Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 00:44
Static task
static1
Behavioral task
behavioral1
Sample
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe
Resource
win10v2004-20220721-en
General
-
Target
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe
-
Size
368KB
-
MD5
65440340932ca8194b58ab27a078d4b5
-
SHA1
3c8690d9c4b8de49ba2ed4ceae26468a3b4220fe
-
SHA256
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8
-
SHA512
23934b41dadc45710bf8c598923c481af643416c0f3cc9e71f7314204fa80bd1a90afe58933911ec03b5cd9cbef93b4328404564a40793de2e75f34c02451410
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2660308776-3705150086-26593515-1000\Recovery+jicfx.txt
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/44816F917716EEE
http://b4youfred5485jgsa3453f.italazudda.com/44816F917716EEE
http://5rport45vcdef345adfkksawe.bematvocal.at/44816F917716EEE
http://fwgrhsao3aoml7ej.onion/44816F917716EEE
http://fwgrhsao3aoml7ej.ONION/44816F917716EEE
Signatures
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
fgwvnakybplx.exefgwvnakybplx.exepid process 1244 fgwvnakybplx.exe 212 fgwvnakybplx.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
fgwvnakybplx.exedescription ioc process File renamed C:\Users\Admin\Pictures\AddUnprotect.png => C:\Users\Admin\Pictures\AddUnprotect.png.mp3 fgwvnakybplx.exe File renamed C:\Users\Admin\Pictures\InvokeTest.png => C:\Users\Admin\Pictures\InvokeTest.png.mp3 fgwvnakybplx.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fgwvnakybplx.exe5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation fgwvnakybplx.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe -
Drops startup file 6 IoCs
Processes:
fgwvnakybplx.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+jicfx.txt fgwvnakybplx.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+jicfx.html fgwvnakybplx.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+jicfx.png fgwvnakybplx.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+jicfx.txt fgwvnakybplx.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+jicfx.html fgwvnakybplx.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+jicfx.png fgwvnakybplx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
fgwvnakybplx.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sixgembuypda = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\fgwvnakybplx.exe\"" fgwvnakybplx.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows\CurrentVersion\Run fgwvnakybplx.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exefgwvnakybplx.exedescription pid process target process PID 4000 set thread context of 4224 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 1244 set thread context of 212 1244 fgwvnakybplx.exe fgwvnakybplx.exe -
Drops file in Program Files directory 64 IoCs
Processes:
fgwvnakybplx.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\VideoThumbnail.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchWideTile.contrast-white_scale-100.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\script\Recovery+jicfx.txt fgwvnakybplx.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\Recovery+jicfx.html fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\offer_cards\o365apps.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-36_altform-lightunplated.png fgwvnakybplx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Recovery+jicfx.txt fgwvnakybplx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\Recovery+jicfx.txt fgwvnakybplx.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\Recovery+jicfx.txt fgwvnakybplx.exe File opened for modification C:\Program Files\Internet Explorer\images\Recovery+jicfx.txt fgwvnakybplx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\Recovery+jicfx.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\FileWord32x32.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-200_contrast-white.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-white_scale-100.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-200.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Speech\Recovery+jicfx.html fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-100.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-200.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-150.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Recovery+jicfx.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare150x150Logo.scale-100_contrast-white.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+jicfx.txt fgwvnakybplx.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\Recovery+jicfx.html fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-125_contrast-white.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-400.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Recovery+jicfx.txt fgwvnakybplx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\Recovery+jicfx.html fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-400.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-200_contrast-white.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-125_contrast-white.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-white_scale-125.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-Toolkit\Recovery+jicfx.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-100_contrast-black.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleLargeTile.scale-100.png fgwvnakybplx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\Recovery+jicfx.png fgwvnakybplx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] fgwvnakybplx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Recovery+jicfx.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-100.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\Recovery+jicfx.html fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_contrast-white.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-30_altform-unplated_contrast-white.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailBadge.scale-200.png fgwvnakybplx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png fgwvnakybplx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\Recovery+jicfx.html fgwvnakybplx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\Recovery+jicfx.txt fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Recovery+jicfx.html fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_altform-unplated_contrast-black.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sl-SI\Recovery+jicfx.html fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\jscripts\wefgallery_strings.js fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-200.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96_altform-unplated.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-125.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-125.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\Recovery+jicfx.html fgwvnakybplx.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\Recovery+jicfx.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\contrast-black\Error.svg fgwvnakybplx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Recovery+jicfx.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-100.png fgwvnakybplx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-256.png fgwvnakybplx.exe -
Drops file in Windows directory 2 IoCs
Processes:
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exedescription ioc process File created C:\Windows\fgwvnakybplx.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe File opened for modification C:\Windows\fgwvnakybplx.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fgwvnakybplx.exepid process 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe 212 fgwvnakybplx.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exefgwvnakybplx.exeWMIC.exevssvc.exedescription pid process Token: SeDebugPrivilege 4224 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe Token: SeDebugPrivilege 212 fgwvnakybplx.exe Token: SeIncreaseQuotaPrivilege 4560 WMIC.exe Token: SeSecurityPrivilege 4560 WMIC.exe Token: SeTakeOwnershipPrivilege 4560 WMIC.exe Token: SeLoadDriverPrivilege 4560 WMIC.exe Token: SeSystemProfilePrivilege 4560 WMIC.exe Token: SeSystemtimePrivilege 4560 WMIC.exe Token: SeProfSingleProcessPrivilege 4560 WMIC.exe Token: SeIncBasePriorityPrivilege 4560 WMIC.exe Token: SeCreatePagefilePrivilege 4560 WMIC.exe Token: SeBackupPrivilege 4560 WMIC.exe Token: SeRestorePrivilege 4560 WMIC.exe Token: SeShutdownPrivilege 4560 WMIC.exe Token: SeDebugPrivilege 4560 WMIC.exe Token: SeSystemEnvironmentPrivilege 4560 WMIC.exe Token: SeRemoteShutdownPrivilege 4560 WMIC.exe Token: SeUndockPrivilege 4560 WMIC.exe Token: SeManageVolumePrivilege 4560 WMIC.exe Token: 33 4560 WMIC.exe Token: 34 4560 WMIC.exe Token: 35 4560 WMIC.exe Token: 36 4560 WMIC.exe Token: SeIncreaseQuotaPrivilege 4560 WMIC.exe Token: SeSecurityPrivilege 4560 WMIC.exe Token: SeTakeOwnershipPrivilege 4560 WMIC.exe Token: SeLoadDriverPrivilege 4560 WMIC.exe Token: SeSystemProfilePrivilege 4560 WMIC.exe Token: SeSystemtimePrivilege 4560 WMIC.exe Token: SeProfSingleProcessPrivilege 4560 WMIC.exe Token: SeIncBasePriorityPrivilege 4560 WMIC.exe Token: SeCreatePagefilePrivilege 4560 WMIC.exe Token: SeBackupPrivilege 4560 WMIC.exe Token: SeRestorePrivilege 4560 WMIC.exe Token: SeShutdownPrivilege 4560 WMIC.exe Token: SeDebugPrivilege 4560 WMIC.exe Token: SeSystemEnvironmentPrivilege 4560 WMIC.exe Token: SeRemoteShutdownPrivilege 4560 WMIC.exe Token: SeUndockPrivilege 4560 WMIC.exe Token: SeManageVolumePrivilege 4560 WMIC.exe Token: 33 4560 WMIC.exe Token: 34 4560 WMIC.exe Token: 35 4560 WMIC.exe Token: 36 4560 WMIC.exe Token: SeBackupPrivilege 3396 vssvc.exe Token: SeRestorePrivilege 3396 vssvc.exe Token: SeAuditPrivilege 3396 vssvc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exefgwvnakybplx.exepid process 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 1244 fgwvnakybplx.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exefgwvnakybplx.exefgwvnakybplx.exedescription pid process target process PID 4000 wrote to memory of 4224 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 4000 wrote to memory of 4224 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 4000 wrote to memory of 4224 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 4000 wrote to memory of 4224 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 4000 wrote to memory of 4224 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 4000 wrote to memory of 4224 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 4000 wrote to memory of 4224 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 4000 wrote to memory of 4224 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 4000 wrote to memory of 4224 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 4000 wrote to memory of 4224 4000 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe PID 4224 wrote to memory of 1244 4224 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe fgwvnakybplx.exe PID 4224 wrote to memory of 1244 4224 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe fgwvnakybplx.exe PID 4224 wrote to memory of 1244 4224 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe fgwvnakybplx.exe PID 4224 wrote to memory of 3836 4224 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe cmd.exe PID 4224 wrote to memory of 3836 4224 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe cmd.exe PID 4224 wrote to memory of 3836 4224 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe cmd.exe PID 1244 wrote to memory of 212 1244 fgwvnakybplx.exe fgwvnakybplx.exe PID 1244 wrote to memory of 212 1244 fgwvnakybplx.exe fgwvnakybplx.exe PID 1244 wrote to memory of 212 1244 fgwvnakybplx.exe fgwvnakybplx.exe PID 1244 wrote to memory of 212 1244 fgwvnakybplx.exe fgwvnakybplx.exe PID 1244 wrote to memory of 212 1244 fgwvnakybplx.exe fgwvnakybplx.exe PID 1244 wrote to memory of 212 1244 fgwvnakybplx.exe fgwvnakybplx.exe PID 1244 wrote to memory of 212 1244 fgwvnakybplx.exe fgwvnakybplx.exe PID 1244 wrote to memory of 212 1244 fgwvnakybplx.exe fgwvnakybplx.exe PID 1244 wrote to memory of 212 1244 fgwvnakybplx.exe fgwvnakybplx.exe PID 1244 wrote to memory of 212 1244 fgwvnakybplx.exe fgwvnakybplx.exe PID 212 wrote to memory of 4560 212 fgwvnakybplx.exe WMIC.exe PID 212 wrote to memory of 4560 212 fgwvnakybplx.exe WMIC.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
fgwvnakybplx.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fgwvnakybplx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" fgwvnakybplx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe"C:\Users\Admin\AppData\Local\Temp\5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe"C:\Users\Admin\AppData\Local\Temp\5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\fgwvnakybplx.exeC:\Windows\fgwvnakybplx.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\fgwvnakybplx.exeC:\Windows\fgwvnakybplx.exe4⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\571946~1.EXE3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\fgwvnakybplx.exeFilesize
368KB
MD565440340932ca8194b58ab27a078d4b5
SHA13c8690d9c4b8de49ba2ed4ceae26468a3b4220fe
SHA2565719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8
SHA51223934b41dadc45710bf8c598923c481af643416c0f3cc9e71f7314204fa80bd1a90afe58933911ec03b5cd9cbef93b4328404564a40793de2e75f34c02451410
-
C:\Windows\fgwvnakybplx.exeFilesize
368KB
MD565440340932ca8194b58ab27a078d4b5
SHA13c8690d9c4b8de49ba2ed4ceae26468a3b4220fe
SHA2565719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8
SHA51223934b41dadc45710bf8c598923c481af643416c0f3cc9e71f7314204fa80bd1a90afe58933911ec03b5cd9cbef93b4328404564a40793de2e75f34c02451410
-
C:\Windows\fgwvnakybplx.exeFilesize
368KB
MD565440340932ca8194b58ab27a078d4b5
SHA13c8690d9c4b8de49ba2ed4ceae26468a3b4220fe
SHA2565719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8
SHA51223934b41dadc45710bf8c598923c481af643416c0f3cc9e71f7314204fa80bd1a90afe58933911ec03b5cd9cbef93b4328404564a40793de2e75f34c02451410
-
memory/212-142-0x0000000000000000-mapping.dmp
-
memory/212-145-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/212-149-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/212-147-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/212-146-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1244-137-0x0000000000000000-mapping.dmp
-
memory/3836-140-0x0000000000000000-mapping.dmp
-
memory/4000-134-0x0000000002500000-0x0000000002503000-memory.dmpFilesize
12KB
-
memory/4000-130-0x0000000002500000-0x0000000002503000-memory.dmpFilesize
12KB
-
memory/4224-141-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/4224-131-0x0000000000000000-mapping.dmp
-
memory/4224-132-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/4224-133-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/4224-136-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/4224-135-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/4560-148-0x0000000000000000-mapping.dmp