Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2022 19:52
Static task
static1
Behavioral task
behavioral1
Sample
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe
Resource
win7-20220718-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe
Resource
win10v2004-20220718-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe
-
Size
352KB
-
MD5
730889ba766d40cf3db888f550785d06
-
SHA1
44cd570d3232530b21d3e6afd7586d812ac3e858
-
SHA256
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
-
SHA512
922417af1d141685956cb6d064b1abf843cdc823755e136af2f78087dcf9390553c477a618ca83c10dc5e75fe3eac50f9e1472e61667487fb6f70a3f58df89ba
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-2783062828-828903012-4218294845-1000\Recovery+dyiqu.txt
Family
teslacrypt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with AES
More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES
How did this happen ?
!!! Specially for your PC was generated personal AES KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6182194AF92AEF6
2. http://tes543berda73i48fsdfsd.keratadze.at/6182194AF92AEF6
3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6182194AF92AEF6
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser
3. Type in the address bar: xlowfznrg4wf7dli.onion/6182194AF92AEF6
4. Follow the instructions on the site.
---------------- IMPORTANT INFORMATION------------------------
*-*-* Your personal pages:
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6182194AF92AEF6
http://tes543berda73i48fsdfsd.keratadze.at/6182194AF92AEF6
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6182194AF92AEF6
*-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/6182194AF92AEF6
URLs
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6182194AF92AEF6
http://tes543berda73i48fsdfsd.keratadze.at/6182194AF92AEF6
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6182194AF92AEF6
http://xlowfznrg4wf7dli.ONION/6182194AF92AEF6
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
pid Process 3300 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\Control Panel\International\Geo\Nation 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe Key value queried \REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\Control Panel\International\Geo\Nation ptaqfghhrpwi.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aggitvjudpyj = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\ptaqfghhrpwi.exe\"" ptaqfghhrpwi.exe Key created \REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\Software\Microsoft\Windows\CurrentVersion\Run ptaqfghhrpwi.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2640 set thread context of 1236 2640 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 79 PID 3300 set thread context of 720 3300 ptaqfghhrpwi.exe 83 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-129.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\Recovery+dyiqu.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt ptaqfghhrpwi.exe File opened for modification C:\Program Files\Reference Assemblies\Recovery+dyiqu.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\Recovery+dyiqu.html ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125_contrast-high.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-125_contrast-white.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageLargeTile.scale-400.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+dyiqu.txt ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\SmallTile.scale-125.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-256_altform-unplated_contrast-black.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupMedTile.scale-100.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Recovery+dyiqu.txt ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Recovery+dyiqu.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\Recovery+dyiqu.html ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Recovery+dyiqu.html ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\FetchingMail.scale-200.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-400.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\Recovery+dyiqu.html ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\Recovery+dyiqu.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\WideTile.scale-100.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\Recovery+dyiqu.txt ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\Recovery+dyiqu.txt ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\Recovery+dyiqu.txt ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\CoreEngine\Recovery+dyiqu.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-100.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-200_contrast-high.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\Recovery+dyiqu.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-150_contrast-black.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-150.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-64.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_scale-100.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-400.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bg-BG\Recovery+dyiqu.txt ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-100_contrast-white.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ca-ES\View3d\Recovery+dyiqu.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-200.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\Recovery+dyiqu.html ptaqfghhrpwi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\Recovery+dyiqu.html ptaqfghhrpwi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\Recovery+dyiqu.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Recovery+dyiqu.txt ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ru-RU\Recovery+dyiqu.txt ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-standard\Recovery+dyiqu.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-125.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxSmallTile.scale-125.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-256_altform-unplated.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\complete.contrast-white.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarLargeTile.scale-200.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\WideTile.scale-200.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\Recovery+dyiqu.html ptaqfghhrpwi.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\offer_cards\Recovery+dyiqu.html ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Dark.scale-300.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\Recovery+dyiqu.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\Recovery+dyiqu.txt ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-125_contrast-white.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-black_scale-200.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\203.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png ptaqfghhrpwi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Recovery+dyiqu.html ptaqfghhrpwi.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ptaqfghhrpwi.exe 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe File opened for modification C:\Windows\ptaqfghhrpwi.exe 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe 720 ptaqfghhrpwi.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 1236 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe Token: SeDebugPrivilege 720 ptaqfghhrpwi.exe Token: SeIncreaseQuotaPrivilege 3668 WMIC.exe Token: SeSecurityPrivilege 3668 WMIC.exe Token: SeTakeOwnershipPrivilege 3668 WMIC.exe Token: SeLoadDriverPrivilege 3668 WMIC.exe Token: SeSystemProfilePrivilege 3668 WMIC.exe Token: SeSystemtimePrivilege 3668 WMIC.exe Token: SeProfSingleProcessPrivilege 3668 WMIC.exe Token: SeIncBasePriorityPrivilege 3668 WMIC.exe Token: SeCreatePagefilePrivilege 3668 WMIC.exe Token: SeBackupPrivilege 3668 WMIC.exe Token: SeRestorePrivilege 3668 WMIC.exe Token: SeShutdownPrivilege 3668 WMIC.exe Token: SeDebugPrivilege 3668 WMIC.exe Token: SeSystemEnvironmentPrivilege 3668 WMIC.exe Token: SeRemoteShutdownPrivilege 3668 WMIC.exe Token: SeUndockPrivilege 3668 WMIC.exe Token: SeManageVolumePrivilege 3668 WMIC.exe Token: 33 3668 WMIC.exe Token: 34 3668 WMIC.exe Token: 35 3668 WMIC.exe Token: 36 3668 WMIC.exe Token: SeIncreaseQuotaPrivilege 3668 WMIC.exe Token: SeSecurityPrivilege 3668 WMIC.exe Token: SeTakeOwnershipPrivilege 3668 WMIC.exe Token: SeLoadDriverPrivilege 3668 WMIC.exe Token: SeSystemProfilePrivilege 3668 WMIC.exe Token: SeSystemtimePrivilege 3668 WMIC.exe Token: SeProfSingleProcessPrivilege 3668 WMIC.exe Token: SeIncBasePriorityPrivilege 3668 WMIC.exe Token: SeCreatePagefilePrivilege 3668 WMIC.exe Token: SeBackupPrivilege 3668 WMIC.exe Token: SeRestorePrivilege 3668 WMIC.exe Token: SeShutdownPrivilege 3668 WMIC.exe Token: SeDebugPrivilege 3668 WMIC.exe Token: SeSystemEnvironmentPrivilege 3668 WMIC.exe Token: SeRemoteShutdownPrivilege 3668 WMIC.exe Token: SeUndockPrivilege 3668 WMIC.exe Token: SeManageVolumePrivilege 3668 WMIC.exe Token: 33 3668 WMIC.exe Token: 34 3668 WMIC.exe Token: 35 3668 WMIC.exe Token: 36 3668 WMIC.exe Token: SeBackupPrivilege 3996 vssvc.exe Token: SeRestorePrivilege 3996 vssvc.exe Token: SeAuditPrivilege 3996 vssvc.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2640 wrote to memory of 1236 2640 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 79 PID 2640 wrote to memory of 1236 2640 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 79 PID 2640 wrote to memory of 1236 2640 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 79 PID 2640 wrote to memory of 1236 2640 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 79 PID 2640 wrote to memory of 1236 2640 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 79 PID 2640 wrote to memory of 1236 2640 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 79 PID 2640 wrote to memory of 1236 2640 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 79 PID 2640 wrote to memory of 1236 2640 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 79 PID 2640 wrote to memory of 1236 2640 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 79 PID 1236 wrote to memory of 3300 1236 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 80 PID 1236 wrote to memory of 3300 1236 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 80 PID 1236 wrote to memory of 3300 1236 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 80 PID 1236 wrote to memory of 2460 1236 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 81 PID 1236 wrote to memory of 2460 1236 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 81 PID 1236 wrote to memory of 2460 1236 4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe 81 PID 3300 wrote to memory of 720 3300 ptaqfghhrpwi.exe 83 PID 3300 wrote to memory of 720 3300 ptaqfghhrpwi.exe 83 PID 3300 wrote to memory of 720 3300 ptaqfghhrpwi.exe 83 PID 3300 wrote to memory of 720 3300 ptaqfghhrpwi.exe 83 PID 3300 wrote to memory of 720 3300 ptaqfghhrpwi.exe 83 PID 3300 wrote to memory of 720 3300 ptaqfghhrpwi.exe 83 PID 3300 wrote to memory of 720 3300 ptaqfghhrpwi.exe 83 PID 3300 wrote to memory of 720 3300 ptaqfghhrpwi.exe 83 PID 3300 wrote to memory of 720 3300 ptaqfghhrpwi.exe 83 PID 720 wrote to memory of 3668 720 ptaqfghhrpwi.exe 84 PID 720 wrote to memory of 3668 720 ptaqfghhrpwi.exe 84 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ptaqfghhrpwi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" ptaqfghhrpwi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe"C:\Users\Admin\AppData\Local\Temp\4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe"C:\Users\Admin\AppData\Local\Temp\4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\ptaqfghhrpwi.exeC:\Windows\ptaqfghhrpwi.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\ptaqfghhrpwi.exeC:\Windows\ptaqfghhrpwi.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:720 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\4FD4F4~1.EXE3⤵PID:2460
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3996
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB
MD5730889ba766d40cf3db888f550785d06
SHA144cd570d3232530b21d3e6afd7586d812ac3e858
SHA2564fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
SHA512922417af1d141685956cb6d064b1abf843cdc823755e136af2f78087dcf9390553c477a618ca83c10dc5e75fe3eac50f9e1472e61667487fb6f70a3f58df89ba
-
Filesize
352KB
MD5730889ba766d40cf3db888f550785d06
SHA144cd570d3232530b21d3e6afd7586d812ac3e858
SHA2564fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
SHA512922417af1d141685956cb6d064b1abf843cdc823755e136af2f78087dcf9390553c477a618ca83c10dc5e75fe3eac50f9e1472e61667487fb6f70a3f58df89ba
-
Filesize
352KB
MD5730889ba766d40cf3db888f550785d06
SHA144cd570d3232530b21d3e6afd7586d812ac3e858
SHA2564fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
SHA512922417af1d141685956cb6d064b1abf843cdc823755e136af2f78087dcf9390553c477a618ca83c10dc5e75fe3eac50f9e1472e61667487fb6f70a3f58df89ba