Analysis
-
max time kernel
151s -
max time network
170s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 04:45
Static task
static1
Behavioral task
behavioral1
Sample
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe
-
Size
352KB
-
MD5
761b5210153ca201ad516c19b4790bb5
-
SHA1
7d332ee352d4ce0c63d072ddc4d428c41a3641da
-
SHA256
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d
-
SHA512
033ad8cac6b36b18aac4bb8d5630475a7b2ca2f595d37729c1fcb30f76bdcc9b722c1b157d315926753d9d02d95c8cc2b11ac8e50d0415e99722c91a3788af88
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\Recovery+xckit.txt
Family
teslacrypt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-4096.
More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-4096 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/54C2FD5D13D3A2B7
2. http://kkd47eh4hdjshb5t.angortra.at/54C2FD5D13D3A2B7
3. http://ytrest84y5i456hghadefdsd.pontogrot.com/54C2FD5D13D3A2B7
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser
3. Type in the address bar: xlowfznrg4wf7dli.onion/54C2FD5D13D3A2B7
4. Follow the instructions on the site.
---------------- IMPORTANT INFORMATION------------------------
*-*-* Your personal pages:
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/54C2FD5D13D3A2B7
http://kkd47eh4hdjshb5t.angortra.at/54C2FD5D13D3A2B7
http://ytrest84y5i456hghadefdsd.pontogrot.com/54C2FD5D13D3A2B7
*-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/54C2FD5D13D3A2B7
URLs
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/54C2FD5D13D3A2B7
http://kkd47eh4hdjshb5t.angortra.at/54C2FD5D13D3A2B7
http://ytrest84y5i456hghadefdsd.pontogrot.com/54C2FD5D13D3A2B7
http://xlowfznrg4wf7dli.ONION/54C2FD5D13D3A2B7
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
Processes:
atxxinnvfeip.exepid Process 1748 atxxinnvfeip.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 1752 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
atxxinnvfeip.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run atxxinnvfeip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\lfxlnalkbewb = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\atxxinnvfeip.exe\"" atxxinnvfeip.exe -
Drops file in Program Files directory 64 IoCs
Processes:
atxxinnvfeip.exedescription ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Services\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png atxxinnvfeip.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\Recovery+xckit.txt atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Recovery+xckit.txt atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png atxxinnvfeip.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_100_percent.pak atxxinnvfeip.exe File opened for modification C:\Program Files\Google\Chrome\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png atxxinnvfeip.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lv.pak atxxinnvfeip.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt atxxinnvfeip.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\System\en-US\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png atxxinnvfeip.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\vi.pak atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fil.pak atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png atxxinnvfeip.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\en-US.pak atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\Recovery+xckit.txt atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png atxxinnvfeip.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Recovery+xckit.txt atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Internet Explorer\en-US\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\Recovery+xckit.txt atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\Recovery+xckit.png atxxinnvfeip.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\Recovery+xckit.html atxxinnvfeip.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Recovery+xckit.txt atxxinnvfeip.exe -
Drops file in Windows directory 2 IoCs
Processes:
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exedescription ioc Process File opened for modification C:\Windows\atxxinnvfeip.exe 3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe File created C:\Windows\atxxinnvfeip.exe 3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
atxxinnvfeip.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 atxxinnvfeip.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e atxxinnvfeip.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e atxxinnvfeip.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
atxxinnvfeip.exepid Process 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe 1748 atxxinnvfeip.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exeatxxinnvfeip.exeWMIC.exedescription pid Process Token: SeDebugPrivilege 1816 3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe Token: SeDebugPrivilege 1748 atxxinnvfeip.exe Token: SeIncreaseQuotaPrivilege 804 WMIC.exe Token: SeSecurityPrivilege 804 WMIC.exe Token: SeTakeOwnershipPrivilege 804 WMIC.exe Token: SeLoadDriverPrivilege 804 WMIC.exe Token: SeSystemProfilePrivilege 804 WMIC.exe Token: SeSystemtimePrivilege 804 WMIC.exe Token: SeProfSingleProcessPrivilege 804 WMIC.exe Token: SeIncBasePriorityPrivilege 804 WMIC.exe Token: SeCreatePagefilePrivilege 804 WMIC.exe Token: SeBackupPrivilege 804 WMIC.exe Token: SeRestorePrivilege 804 WMIC.exe Token: SeShutdownPrivilege 804 WMIC.exe Token: SeDebugPrivilege 804 WMIC.exe Token: SeSystemEnvironmentPrivilege 804 WMIC.exe Token: SeRemoteShutdownPrivilege 804 WMIC.exe Token: SeUndockPrivilege 804 WMIC.exe Token: SeManageVolumePrivilege 804 WMIC.exe Token: 33 804 WMIC.exe Token: 34 804 WMIC.exe Token: 35 804 WMIC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exeatxxinnvfeip.exedescription pid Process procid_target PID 1816 wrote to memory of 1748 1816 3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe 28 PID 1816 wrote to memory of 1748 1816 3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe 28 PID 1816 wrote to memory of 1748 1816 3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe 28 PID 1816 wrote to memory of 1748 1816 3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe 28 PID 1816 wrote to memory of 1752 1816 3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe 29 PID 1816 wrote to memory of 1752 1816 3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe 29 PID 1816 wrote to memory of 1752 1816 3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe 29 PID 1816 wrote to memory of 1752 1816 3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe 29 PID 1748 wrote to memory of 804 1748 atxxinnvfeip.exe 31 PID 1748 wrote to memory of 804 1748 atxxinnvfeip.exe 31 PID 1748 wrote to memory of 804 1748 atxxinnvfeip.exe 31 PID 1748 wrote to memory of 804 1748 atxxinnvfeip.exe 31 -
System policy modification 1 TTPs 2 IoCs
Processes:
atxxinnvfeip.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" atxxinnvfeip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System atxxinnvfeip.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe"C:\Users\Admin\AppData\Local\Temp\3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\atxxinnvfeip.exeC:\Windows\atxxinnvfeip.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1748 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:804
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\3CF3BC~1.EXE2⤵
- Deletes itself
PID:1752
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB
MD5761b5210153ca201ad516c19b4790bb5
SHA17d332ee352d4ce0c63d072ddc4d428c41a3641da
SHA2563cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d
SHA512033ad8cac6b36b18aac4bb8d5630475a7b2ca2f595d37729c1fcb30f76bdcc9b722c1b157d315926753d9d02d95c8cc2b11ac8e50d0415e99722c91a3788af88
-
Filesize
352KB
MD5761b5210153ca201ad516c19b4790bb5
SHA17d332ee352d4ce0c63d072ddc4d428c41a3641da
SHA2563cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d
SHA512033ad8cac6b36b18aac4bb8d5630475a7b2ca2f595d37729c1fcb30f76bdcc9b722c1b157d315926753d9d02d95c8cc2b11ac8e50d0415e99722c91a3788af88