Analysis
-
max time kernel
155s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08/07/2022, 03:25
Static task
static1
Behavioral task
behavioral1
Sample
422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe
-
Size
424KB
-
MD5
361442e2efc62488610da4bc74325c3e
-
SHA1
94e2023f686817001fbfd65d59ab32e226c16f66
-
SHA256
422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a
-
SHA512
f1c80c5b5528ad7abd688ffc6603f2087813946045cac3885d20e3f7b4cc03fd820adf5a4aa94d2d71b67dce4840d20f56256c99cc7cb8d744b7b8672a5d853a
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-1081944012-3634099177-1681222835-1000\_RECoVERY_+owvqf.txt
Family
teslacrypt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with AES
More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES
How did this happen ?
!!! Specially for your PC was generated personal AES KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/6726C8C09FCFD673
2. http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/6726C8C09FCFD673
3. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6726C8C09FCFD673
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser
3. Type in the address bar: xlowfznrg4wf7dli.onion/6726C8C09FCFD673
4. Follow the instructions on the site.
---------------- IMPORTANT INFORMATION------------------------
*-*-* Your personal pages:
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/6726C8C09FCFD673
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/6726C8C09FCFD673
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6726C8C09FCFD673
*-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/6726C8C09FCFD673
URLs
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/6726C8C09FCFD673
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/6726C8C09FCFD673
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6726C8C09FCFD673
http://xlowfznrg4wf7dli.ONION/6726C8C09FCFD673
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 1860 idemjtqxxyci.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation idemjtqxxyci.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run idemjtqxxyci.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vecsppvdhvqf = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\idemjtqxxyci.exe\"" idemjtqxxyci.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_RECoVERY_+owvqf.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.contrast-black_scale-100.png idemjtqxxyci.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-white_scale-125.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-ES\_RECoVERY_+owvqf.html idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_scale-125.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\LargeTile.scale-125.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-30_altform-lightunplated.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png idemjtqxxyci.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VC\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_RECoVERY_+owvqf.html idemjtqxxyci.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\az\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-30_altform-unplated_contrast-white.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\capture\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_RECoVERY_+owvqf.html idemjtqxxyci.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\_RECoVERY_+owvqf.html idemjtqxxyci.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\_RECoVERY_+owvqf.png idemjtqxxyci.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\_RECoVERY_+owvqf.html idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-24.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W6.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\_RECoVERY_+owvqf.html idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-80.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailSmallTile.scale-400.png idemjtqxxyci.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] idemjtqxxyci.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\_RECoVERY_+owvqf.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_scale-100.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\AppxMetadata\_RECoVERY_+owvqf.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_RECoVERY_+owvqf.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sunglasses.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteMediumTile.scale-200.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\168.png idemjtqxxyci.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\AE71BCDB-C16C-4D18-AD9F-49CE74FCC152\root\vfs\Windows\assembly\_RECoVERY_+owvqf.png idemjtqxxyci.exe File opened for modification C:\Program Files\Windows NT\TableTextService\en-US\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-125.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\_RECoVERY_+owvqf.html idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-100.png idemjtqxxyci.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GameBar_SmallTile.scale-125.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-150.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-32_contrast-white.png idemjtqxxyci.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\_RECoVERY_+owvqf.txt idemjtqxxyci.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\uk.pak idemjtqxxyci.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\_RECoVERY_+owvqf.html idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-150.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-24_altform-unplated.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-125.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-256.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-white_scale-200.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-16_altform-unplated_contrast-white.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-100.png idemjtqxxyci.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\_RECoVERY_+owvqf.png idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\_RECoVERY_+owvqf.html idemjtqxxyci.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\TriPeaks.Medium.png idemjtqxxyci.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\idemjtqxxyci.exe 422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe File opened for modification C:\Windows\idemjtqxxyci.exe 422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe 1860 idemjtqxxyci.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 2324 422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe Token: SeDebugPrivilege 1860 idemjtqxxyci.exe Token: SeIncreaseQuotaPrivilege 552 WMIC.exe Token: SeSecurityPrivilege 552 WMIC.exe Token: SeTakeOwnershipPrivilege 552 WMIC.exe Token: SeLoadDriverPrivilege 552 WMIC.exe Token: SeSystemProfilePrivilege 552 WMIC.exe Token: SeSystemtimePrivilege 552 WMIC.exe Token: SeProfSingleProcessPrivilege 552 WMIC.exe Token: SeIncBasePriorityPrivilege 552 WMIC.exe Token: SeCreatePagefilePrivilege 552 WMIC.exe Token: SeBackupPrivilege 552 WMIC.exe Token: SeRestorePrivilege 552 WMIC.exe Token: SeShutdownPrivilege 552 WMIC.exe Token: SeDebugPrivilege 552 WMIC.exe Token: SeSystemEnvironmentPrivilege 552 WMIC.exe Token: SeRemoteShutdownPrivilege 552 WMIC.exe Token: SeUndockPrivilege 552 WMIC.exe Token: SeManageVolumePrivilege 552 WMIC.exe Token: 33 552 WMIC.exe Token: 34 552 WMIC.exe Token: 35 552 WMIC.exe Token: 36 552 WMIC.exe Token: SeIncreaseQuotaPrivilege 552 WMIC.exe Token: SeSecurityPrivilege 552 WMIC.exe Token: SeTakeOwnershipPrivilege 552 WMIC.exe Token: SeLoadDriverPrivilege 552 WMIC.exe Token: SeSystemProfilePrivilege 552 WMIC.exe Token: SeSystemtimePrivilege 552 WMIC.exe Token: SeProfSingleProcessPrivilege 552 WMIC.exe Token: SeIncBasePriorityPrivilege 552 WMIC.exe Token: SeCreatePagefilePrivilege 552 WMIC.exe Token: SeBackupPrivilege 552 WMIC.exe Token: SeRestorePrivilege 552 WMIC.exe Token: SeShutdownPrivilege 552 WMIC.exe Token: SeDebugPrivilege 552 WMIC.exe Token: SeSystemEnvironmentPrivilege 552 WMIC.exe Token: SeRemoteShutdownPrivilege 552 WMIC.exe Token: SeUndockPrivilege 552 WMIC.exe Token: SeManageVolumePrivilege 552 WMIC.exe Token: 33 552 WMIC.exe Token: 34 552 WMIC.exe Token: 35 552 WMIC.exe Token: 36 552 WMIC.exe Token: SeBackupPrivilege 4800 vssvc.exe Token: SeRestorePrivilege 4800 vssvc.exe Token: SeAuditPrivilege 4800 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2324 wrote to memory of 1860 2324 422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe 79 PID 2324 wrote to memory of 1860 2324 422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe 79 PID 2324 wrote to memory of 1860 2324 422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe 79 PID 2324 wrote to memory of 4104 2324 422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe 80 PID 2324 wrote to memory of 4104 2324 422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe 80 PID 2324 wrote to memory of 4104 2324 422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe 80 PID 1860 wrote to memory of 552 1860 idemjtqxxyci.exe 81 PID 1860 wrote to memory of 552 1860 idemjtqxxyci.exe 81 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System idemjtqxxyci.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" idemjtqxxyci.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe"C:\Users\Admin\AppData\Local\Temp\422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\idemjtqxxyci.exeC:\Windows\idemjtqxxyci.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1860 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\422CEB~1.EXE2⤵PID:4104
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
424KB
MD5361442e2efc62488610da4bc74325c3e
SHA194e2023f686817001fbfd65d59ab32e226c16f66
SHA256422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a
SHA512f1c80c5b5528ad7abd688ffc6603f2087813946045cac3885d20e3f7b4cc03fd820adf5a4aa94d2d71b67dce4840d20f56256c99cc7cb8d744b7b8672a5d853a
-
Filesize
424KB
MD5361442e2efc62488610da4bc74325c3e
SHA194e2023f686817001fbfd65d59ab32e226c16f66
SHA256422ceb6b5b2270c248813080ce47977c7885af1c9fcd71e4c5a19f46f204446a
SHA512f1c80c5b5528ad7abd688ffc6603f2087813946045cac3885d20e3f7b4cc03fd820adf5a4aa94d2d71b67dce4840d20f56256c99cc7cb8d744b7b8672a5d853a