSingleProcessPrivilege 1440 WMIC.exe Token: SeIncBasePriorityPrivilege 1440 WMIC.exe Token: SeCreatePagefilePrivilege 1440 WMIC.exe Token: SeBackupPrivilege 1440 WMIC.exe Token: SeRestorePrivilege 1440 WMIC.exe Token: SeShutdownPrivilege 1440 WMIC.exe Token: SeDebugPrivilege 1440 WMIC.exe Token: SeSystemEnvironmentPrivilege 1440 WMIC.exe Token: SeRemoteShutdownPrivilege 1440 WMIC.exe Token: SeUndockPrivilege 1440 WMIC.exe Token: SeManageVolumePrivilege 1440 WMIC.exe Token: 33 1440 WMIC.exe Token: 34 1440 WMIC.exe Token: 35 1440 WMIC.exe Token: SeBackupPrivilege 392 vssvc.exe Token: SeRestorePrivilege 392 vssvc.exe Token: SeAuditPrivilege 392 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1936 wrote to memory of 1164 1936 3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe 28 PID 1936 wrote to memory of 1164 1936 3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe 28 PID 1936 wrote to memory of 1164 1936 3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe 28 PID 1936 wrote to memory of 1164 1936 3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe 28 PID 1936 wrote to memory of 1876 1936 3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe 29 PID 1936 wrote to memory of 1876 1936 3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe 29 PID 1936 wrote to memory of 1876 1936 3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe 29 PID 1936 wrote to memory of 1876 1936 3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe 29 PID 1164 wrote to memory of 1440 1164 mxyusohsacmc.exe 31 PID 1164 wrote to memory of 1440 1164 mxyusohsacmc.exe 31 PID 1164 wrote to memory of 1440 1164 mxyusohsacmc.exe 31 PID 1164 wrote to memory of 1440 1164 mxyusohsacmc.exe 31 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System mxyusohsacmc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" mxyusohsacmc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe"C:\Users\Admin\AppData\Local\Temp\3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\mxyusohsacmc.exeC:\Windows\mxyusohsacmc.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1164 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\3A1465~1.EXE2⤵
- Deletes itself
PID:1876
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:392
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342KB
MD5012427fa5009d5676f160dce7eb80eea
SHA100d38f07f9fcdd6a8873244d1eb9946935525b7f
SHA2563a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c
SHA512defe32114c0ea31638825c001d9b5d4079ba7e6cbb0f65989053b08b9f5785d5d7471ec37dd5fc3d5632d2d858cd98a41319675721cd87c4bc4f1dbb2c9ad72c
-
Filesize
342KB
MD5012427fa5009d5676f160dce7eb80eea
SHA100d38f07f9fcdd6a8873244d1eb9946935525b7f
SHA2563a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c
SHA512defe32114c0ea31638825c001d9b5d4079ba7e6cbb0f65989053b08b9f5785d5d7471ec37dd5fc3d5632d2d858cd98a41319675721cd87c4bc4f1dbb2c9ad72c