Analysis
-
max time kernel
151s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 00:44
Static task
static1
Behavioral task
behavioral1
Sample
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe
Resource
win10v2004-20220721-en
General
-
Target
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe
-
Size
368KB
-
MD5
65440340932ca8194b58ab27a078d4b5
-
SHA1
3c8690d9c4b8de49ba2ed4ceae26468a3b4220fe
-
SHA256
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8
-
SHA512
23934b41dadc45710bf8c598923c481af643416c0f3cc9e71f7314204fa80bd1a90afe58933911ec03b5cd9cbef93b4328404564a40793de2e75f34c02451410
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\Recovery+fvssi.txt
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/24226F9885EA5C9
http://b4youfred5485jgsa3453f.italazudda.com/24226F9885EA5C9
http://5rport45vcdef345adfkksawe.bematvocal.at/24226F9885EA5C9
http://fwgrhsao3aoml7ej.onion/24226F9885EA5C9
http://fwgrhsao3aoml7ej.ONION/24226F9885EA5C9
Signatures
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
roveddixelms.exeroveddixelms.exepid process 1360 roveddixelms.exe 268 roveddixelms.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1788 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
roveddixelms.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run roveddixelms.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\klghisbqncdh = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\roveddixelms.exe\"" roveddixelms.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exeroveddixelms.exedescription pid process target process PID 1976 set thread context of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1360 set thread context of 268 1360 roveddixelms.exe roveddixelms.exe -
Drops file in Program Files directory 64 IoCs
Processes:
roveddixelms.exedescription ioc process File opened for modification C:\Program Files\Windows Mail\fr-FR\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png roveddixelms.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\Microsoft Games\More Games\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\Recovery+fvssi.txt roveddixelms.exe File opened for modification C:\Program Files\Windows Sidebar\en-US\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\Recovery+fvssi.txt roveddixelms.exe File opened for modification C:\Program Files\DVD Maker\Shared\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png roveddixelms.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\Recovery+fvssi.txt roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ckb\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\Windows Defender\fr-FR\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\Windows Media Player\Skins\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\Recovery+fvssi.txt roveddixelms.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\Recovery+fvssi.txt roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\Windows Portable Devices\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\Common Files\Services\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png roveddixelms.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_bkg.png roveddixelms.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css roveddixelms.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\init.js roveddixelms.exe File opened for modification C:\Program Files\DVD Maker\en-US\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png roveddixelms.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\Recovery+fvssi.txt roveddixelms.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv roveddixelms.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\Recovery+fvssi.txt roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\Recovery+fvssi.txt roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png roveddixelms.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\Recovery+fvssi.txt roveddixelms.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png roveddixelms.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\es-ES\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt roveddixelms.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt roveddixelms.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png roveddixelms.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\localizedStrings.js roveddixelms.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\Recovery+fvssi.txt roveddixelms.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png roveddixelms.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\Common Files\System\ado\Recovery+fvssi.txt roveddixelms.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\Recovery+fvssi.html roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\Recovery+fvssi.png roveddixelms.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\Recovery+fvssi.txt roveddixelms.exe -
Drops file in Windows directory 2 IoCs
Processes:
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exedescription ioc process File opened for modification C:\Windows\roveddixelms.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe File created C:\Windows\roveddixelms.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
roveddixelms.exepid process 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe 268 roveddixelms.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exeroveddixelms.exeWMIC.exevssvc.exedescription pid process Token: SeDebugPrivilege 1408 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe Token: SeDebugPrivilege 268 roveddixelms.exe Token: SeIncreaseQuotaPrivilege 1676 WMIC.exe Token: SeSecurityPrivilege 1676 WMIC.exe Token: SeTakeOwnershipPrivilege 1676 WMIC.exe Token: SeLoadDriverPrivilege 1676 WMIC.exe Token: SeSystemProfilePrivilege 1676 WMIC.exe Token: SeSystemtimePrivilege 1676 WMIC.exe Token: SeProfSingleProcessPrivilege 1676 WMIC.exe Token: SeIncBasePriorityPrivilege 1676 WMIC.exe Token: SeCreatePagefilePrivilege 1676 WMIC.exe Token: SeBackupPrivilege 1676 WMIC.exe Token: SeRestorePrivilege 1676 WMIC.exe Token: SeShutdownPrivilege 1676 WMIC.exe Token: SeDebugPrivilege 1676 WMIC.exe Token: SeSystemEnvironmentPrivilege 1676 WMIC.exe Token: SeRemoteShutdownPrivilege 1676 WMIC.exe Token: SeUndockPrivilege 1676 WMIC.exe Token: SeManageVolumePrivilege 1676 WMIC.exe Token: 33 1676 WMIC.exe Token: 34 1676 WMIC.exe Token: 35 1676 WMIC.exe Token: SeIncreaseQuotaPrivilege 1676 WMIC.exe Token: SeSecurityPrivilege 1676 WMIC.exe Token: SeTakeOwnershipPrivilege 1676 WMIC.exe Token: SeLoadDriverPrivilege 1676 WMIC.exe Token: SeSystemProfilePrivilege 1676 WMIC.exe Token: SeSystemtimePrivilege 1676 WMIC.exe Token: SeProfSingleProcessPrivilege 1676 WMIC.exe Token: SeIncBasePriorityPrivilege 1676 WMIC.exe Token: SeCreatePagefilePrivilege 1676 WMIC.exe Token: SeBackupPrivilege 1676 WMIC.exe Token: SeRestorePrivilege 1676 WMIC.exe Token: SeShutdownPrivilege 1676 WMIC.exe Token: SeDebugPrivilege 1676 WMIC.exe Token: SeSystemEnvironmentPrivilege 1676 WMIC.exe Token: SeRemoteShutdownPrivilege 1676 WMIC.exe Token: SeUndockPrivilege 1676 WMIC.exe Token: SeManageVolumePrivilege 1676 WMIC.exe Token: 33 1676 WMIC.exe Token: 34 1676 WMIC.exe Token: 35 1676 WMIC.exe Token: SeBackupPrivilege 1772 vssvc.exe Token: SeRestorePrivilege 1772 vssvc.exe Token: SeAuditPrivilege 1772 vssvc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exeroveddixelms.exepid process 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 1360 roveddixelms.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exeroveddixelms.exeroveddixelms.exedescription pid process target process PID 1976 wrote to memory of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1976 wrote to memory of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1976 wrote to memory of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1976 wrote to memory of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1976 wrote to memory of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1976 wrote to memory of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1976 wrote to memory of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1976 wrote to memory of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1976 wrote to memory of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1976 wrote to memory of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1976 wrote to memory of 1408 1976 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1408 wrote to memory of 1360 1408 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe roveddixelms.exe PID 1408 wrote to memory of 1360 1408 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe roveddixelms.exe PID 1408 wrote to memory of 1360 1408 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe roveddixelms.exe PID 1408 wrote to memory of 1360 1408 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe roveddixelms.exe PID 1408 wrote to memory of 1788 1408 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe cmd.exe PID 1408 wrote to memory of 1788 1408 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe cmd.exe PID 1408 wrote to memory of 1788 1408 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe cmd.exe PID 1408 wrote to memory of 1788 1408 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe cmd.exe PID 1360 wrote to memory of 268 1360 roveddixelms.exe roveddixelms.exe PID 1360 wrote to memory of 268 1360 roveddixelms.exe roveddixelms.exe PID 1360 wrote to memory of 268 1360 roveddixelms.exe roveddixelms.exe PID 1360 wrote to memory of 268 1360 roveddixelms.exe roveddixelms.exe PID 1360 wrote to memory of 268 1360 roveddixelms.exe roveddixelms.exe PID 1360 wrote to memory of 268 1360 roveddixelms.exe roveddixelms.exe PID 1360 wrote to memory of 268 1360 roveddixelms.exe roveddixelms.exe PID 1360 wrote to memory of 268 1360 roveddixelms.exe roveddixelms.exe PID 1360 wrote to memory of 268 1360 roveddixelms.exe roveddixelms.exe PID 1360 wrote to memory of 268 1360 roveddixelms.exe roveddixelms.exe PID 1360 wrote to memory of 268 1360 roveddixelms.exe roveddixelms.exe PID 268 wrote to memory of 1676 268 roveddixelms.exe WMIC.exe PID 268 wrote to memory of 1676 268 roveddixelms.exe WMIC.exe PID 268 wrote to memory of 1676 268 roveddixelms.exe WMIC.exe PID 268 wrote to memory of 1676 268 roveddixelms.exe WMIC.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
roveddixelms.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System roveddixelms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" roveddixelms.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe"C:\Users\Admin\AppData\Local\Temp\5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe"C:\Users\Admin\AppData\Local\Temp\5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\roveddixelms.exeC:\Windows\roveddixelms.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\roveddixelms.exeC:\Windows\roveddixelms.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\571946~1.EXE3⤵
- Deletes itself
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\roveddixelms.exeFilesize
368KB
MD565440340932ca8194b58ab27a078d4b5
SHA13c8690d9c4b8de49ba2ed4ceae26468a3b4220fe
SHA2565719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8
SHA51223934b41dadc45710bf8c598923c481af643416c0f3cc9e71f7314204fa80bd1a90afe58933911ec03b5cd9cbef93b4328404564a40793de2e75f34c02451410
-
C:\Windows\roveddixelms.exeFilesize
368KB
MD565440340932ca8194b58ab27a078d4b5
SHA13c8690d9c4b8de49ba2ed4ceae26468a3b4220fe
SHA2565719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8
SHA51223934b41dadc45710bf8c598923c481af643416c0f3cc9e71f7314204fa80bd1a90afe58933911ec03b5cd9cbef93b4328404564a40793de2e75f34c02451410
-
C:\Windows\roveddixelms.exeFilesize
368KB
MD565440340932ca8194b58ab27a078d4b5
SHA13c8690d9c4b8de49ba2ed4ceae26468a3b4220fe
SHA2565719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8
SHA51223934b41dadc45710bf8c598923c481af643416c0f3cc9e71f7314204fa80bd1a90afe58933911ec03b5cd9cbef93b4328404564a40793de2e75f34c02451410
-
memory/268-96-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/268-95-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/268-94-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/268-90-0x0000000000417D60-mapping.dmp
-
memory/1360-73-0x0000000000000000-mapping.dmp
-
memory/1408-71-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1408-77-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1408-56-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1408-72-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1408-67-0x0000000000417D60-mapping.dmp
-
memory/1408-66-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1408-57-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1408-59-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1408-63-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1408-61-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1676-97-0x0000000000000000-mapping.dmp
-
memory/1788-76-0x0000000000000000-mapping.dmp
-
memory/1976-69-0x00000000003E0000-0x00000000003E3000-memory.dmpFilesize
12KB
-
memory/1976-54-0x0000000075301000-0x0000000075303000-memory.dmpFilesize
8KB
-
memory/1976-55-0x00000000003E0000-0x00000000003E3000-memory.dmpFilesize
12KB