Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 02:01
Static task
static1
Behavioral task
behavioral1
Sample
5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe
Resource
win10v2004-20220721-en
General
-
Target
5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe
-
Size
360KB
-
MD5
5d73b551f8c6abd194d9bffe8ec1968a
-
SHA1
ed3cceaee93ed29d06c05784cb870a56b529b148
-
SHA256
5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310
-
SHA512
3d996a38c15801ba9a96cee6bbb33128a9f5431102c2d3ca265f709269b54c12862d2a545951c0abba76ced582d90e57d226988fcc4ecdb4ba7dca36c43e0f7c
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\_ReCoVeRy_+vxuoq.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/B1EB93A6A6FA2113
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/B1EB93A6A6FA2113
http://yyre45dbvn2nhbefbmh.begumvelic.at/B1EB93A6A6FA2113
http://xlowfznrg4wf7dli.ONION/B1EB93A6A6FA2113
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\_ReCoVeRy_+vxuoq.html
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 4308 fsceiycgygnr.exe -
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ReceiveUnlock.png => C:\Users\Admin\Pictures\ReceiveUnlock.png.mp3 fsceiycgygnr.exe File renamed C:\Users\Admin\Pictures\UseCompress.crw => C:\Users\Admin\Pictures\UseCompress.crw.mp3 fsceiycgygnr.exe File opened for modification C:\Users\Admin\Pictures\ConnectMeasure.tiff fsceiycgygnr.exe File renamed C:\Users\Admin\Pictures\ConnectMeasure.tiff => C:\Users\Admin\Pictures\ConnectMeasure.tiff.mp3 fsceiycgygnr.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation fsceiycgygnr.exe -
Drops startup file 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+vxuoq.png fsceiycgygnr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+vxuoq.png fsceiycgygnr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\RUN fsceiycgygnr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rojujci = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\fsceiycgygnr.exe" fsceiycgygnr.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\_ReCoVeRy_+vxuoq.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\sr-cyrl-cs\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Text\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.AppTk.NativeDirect3d.UAP\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-20.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-125.png fsceiycgygnr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\_ReCoVeRy_+vxuoq.png fsceiycgygnr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\THMBNAIL.PNG fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\SuggestionsService\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bg-BG\_ReCoVeRy_+vxuoq.png fsceiycgygnr.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lv-LV\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\Assets\_ReCoVeRy_+vxuoq.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-200_contrast-white.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\_ReCoVeRy_+vxuoq.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\WideTile.scale-125.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_contrast-white.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Call_Connecting_Loud.m4a fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-100.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_Package.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ru-RU\View3d\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\logo.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-150.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_contrast-high.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-125.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-80_altform-unplated.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-20_altform-unplated_contrast-white.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\MedTile.scale-125.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-200.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyCalendarSearch.scale-100.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\MedTile.scale-100.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-16_altform-lightunplated.png fsceiycgygnr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-200_contrast-white.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_contrast-black.png fsceiycgygnr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\_ReCoVeRy_+vxuoq.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Opacity.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-125_contrast-black.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-fullcolor.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-40_altform-unplated.png fsceiycgygnr.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\SplashScreen.scale-125.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\_ReCoVeRy_+vxuoq.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-16_altform-unplated.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\WideTile.scale-200.png fsceiycgygnr.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\_ReCoVeRy_+vxuoq.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\Shaders\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\_ReCoVeRy_+vxuoq.txt fsceiycgygnr.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\_ReCoVeRy_+vxuoq.html fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Configuration\_ReCoVeRy_+vxuoq.png fsceiycgygnr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-125_contrast-black.png fsceiycgygnr.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\fsceiycgygnr.exe 5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe File opened for modification C:\Windows\fsceiycgygnr.exe 5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe 4308 fsceiycgygnr.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 2200 5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe Token: SeDebugPrivilege 4308 fsceiycgygnr.exe Token: SeIncreaseQuotaPrivilege 4684 WMIC.exe Token: SeSecurityPrivilege 4684 WMIC.exe Token: SeTakeOwnershipPrivilege 4684 WMIC.exe Token: SeLoadDriverPrivilege 4684 WMIC.exe Token: SeSystemProfilePrivilege 4684 WMIC.exe Token: SeSystemtimePrivilege 4684 WMIC.exe Token: SeProfSingleProcessPrivilege 4684 WMIC.exe Token: SeIncBasePriorityPrivilege 4684 WMIC.exe Token: SeCreatePagefilePrivilege 4684 WMIC.exe Token: SeBackupPrivilege 4684 WMIC.exe Token: SeRestorePrivilege 4684 WMIC.exe Token: SeShutdownPrivilege 4684 WMIC.exe Token: SeDebugPrivilege 4684 WMIC.exe Token: SeSystemEnvironmentPrivilege 4684 WMIC.exe Token: SeRemoteShutdownPrivilege 4684 WMIC.exe Token: SeUndockPrivilege 4684 WMIC.exe Token: SeManageVolumePrivilege 4684 WMIC.exe Token: 33 4684 WMIC.exe Token: 34 4684 WMIC.exe Token: 35 4684 WMIC.exe Token: 36 4684 WMIC.exe Token: SeIncreaseQuotaPrivilege 4684 WMIC.exe Token: SeSecurityPrivilege 4684 WMIC.exe Token: SeTakeOwnershipPrivilege 4684 WMIC.exe Token: SeLoadDriverPrivilege 4684 WMIC.exe Token: SeSystemProfilePrivilege 4684 WMIC.exe Token: SeSystemtimePrivilege 4684 WMIC.exe Token: SeProfSingleProcessPrivilege 4684 WMIC.exe Token: SeIncBasePriorityPrivilege 4684 WMIC.exe Token: SeCreatePagefilePrivilege 4684 WMIC.exe Token: SeBackupPrivilege 4684 WMIC.exe Token: SeRestorePrivilege 4684 WMIC.exe Token: SeShutdownPrivilege 4684 WMIC.exe Token: SeDebugPrivilege 4684 WMIC.exe Token: SeSystemEnvironmentPrivilege 4684 WMIC.exe Token: SeRemoteShutdownPrivilege 4684 WMIC.exe Token: SeUndockPrivilege 4684 WMIC.exe Token: SeManageVolumePrivilege 4684 WMIC.exe Token: 33 4684 WMIC.exe Token: 34 4684 WMIC.exe Token: 35 4684 WMIC.exe Token: 36 4684 WMIC.exe Token: SeBackupPrivilege 4876 vssvc.exe Token: SeRestorePrivilege 4876 vssvc.exe Token: SeAuditPrivilege 4876 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2200 wrote to memory of 4308 2200 5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe 78 PID 2200 wrote to memory of 4308 2200 5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe 78 PID 2200 wrote to memory of 4308 2200 5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe 78 PID 2200 wrote to memory of 4644 2200 5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe 80 PID 2200 wrote to memory of 4644 2200 5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe 80 PID 2200 wrote to memory of 4644 2200 5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe 80 PID 4308 wrote to memory of 4684 4308 fsceiycgygnr.exe 82 PID 4308 wrote to memory of 4684 4308 fsceiycgygnr.exe 82 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fsceiycgygnr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" fsceiycgygnr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe"C:\Users\Admin\AppData\Local\Temp\5a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\fsceiycgygnr.exeC:\Windows\fsceiycgygnr.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4308 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\5A0E56~1.EXE2⤵PID:4644
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4876
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
MD55d73b551f8c6abd194d9bffe8ec1968a
SHA1ed3cceaee93ed29d06c05784cb870a56b529b148
SHA2565a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310
SHA5123d996a38c15801ba9a96cee6bbb33128a9f5431102c2d3ca265f709269b54c12862d2a545951c0abba76ced582d90e57d226988fcc4ecdb4ba7dca36c43e0f7c
-
Filesize
360KB
MD55d73b551f8c6abd194d9bffe8ec1968a
SHA1ed3cceaee93ed29d06c05784cb870a56b529b148
SHA2565a0e56ade0fd3259f3ee630111ba370a509a78e60d6e3cbd2c6a74ede64ab310
SHA5123d996a38c15801ba9a96cee6bbb33128a9f5431102c2d3ca265f709269b54c12862d2a545951c0abba76ced582d90e57d226988fcc4ecdb4ba7dca36c43e0f7c