Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 20:26
Static task
static1
Behavioral task
behavioral1
Sample
4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe
Resource
win10v2004-20220718-en
General
-
Target
4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe
-
Size
367KB
-
MD5
4730bcca5ec3e6a057604dc02d289236
-
SHA1
fe421fa51dc1ca9133189f6afe7bd410238971b7
-
SHA256
4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3
-
SHA512
f84d3c59fa448db14ef6f247adc9f1785a5f9149701e6faa9aeb64298a30245694faf4aa428e0396b4dd418a164c7564a9de7ab20c1ae669497422ee187b1584
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1178428168-2939480073-3055857545-1000\_RECOVERY_+onyen.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/B064C9F15FDF52C6
http://tes543berda73i48fsdfsd.keratadze.at/B064C9F15FDF52C6
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/B064C9F15FDF52C6
http://xlowfznrg4wf7dli.ONION/B064C9F15FDF52C6
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
pid Process 1292 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1178428168-2939480073-3055857545-1000\Control Panel\International\Geo\Nation 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe Key value queried \REGISTRY\USER\S-1-5-21-1178428168-2939480073-3055857545-1000\Control Panel\International\Geo\Nation ewgpnxpgquap.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1178428168-2939480073-3055857545-1000\Software\Microsoft\Windows\CurrentVersion\Run ewgpnxpgquap.exe Set value (str) \REGISTRY\USER\S-1-5-21-1178428168-2939480073-3055857545-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csqurqhlxfit = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\ewgpnxpgquap.exe\"" ewgpnxpgquap.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1908 set thread context of 4036 1908 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 75 PID 1292 set thread context of 2348 1292 ewgpnxpgquap.exe 79 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tr-TR\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\plugin2\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pl.pak ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lv.pak ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ar-SA\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\amd64\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-PT\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\TextConv\en-US\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Internet Explorer\en-US\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_200_percent.pak ewgpnxpgquap.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\bn.pak ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\_RECOVERY_+onyen.html ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\_RECOVERY_+onyen.png ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_RECOVERY_+onyen.txt ewgpnxpgquap.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\_RECOVERY_+onyen.png ewgpnxpgquap.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ewgpnxpgquap.exe 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe File opened for modification C:\Windows\ewgpnxpgquap.exe 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe 2348 ewgpnxpgquap.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 4036 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe Token: SeDebugPrivilege 2348 ewgpnxpgquap.exe Token: SeIncreaseQuotaPrivilege 1232 WMIC.exe Token: SeSecurityPrivilege 1232 WMIC.exe Token: SeTakeOwnershipPrivilege 1232 WMIC.exe Token: SeLoadDriverPrivilege 1232 WMIC.exe Token: SeSystemProfilePrivilege 1232 WMIC.exe Token: SeSystemtimePrivilege 1232 WMIC.exe Token: SeProfSingleProcessPrivilege 1232 WMIC.exe Token: SeIncBasePriorityPrivilege 1232 WMIC.exe Token: SeCreatePagefilePrivilege 1232 WMIC.exe Token: SeBackupPrivilege 1232 WMIC.exe Token: SeRestorePrivilege 1232 WMIC.exe Token: SeShutdownPrivilege 1232 WMIC.exe Token: SeDebugPrivilege 1232 WMIC.exe Token: SeSystemEnvironmentPrivilege 1232 WMIC.exe Token: SeRemoteShutdownPrivilege 1232 WMIC.exe Token: SeUndockPrivilege 1232 WMIC.exe Token: SeManageVolumePrivilege 1232 WMIC.exe Token: 33 1232 WMIC.exe Token: 34 1232 WMIC.exe Token: 35 1232 WMIC.exe Token: 36 1232 WMIC.exe Token: SeIncreaseQuotaPrivilege 1232 WMIC.exe Token: SeSecurityPrivilege 1232 WMIC.exe Token: SeTakeOwnershipPrivilege 1232 WMIC.exe Token: SeLoadDriverPrivilege 1232 WMIC.exe Token: SeSystemProfilePrivilege 1232 WMIC.exe Token: SeSystemtimePrivilege 1232 WMIC.exe Token: SeProfSingleProcessPrivilege 1232 WMIC.exe Token: SeIncBasePriorityPrivilege 1232 WMIC.exe Token: SeCreatePagefilePrivilege 1232 WMIC.exe Token: SeBackupPrivilege 1232 WMIC.exe Token: SeRestorePrivilege 1232 WMIC.exe Token: SeShutdownPrivilege 1232 WMIC.exe Token: SeDebugPrivilege 1232 WMIC.exe Token: SeSystemEnvironmentPrivilege 1232 WMIC.exe Token: SeRemoteShutdownPrivilege 1232 WMIC.exe Token: SeUndockPrivilege 1232 WMIC.exe Token: SeManageVolumePrivilege 1232 WMIC.exe Token: 33 1232 WMIC.exe Token: 34 1232 WMIC.exe Token: 35 1232 WMIC.exe Token: 36 1232 WMIC.exe Token: SeBackupPrivilege 3612 vssvc.exe Token: SeRestorePrivilege 3612 vssvc.exe Token: SeAuditPrivilege 3612 vssvc.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1908 wrote to memory of 4036 1908 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 75 PID 1908 wrote to memory of 4036 1908 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 75 PID 1908 wrote to memory of 4036 1908 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 75 PID 1908 wrote to memory of 4036 1908 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 75 PID 1908 wrote to memory of 4036 1908 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 75 PID 1908 wrote to memory of 4036 1908 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 75 PID 1908 wrote to memory of 4036 1908 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 75 PID 1908 wrote to memory of 4036 1908 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 75 PID 1908 wrote to memory of 4036 1908 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 75 PID 4036 wrote to memory of 1292 4036 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 76 PID 4036 wrote to memory of 1292 4036 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 76 PID 4036 wrote to memory of 1292 4036 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 76 PID 4036 wrote to memory of 3532 4036 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 77 PID 4036 wrote to memory of 3532 4036 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 77 PID 4036 wrote to memory of 3532 4036 4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe 77 PID 1292 wrote to memory of 2348 1292 ewgpnxpgquap.exe 79 PID 1292 wrote to memory of 2348 1292 ewgpnxpgquap.exe 79 PID 1292 wrote to memory of 2348 1292 ewgpnxpgquap.exe 79 PID 1292 wrote to memory of 2348 1292 ewgpnxpgquap.exe 79 PID 1292 wrote to memory of 2348 1292 ewgpnxpgquap.exe 79 PID 1292 wrote to memory of 2348 1292 ewgpnxpgquap.exe 79 PID 1292 wrote to memory of 2348 1292 ewgpnxpgquap.exe 79 PID 1292 wrote to memory of 2348 1292 ewgpnxpgquap.exe 79 PID 1292 wrote to memory of 2348 1292 ewgpnxpgquap.exe 79 PID 2348 wrote to memory of 1232 2348 ewgpnxpgquap.exe 80 PID 2348 wrote to memory of 1232 2348 ewgpnxpgquap.exe 80 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ewgpnxpgquap.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" ewgpnxpgquap.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe"C:\Users\Admin\AppData\Local\Temp\4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe"C:\Users\Admin\AppData\Local\Temp\4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\ewgpnxpgquap.exeC:\Windows\ewgpnxpgquap.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\ewgpnxpgquap.exeC:\Windows\ewgpnxpgquap.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2348 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\4DA541~1.EXE3⤵PID:3532
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3612
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
367KB
MD54730bcca5ec3e6a057604dc02d289236
SHA1fe421fa51dc1ca9133189f6afe7bd410238971b7
SHA2564da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3
SHA512f84d3c59fa448db14ef6f247adc9f1785a5f9149701e6faa9aeb64298a30245694faf4aa428e0396b4dd418a164c7564a9de7ab20c1ae669497422ee187b1584
-
Filesize
367KB
MD54730bcca5ec3e6a057604dc02d289236
SHA1fe421fa51dc1ca9133189f6afe7bd410238971b7
SHA2564da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3
SHA512f84d3c59fa448db14ef6f247adc9f1785a5f9149701e6faa9aeb64298a30245694faf4aa428e0396b4dd418a164c7564a9de7ab20c1ae669497422ee187b1584
-
Filesize
367KB
MD54730bcca5ec3e6a057604dc02d289236
SHA1fe421fa51dc1ca9133189f6afe7bd410238971b7
SHA2564da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3
SHA512f84d3c59fa448db14ef6f247adc9f1785a5f9149701e6faa9aeb64298a30245694faf4aa428e0396b4dd418a164c7564a9de7ab20c1ae669497422ee187b1584