Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
19-07-2022 19:52
Static task
static1
Behavioral task
behavioral1
Sample
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe
Resource
win7-20220718-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe
Resource
win10v2004-20220718-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe
-
Size
352KB
-
MD5
730889ba766d40cf3db888f550785d06
-
SHA1
44cd570d3232530b21d3e6afd7586d812ac3e858
-
SHA256
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
-
SHA512
922417af1d141685956cb6d064b1abf843cdc823755e136af2f78087dcf9390553c477a618ca83c10dc5e75fe3eac50f9e1472e61667487fb6f70a3f58df89ba
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\Recovery+btmso.txt
Family
teslacrypt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with AES
More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES
How did this happen ?
!!! Specially for your PC was generated personal AES KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A5EF151D10E9FF8A
2. http://tes543berda73i48fsdfsd.keratadze.at/A5EF151D10E9FF8A
3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A5EF151D10E9FF8A
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser
3. Type in the address bar: xlowfznrg4wf7dli.onion/A5EF151D10E9FF8A
4. Follow the instructions on the site.
---------------- IMPORTANT INFORMATION------------------------
*-*-* Your personal pages:
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A5EF151D10E9FF8A
http://tes543berda73i48fsdfsd.keratadze.at/A5EF151D10E9FF8A
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A5EF151D10E9FF8A
*-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/A5EF151D10E9FF8A
URLs
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A5EF151D10E9FF8A
http://tes543berda73i48fsdfsd.keratadze.at/A5EF151D10E9FF8A
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A5EF151D10E9FF8A
http://xlowfznrg4wf7dli.ONION/A5EF151D10E9FF8A
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
guutpgrrgecw.exeguutpgrrgecw.exepid Process 1252 guutpgrrgecw.exe 1496 guutpgrrgecw.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 1728 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
guutpgrrgecw.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run guutpgrrgecw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\vxktupsenfbl = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\guutpgrrgecw.exe\"" guutpgrrgecw.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exeguutpgrrgecw.exedescription pid Process procid_target PID 1176 set thread context of 748 1176 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 27 PID 1252 set thread context of 1496 1252 guutpgrrgecw.exe 31 -
Drops file in Program Files directory 64 IoCs
Processes:
guutpgrrgecw.exedescription ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png guutpgrrgecw.exe File opened for modification C:\Program Files\Microsoft Games\More Games\it-IT\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\Windows NT\TableTextService\fr-FR\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt guutpgrrgecw.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png guutpgrrgecw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt guutpgrrgecw.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv guutpgrrgecw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\Microsoft Games\Chess\it-IT\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png guutpgrrgecw.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg guutpgrrgecw.exe File opened for modification C:\Program Files\Google\Chrome\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\Recovery+btmso.html guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv guutpgrrgecw.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png guutpgrrgecw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\Windows Media Player\fr-FR\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\Recovery+btmso.png guutpgrrgecw.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\Recovery+btmso.txt guutpgrrgecw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\Recovery+btmso.png guutpgrrgecw.exe -
Drops file in Windows directory 2 IoCs
Processes:
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exedescription ioc Process File created C:\Windows\guutpgrrgecw.exe 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe File opened for modification C:\Windows\guutpgrrgecw.exe 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
guutpgrrgecw.exedescription ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 guutpgrrgecw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 guutpgrrgecw.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 guutpgrrgecw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 guutpgrrgecw.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
guutpgrrgecw.exepid Process 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe 1496 guutpgrrgecw.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exeguutpgrrgecw.exeWMIC.exevssvc.exedescription pid Process Token: SeDebugPrivilege 748 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe Token: SeDebugPrivilege 1496 guutpgrrgecw.exe Token: SeIncreaseQuotaPrivilege 1684 WMIC.exe Token: SeSecurityPrivilege 1684 WMIC.exe Token: SeTakeOwnershipPrivilege 1684 WMIC.exe Token: SeLoadDriverPrivilege 1684 WMIC.exe Token: SeSystemProfilePrivilege 1684 WMIC.exe Token: SeSystemtimePrivilege 1684 WMIC.exe Token: SeProfSingleProcessPrivilege 1684 WMIC.exe Token: SeIncBasePriorityPrivilege 1684 WMIC.exe Token: SeCreatePagefilePrivilege 1684 WMIC.exe Token: SeBackupPrivilege 1684 WMIC.exe Token: SeRestorePrivilege 1684 WMIC.exe Token: SeShutdownPrivilege 1684 WMIC.exe Token: SeDebugPrivilege 1684 WMIC.exe Token: SeSystemEnvironmentPrivilege 1684 WMIC.exe Token: SeRemoteShutdownPrivilege 1684 WMIC.exe Token: SeUndockPrivilege 1684 WMIC.exe Token: SeManageVolumePrivilege 1684 WMIC.exe Token: 33 1684 WMIC.exe Token: 34 1684 WMIC.exe Token: 35 1684 WMIC.exe Token: SeIncreaseQuotaPrivilege 1684 WMIC.exe Token: SeSecurityPrivilege 1684 WMIC.exe Token: SeTakeOwnershipPrivilege 1684 WMIC.exe Token: SeLoadDriverPrivilege 1684 WMIC.exe Token: SeSystemProfilePrivilege 1684 WMIC.exe Token: SeSystemtimePrivilege 1684 WMIC.exe Token: SeProfSingleProcessPrivilege 1684 WMIC.exe Token: SeIncBasePriorityPrivilege 1684 WMIC.exe Token: SeCreatePagefilePrivilege 1684 WMIC.exe Token: SeBackupPrivilege 1684 WMIC.exe Token: SeRestorePrivilege 1684 WMIC.exe Token: SeShutdownPrivilege 1684 WMIC.exe Token: SeDebugPrivilege 1684 WMIC.exe Token: SeSystemEnvironmentPrivilege 1684 WMIC.exe Token: SeRemoteShutdownPrivilege 1684 WMIC.exe Token: SeUndockPrivilege 1684 WMIC.exe Token: SeManageVolumePrivilege 1684 WMIC.exe Token: 33 1684 WMIC.exe Token: 34 1684 WMIC.exe Token: 35 1684 WMIC.exe Token: SeBackupPrivilege 828 vssvc.exe Token: SeRestorePrivilege 828 vssvc.exe Token: SeAuditPrivilege 828 vssvc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exeguutpgrrgecw.exeguutpgrrgecw.exedescription pid Process procid_target PID 1176 wrote to memory of 748 1176 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 27 PID 1176 wrote to memory of 748 1176 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 27 PID 1176 wrote to memory of 748 1176 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 27 PID 1176 wrote to memory of 748 1176 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 27 PID 1176 wrote to memory of 748 1176 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 27 PID 1176 wrote to memory of 748 1176 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 27 PID 1176 wrote to memory of 748 1176 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 27 PID 1176 wrote to memory of 748 1176 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 27 PID 1176 wrote to memory of 748 1176 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 27 PID 1176 wrote to memory of 748 1176 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 27 PID 748 wrote to memory of 1252 748 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 28 PID 748 wrote to memory of 1252 748 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 28 PID 748 wrote to memory of 1252 748 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 28 PID 748 wrote to memory of 1252 748 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 28 PID 748 wrote to memory of 1728 748 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 29 PID 748 wrote to memory of 1728 748 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 29 PID 748 wrote to memory of 1728 748 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 29 PID 748 wrote to memory of 1728 748 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 29 PID 1252 wrote to memory of 1496 1252 guutpgrrgecw.exe 31 PID 1252 wrote to memory of 1496 1252 guutpgrrgecw.exe 31 PID 1252 wrote to memory of 1496 1252 guutpgrrgecw.exe 31 PID 1252 wrote to memory of 1496 1252 guutpgrrgecw.exe 31 PID 1252 wrote to memory of 1496 1252 guutpgrrgecw.exe 31 PID 1252 wrote to memory of 1496 1252 guutpgrrgecw.exe 31 PID 1252 wrote to memory of 1496 1252 guutpgrrgecw.exe 31 PID 1252 wrote to memory of 1496 1252 guutpgrrgecw.exe 31 PID 1252 wrote to memory of 1496 1252 guutpgrrgecw.exe 31 PID 1252 wrote to memory of 1496 1252 guutpgrrgecw.exe 31 PID 1496 wrote to memory of 1684 1496 guutpgrrgecw.exe 32 PID 1496 wrote to memory of 1684 1496 guutpgrrgecw.exe 32 PID 1496 wrote to memory of 1684 1496 guutpgrrgecw.exe 32 PID 1496 wrote to memory of 1684 1496 guutpgrrgecw.exe 32 -
System policy modification 1 TTPs 2 IoCs
Processes:
guutpgrrgecw.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System guutpgrrgecw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" guutpgrrgecw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe"C:\Users\Admin\AppData\Local\Temp\4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe"C:\Users\Admin\AppData\Local\Temp\4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\guutpgrrgecw.exeC:\Windows\guutpgrrgecw.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\guutpgrrgecw.exeC:\Windows\guutpgrrgecw.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1496 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\4FD4F4~1.EXE3⤵
- Deletes itself
PID:1728
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:828
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB
MD5730889ba766d40cf3db888f550785d06
SHA144cd570d3232530b21d3e6afd7586d812ac3e858
SHA2564fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
SHA512922417af1d141685956cb6d064b1abf843cdc823755e136af2f78087dcf9390553c477a618ca83c10dc5e75fe3eac50f9e1472e61667487fb6f70a3f58df89ba
-
Filesize
352KB
MD5730889ba766d40cf3db888f550785d06
SHA144cd570d3232530b21d3e6afd7586d812ac3e858
SHA2564fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
SHA512922417af1d141685956cb6d064b1abf843cdc823755e136af2f78087dcf9390553c477a618ca83c10dc5e75fe3eac50f9e1472e61667487fb6f70a3f58df89ba
-
Filesize
352KB
MD5730889ba766d40cf3db888f550785d06
SHA144cd570d3232530b21d3e6afd7586d812ac3e858
SHA2564fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
SHA512922417af1d141685956cb6d064b1abf843cdc823755e136af2f78087dcf9390553c477a618ca83c10dc5e75fe3eac50f9e1472e61667487fb6f70a3f58df89ba