3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb

General

Target

3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
Size

71KB
MD5

d8a44d2ed34b5fee7c8e24d998f805d9
SHA1

d8369cb0d8ccec95b2a49ba34aa7749b60998661
SHA256

3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb
SHA512

27974ffb60f4bb726cbc8269257b9485533fa33b3229667f4b7a7019fbd410252a1006df18fcf784cca85d48da277277b552815ee5d23d9f811c263e20d115ac

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\msocache\# DECRYPT FILES BLUESKY #.txt

Ransom Note

<<>> YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: -------------------------------------------------------------- 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the tor browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions --------------------------------------------------------------

URLs

http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion

Extracted

Path

C:\msocache\# DECRYPT FILES BLUESKY #.html

Ransom Note

<!DOCTYPE html> <html> <body> <center> B L U E S K Y YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the Tor Browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions on the website </center> </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.html

Ransom Note

B L U E S K Y YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the Tor Browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions on the website

URLs

http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion

Signatures

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe

description	ioc	process
File opened for modification	C:\users\admin\pictures\removewrite.tiff	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
File renamed	C:\Users\Admin\Pictures\RegisterSkip.png => C:\users\admin\pictures\registerskip.png.bluesky	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
File renamed	C:\Users\Admin\Pictures\RemoveWrite.tiff => C:\users\admin\pictures\removewrite.tiff.bluesky	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
File opened for modification	C:\users\admin\pictures\searchwatch.tiff	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
File renamed	C:\Users\Admin\Pictures\MeasureLock.crw => C:\users\admin\pictures\measurelock.crw.bluesky	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
File renamed	C:\Users\Admin\Pictures\MountRemove.crw => C:\users\admin\pictures\mountremove.crw.bluesky	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
File renamed	C:\Users\Admin\Pictures\SearchTrace.raw => C:\users\admin\pictures\searchtrace.raw.bluesky	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
File renamed	C:\Users\Admin\Pictures\SearchWatch.tiff => C:\users\admin\pictures\searchwatch.tiff.bluesky	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
File renamed	C:\Users\Admin\Pictures\SendConvertTo.tif => C:\users\admin\pictures\sendconvertto.tif.bluesky	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe

pid	process
1672	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
1672	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
1672	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e4effcea8ad801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2749DF01-F6DE-11EC-85FC-5EFF8A6DE4BC} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b000000000200000000001066000000010000200000009ff95eb4e8fe0392fcbe8461a87f38de7e10f729fdd9811e5de16e088a631fe1000000000e8000000002000020000000e28bbb54db24a0fd9a3d99f50df948a05d4009146228af491336962acc4fcc5790000000d4f8f47b9b0a50bb28dcedc79d0e8949605aafdccfa931e6e9b17fd1def5830ff34e408b5721b54842ed305ef02b07740e0c76e17583161c69733ba35b44337f7985476d03c86e97fd5c1dc638cd6d7a5a92e61ca38bbaa56cad974e3a70c5bf4a771a478e6df312fce20eda0a3a72600791789189e950c1b7ae9601f588b7a9189215897faede40167c014d5156549440000000166328d15ce18d550707264610a4da4d998f7c52784584cf8251b5f3863e8095ed72dec21455947201f34426b49fe267cac7396f7fc017dbb8ad35ad26bf2e99	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b0000000002000000000010660000000100002000000008e26bf7e6b643e043378970d9f0e2e518f4d82def9aeab26089c9b228f0c69a000000000e80000000020000200000009d3208b08159dc5e367f412b16e65ba6cd9af4fedf4026cbf0996579d97b2e1920000000fa2c286cf9a793be6cb35fcb4c155cb4f4e8a32fe1b507d2f7b0d4416bb5bdb140000000a530cf50dc00c62e3e1dc028aa774bbbbcbfdb5a935b0a7ed0c90d5ba26e4a22e7dd7bd62ea03e56e24d28701e25e5376f1195ff4643aafe9ea8dda6e7f8bca5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exechrome.exechrome.exe

pid	process
1672	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
1672	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
2028	chrome.exe
1304	chrome.exe
1304	chrome.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe

description pid process

Token: SeDebugPrivilege 1672 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe

description	pid	process
Token: SeDebugPrivilege	1672	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe

Suspicious use of FindShellTrayWindow 37 IoCs

Processes:

3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exeiexplore.exechrome.exe

pid	process
1672	3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
1700	iexplore.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1700 iexplore.exe
1700 iexplore.exe
1248 IEXPLORE.EXE
1248 IEXPLORE.EXE
1248 IEXPLORE.EXE
1248 IEXPLORE.EXE

pid	process
1700	iexplore.exe
1700	iexplore.exe
1248	IEXPLORE.EXE
1248	IEXPLORE.EXE
1248	IEXPLORE.EXE
1248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exechrome.exe

description	pid	process	target process
PID 1700 wrote to memory of 1248	1700	iexplore.exe	IEXPLORE.EXE
PID 1700 wrote to memory of 1248	1700	iexplore.exe	IEXPLORE.EXE
PID 1700 wrote to memory of 1248	1700	iexplore.exe	IEXPLORE.EXE
PID 1700 wrote to memory of 1248	1700	iexplore.exe	IEXPLORE.EXE
PID 1304 wrote to memory of 396	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 396	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 396	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 1676	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2028	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2028	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2028	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe
PID 1304 wrote to memory of 2024	1304	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe
"C:\Users\Admin\AppData\Local\Temp\3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1672

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.txt
1⤵
PID:2036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6924f50,0x7fef6924f60,0x7fef6924f70
2⤵
PID:396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1112 /prefetch:2
2⤵
PID:1676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1152 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1704 /prefetch:8
2⤵
PID:2024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:1
2⤵
PID:1500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:1
2⤵
PID:1740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
2⤵
PID:2064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1100,15920030754783725690,16412112306035549276,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3244 /prefetch:2
2⤵
PID:2148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.html
Filesize
1KB

MD5
e11f3f3365d89a4c7fc36cef867027a3

SHA1
19b793c72ee43b7edc0fb6f39d45e19b0e663a25

SHA256
85c2089ab426ab13cd9d11a80d7c0b92b416aab477db2a51b970179912f93e34

SHA512
3f80d9ff65add3e190cac3792ccfdbffe497d3554c38cd8cb93e7622165b590ca75ef185cab6d7474edd25b7340098568ad2f498a85baaca8cef2238c1b8f8a9

Download Submit
C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.txt
Filesize
985B

MD5
fdd933640e474cbf59bb3a855b4bb074

SHA1
1ee2241187dc358ab86325aaa455bb3e1f5fb40a

SHA256
fc35eb5b9ceb0245abf32764e77d70f9572d11f1bf606a369c8c914ee6fa9943

SHA512
01a6630760e2b309a19174594c1ee254c5f53d4a2a2e7c6527484442f9f5c6cf2bc5ffddf1cea6e3ed1f00650a41640e266e9e271e2ea82437ebd89aaa83015a

Download Submit
\??\pipe\crashpad_1304_NHIBXDCXAXHYKSID
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1672-54-0x00000000763C1000-0x00000000763C3000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads