Analysis
-
max time kernel
152s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-07-2022 12:31
Static task
static1
Behavioral task
behavioral1
Sample
4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe
-
Size
340KB
-
MD5
74cdb42da9136b13a07e00a2bfc60323
-
SHA1
f4e02831a49a93bbba08986c896ef189cd76a755
-
SHA256
4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518
-
SHA512
f36dffecf9a16427597275adbf9c6fbc4c672d0e987ea1fcfee043dc2df608601f088fe5e9f1e8a50a882bc5068afcf082c456f399cde7cc8a139a07897e22bb
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-790309383-526510583-3802439154-1000\_RECOVERY_+pavbl.txt
Family
teslacrypt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with AES
More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES
How did this happen ?
!!! Specially for your PC was generated personal AES KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/CC9869EFD9D43EA6
2. http://tes543berda73i48fsdfsd.keratadze.at/CC9869EFD9D43EA6
3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/CC9869EFD9D43EA6
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser
3. Type in the address bar: xlowfznrg4wf7dli.onion/CC9869EFD9D43EA6
4. Follow the instructions on the site.
---------------- IMPORTANT INFORMATION------------------------
*-*-* Your personal pages:
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/CC9869EFD9D43EA6
http://tes543berda73i48fsdfsd.keratadze.at/CC9869EFD9D43EA6
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/CC9869EFD9D43EA6
*-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/CC9869EFD9D43EA6
URLs
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/CC9869EFD9D43EA6
http://tes543berda73i48fsdfsd.keratadze.at/CC9869EFD9D43EA6
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/CC9869EFD9D43EA6
http://xlowfznrg4wf7dli.ONION/CC9869EFD9D43EA6
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
xsvcxnsundtl.exexsvcxnsundtl.exepid Process 2044 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 2008 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
xsvcxnsundtl.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run xsvcxnsundtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\bvcltehfktbe = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\xsvcxnsundtl.exe\"" xsvcxnsundtl.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exexsvcxnsundtl.exedescription pid Process procid_target PID 1040 set thread context of 1836 1040 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 27 PID 2044 set thread context of 1384 2044 xsvcxnsundtl.exe 31 -
Drops file in Program Files directory 64 IoCs
Processes:
xsvcxnsundtl.exedescription ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\_RECOVERY_+pavbl.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\_RECOVERY_+pavbl.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\_RECOVERY_+pavbl.png xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\_RECOVERY_+pavbl.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png xsvcxnsundtl.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_RECOVERY_+pavbl.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\_RECOVERY_+pavbl.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png xsvcxnsundtl.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\_RECOVERY_+pavbl.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\_RECOVERY_+pavbl.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\_RECOVERY_+pavbl.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\_RECOVERY_+pavbl.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\_RECOVERY_+pavbl.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\_RECOVERY_+pavbl.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\_RECOVERY_+pavbl.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\_RECOVERY_+pavbl.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\_RECOVERY_+pavbl.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_100_percent.pak xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\_RECOVERY_+pavbl.png xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\_RECOVERY_+pavbl.html xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png xsvcxnsundtl.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png xsvcxnsundtl.exe -
Drops file in Windows directory 2 IoCs
Processes:
4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exedescription ioc Process File created C:\Windows\xsvcxnsundtl.exe 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe File opened for modification C:\Windows\xsvcxnsundtl.exe 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
xsvcxnsundtl.exedescription ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 xsvcxnsundtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 xsvcxnsundtl.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 xsvcxnsundtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 xsvcxnsundtl.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 xsvcxnsundtl.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 xsvcxnsundtl.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
xsvcxnsundtl.exepid Process 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe 1384 xsvcxnsundtl.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exexsvcxnsundtl.exeWMIC.exevssvc.exedescription pid Process Token: SeDebugPrivilege 1836 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe Token: SeDebugPrivilege 1384 xsvcxnsundtl.exe Token: SeIncreaseQuotaPrivilege 1660 WMIC.exe Token: SeSecurityPrivilege 1660 WMIC.exe Token: SeTakeOwnershipPrivilege 1660 WMIC.exe Token: SeLoadDriverPrivilege 1660 WMIC.exe Token: SeSystemProfilePrivilege 1660 WMIC.exe Token: SeSystemtimePrivilege 1660 WMIC.exe Token: SeProfSingleProcessPrivilege 1660 WMIC.exe Token: SeIncBasePriorityPrivilege 1660 WMIC.exe Token: SeCreatePagefilePrivilege 1660 WMIC.exe Token: SeBackupPrivilege 1660 WMIC.exe Token: SeRestorePrivilege 1660 WMIC.exe Token: SeShutdownPrivilege 1660 WMIC.exe Token: SeDebugPrivilege 1660 WMIC.exe Token: SeSystemEnvironmentPrivilege 1660 WMIC.exe Token: SeRemoteShutdownPrivilege 1660 WMIC.exe Token: SeUndockPrivilege 1660 WMIC.exe Token: SeManageVolumePrivilege 1660 WMIC.exe Token: 33 1660 WMIC.exe Token: 34 1660 WMIC.exe Token: 35 1660 WMIC.exe Token: SeIncreaseQuotaPrivilege 1660 WMIC.exe Token: SeSecurityPrivilege 1660 WMIC.exe Token: SeTakeOwnershipPrivilege 1660 WMIC.exe Token: SeLoadDriverPrivilege 1660 WMIC.exe Token: SeSystemProfilePrivilege 1660 WMIC.exe Token: SeSystemtimePrivilege 1660 WMIC.exe Token: SeProfSingleProcessPrivilege 1660 WMIC.exe Token: SeIncBasePriorityPrivilege 1660 WMIC.exe Token: SeCreatePagefilePrivilege 1660 WMIC.exe Token: SeBackupPrivilege 1660 WMIC.exe Token: SeRestorePrivilege 1660 WMIC.exe Token: SeShutdownPrivilege 1660 WMIC.exe Token: SeDebugPrivilege 1660 WMIC.exe Token: SeSystemEnvironmentPrivilege 1660 WMIC.exe Token: SeRemoteShutdownPrivilege 1660 WMIC.exe Token: SeUndockPrivilege 1660 WMIC.exe Token: SeManageVolumePrivilege 1660 WMIC.exe Token: 33 1660 WMIC.exe Token: 34 1660 WMIC.exe Token: 35 1660 WMIC.exe Token: SeBackupPrivilege 840 vssvc.exe Token: SeRestorePrivilege 840 vssvc.exe Token: SeAuditPrivilege 840 vssvc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exexsvcxnsundtl.exexsvcxnsundtl.exedescription pid Process procid_target PID 1040 wrote to memory of 1836 1040 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 27 PID 1040 wrote to memory of 1836 1040 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 27 PID 1040 wrote to memory of 1836 1040 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 27 PID 1040 wrote to memory of 1836 1040 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 27 PID 1040 wrote to memory of 1836 1040 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 27 PID 1040 wrote to memory of 1836 1040 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 27 PID 1040 wrote to memory of 1836 1040 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 27 PID 1040 wrote to memory of 1836 1040 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 27 PID 1040 wrote to memory of 1836 1040 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 27 PID 1040 wrote to memory of 1836 1040 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 27 PID 1836 wrote to memory of 2044 1836 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 28 PID 1836 wrote to memory of 2044 1836 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 28 PID 1836 wrote to memory of 2044 1836 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 28 PID 1836 wrote to memory of 2044 1836 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 28 PID 1836 wrote to memory of 2008 1836 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 29 PID 1836 wrote to memory of 2008 1836 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 29 PID 1836 wrote to memory of 2008 1836 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 29 PID 1836 wrote to memory of 2008 1836 4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe 29 PID 2044 wrote to memory of 1384 2044 xsvcxnsundtl.exe 31 PID 2044 wrote to memory of 1384 2044 xsvcxnsundtl.exe 31 PID 2044 wrote to memory of 1384 2044 xsvcxnsundtl.exe 31 PID 2044 wrote to memory of 1384 2044 xsvcxnsundtl.exe 31 PID 2044 wrote to memory of 1384 2044 xsvcxnsundtl.exe 31 PID 2044 wrote to memory of 1384 2044 xsvcxnsundtl.exe 31 PID 2044 wrote to memory of 1384 2044 xsvcxnsundtl.exe 31 PID 2044 wrote to memory of 1384 2044 xsvcxnsundtl.exe 31 PID 2044 wrote to memory of 1384 2044 xsvcxnsundtl.exe 31 PID 2044 wrote to memory of 1384 2044 xsvcxnsundtl.exe 31 PID 1384 wrote to memory of 1660 1384 xsvcxnsundtl.exe 32 PID 1384 wrote to memory of 1660 1384 xsvcxnsundtl.exe 32 PID 1384 wrote to memory of 1660 1384 xsvcxnsundtl.exe 32 PID 1384 wrote to memory of 1660 1384 xsvcxnsundtl.exe 32 -
System policy modification 1 TTPs 2 IoCs
Processes:
xsvcxnsundtl.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xsvcxnsundtl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" xsvcxnsundtl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe"C:\Users\Admin\AppData\Local\Temp\4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe"C:\Users\Admin\AppData\Local\Temp\4aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\xsvcxnsundtl.exeC:\Windows\xsvcxnsundtl.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\xsvcxnsundtl.exeC:\Windows\xsvcxnsundtl.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1384 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\4AAB3E~1.EXE3⤵
- Deletes itself
PID:2008
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:840
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
MD574cdb42da9136b13a07e00a2bfc60323
SHA1f4e02831a49a93bbba08986c896ef189cd76a755
SHA2564aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518
SHA512f36dffecf9a16427597275adbf9c6fbc4c672d0e987ea1fcfee043dc2df608601f088fe5e9f1e8a50a882bc5068afcf082c456f399cde7cc8a139a07897e22bb
-
Filesize
340KB
MD574cdb42da9136b13a07e00a2bfc60323
SHA1f4e02831a49a93bbba08986c896ef189cd76a755
SHA2564aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518
SHA512f36dffecf9a16427597275adbf9c6fbc4c672d0e987ea1fcfee043dc2df608601f088fe5e9f1e8a50a882bc5068afcf082c456f399cde7cc8a139a07897e22bb
-
Filesize
340KB
MD574cdb42da9136b13a07e00a2bfc60323
SHA1f4e02831a49a93bbba08986c896ef189cd76a755
SHA2564aab3e6ac278889322a964f069fa257ac2792dcd17293f8b9f0bfae12a4f7518
SHA512f36dffecf9a16427597275adbf9c6fbc4c672d0e987ea1fcfee043dc2df608601f088fe5e9f1e8a50a882bc5068afcf082c456f399cde7cc8a139a07897e22bb