Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 06:34
Static task
static1
Behavioral task
behavioral1
Sample
55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe
Resource
win10v2004-20220721-en
General
-
Target
55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe
-
Size
620KB
-
MD5
5f685fae5cf582995387f342f60b5e23
-
SHA1
f99aa09d283e441e42edb46ae48c58f6ac8011ce
-
SHA256
55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e
-
SHA512
dc3793c5699e53ccb818787b5f60d866e1a4ab78ac08a0ba0e53db6a3810dfb829f67bf372acf54dcde768d8a7ae9434a213fd7391605b65e4290df5cb5b6ce5
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\Recovery+pbccn.txt
http://ert54nfh6hdshbw4f.nursespelk.com/BF8030705537E860
http://kk4dshfjn45tsnkdf34fg.tatiejava.at/BF8030705537E860
http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/BF8030705537E860
http://fwgrhsao3aoml7ej.onion/BF8030705537E860
Signatures
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 3 IoCs
Processes:
dbwsmidoe.exedbwsmidoe.exeinhqv.exepid process 1748 dbwsmidoe.exe 1508 dbwsmidoe.exe 1452 inhqv.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dbwsmidoe.exedescription ioc process File renamed C:\Users\Admin\Pictures\InstallSend.png => C:\Users\Admin\Pictures\InstallSend.png.mp3 dbwsmidoe.exe File renamed C:\Users\Admin\Pictures\ReceiveGroup.raw => C:\Users\Admin\Pictures\ReceiveGroup.raw.mp3 dbwsmidoe.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 940 cmd.exe -
Drops startup file 3 IoCs
Processes:
dbwsmidoe.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+pbccn.txt dbwsmidoe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+pbccn.png dbwsmidoe.exe -
Loads dropped DLL 1 IoCs
Processes:
dbwsmidoe.exepid process 1508 dbwsmidoe.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
dbwsmidoe.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run dbwsmidoe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\qwer-sadkfgsa = "C:\\Windows\\dbwsmidoe.exe" dbwsmidoe.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exedbwsmidoe.exedescription pid process target process PID 976 set thread context of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 1748 set thread context of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe -
Drops file in Program Files directory 64 IoCs
Processes:
dbwsmidoe.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\Recovery+pbccn.txt dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\Recovery+pbccn.txt dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous_partly-cloudy.png dbwsmidoe.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt dbwsmidoe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png dbwsmidoe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png dbwsmidoe.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\es-ES\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\ja-JP\Recovery+pbccn.txt dbwsmidoe.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\Recovery+pbccn.txt dbwsmidoe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png dbwsmidoe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png dbwsmidoe.exe File opened for modification C:\Program Files\Windows Journal\ja-JP\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\flyout.css dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\Recovery+pbccn.txt dbwsmidoe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\Recovery+pbccn.txt dbwsmidoe.exe File opened for modification C:\Program Files\Microsoft Office\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_up.png dbwsmidoe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt dbwsmidoe.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\en-US\Recovery+pbccn.txt dbwsmidoe.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png dbwsmidoe.exe File opened for modification C:\Program Files\Windows NT\TableTextService\ja-JP\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\Recovery+pbccn.txt dbwsmidoe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv dbwsmidoe.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\7-Zip\Lang\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\de-DE\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg dbwsmidoe.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\Recovery+pbccn.txt dbwsmidoe.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\Recovery+pbccn.txt dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\main.js dbwsmidoe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css dbwsmidoe.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_thunderstorm.png dbwsmidoe.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\it-IT\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\picturePuzzle.js dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_100_percent.pak dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\slideShow.js dbwsmidoe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png dbwsmidoe.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\ja-JP\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png dbwsmidoe.exe File opened for modification C:\Program Files\Windows Journal\it-IT\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\clock.js dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\RSSFeeds.js dbwsmidoe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\Recovery+pbccn.html dbwsmidoe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\Recovery+pbccn.png dbwsmidoe.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\Recovery+pbccn.html dbwsmidoe.exe -
Drops file in Windows directory 2 IoCs
Processes:
55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exedescription ioc process File created C:\Windows\dbwsmidoe.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe File opened for modification C:\Windows\dbwsmidoe.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1912 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dbwsmidoe.exepid process 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe 1508 dbwsmidoe.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exedbwsmidoe.exevssvc.exedescription pid process Token: SeDebugPrivilege 1476 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe Token: SeDebugPrivilege 1508 dbwsmidoe.exe Token: SeBackupPrivilege 1408 vssvc.exe Token: SeRestorePrivilege 1408 vssvc.exe Token: SeAuditPrivilege 1408 vssvc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exedbwsmidoe.exepid process 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 1748 dbwsmidoe.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exedbwsmidoe.exedbwsmidoe.exeinhqv.exedescription pid process target process PID 976 wrote to memory of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 976 wrote to memory of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 976 wrote to memory of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 976 wrote to memory of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 976 wrote to memory of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 976 wrote to memory of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 976 wrote to memory of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 976 wrote to memory of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 976 wrote to memory of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 976 wrote to memory of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 976 wrote to memory of 1476 976 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe PID 1476 wrote to memory of 1748 1476 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe dbwsmidoe.exe PID 1476 wrote to memory of 1748 1476 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe dbwsmidoe.exe PID 1476 wrote to memory of 1748 1476 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe dbwsmidoe.exe PID 1476 wrote to memory of 1748 1476 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe dbwsmidoe.exe PID 1476 wrote to memory of 940 1476 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe cmd.exe PID 1476 wrote to memory of 940 1476 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe cmd.exe PID 1476 wrote to memory of 940 1476 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe cmd.exe PID 1476 wrote to memory of 940 1476 55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe cmd.exe PID 1748 wrote to memory of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe PID 1748 wrote to memory of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe PID 1748 wrote to memory of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe PID 1748 wrote to memory of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe PID 1748 wrote to memory of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe PID 1748 wrote to memory of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe PID 1748 wrote to memory of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe PID 1748 wrote to memory of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe PID 1748 wrote to memory of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe PID 1748 wrote to memory of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe PID 1748 wrote to memory of 1508 1748 dbwsmidoe.exe dbwsmidoe.exe PID 1508 wrote to memory of 1452 1508 dbwsmidoe.exe inhqv.exe PID 1508 wrote to memory of 1452 1508 dbwsmidoe.exe inhqv.exe PID 1508 wrote to memory of 1452 1508 dbwsmidoe.exe inhqv.exe PID 1508 wrote to memory of 1452 1508 dbwsmidoe.exe inhqv.exe PID 1452 wrote to memory of 1912 1452 inhqv.exe vssadmin.exe PID 1452 wrote to memory of 1912 1452 inhqv.exe vssadmin.exe PID 1452 wrote to memory of 1912 1452 inhqv.exe vssadmin.exe PID 1452 wrote to memory of 1912 1452 inhqv.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe"C:\Users\Admin\AppData\Local\Temp\55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe"C:\Users\Admin\AppData\Local\Temp\55e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\dbwsmidoe.exeC:\Windows\dbwsmidoe.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\dbwsmidoe.exeC:\Windows\dbwsmidoe.exe4⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\inhqv.exeC:\Users\Admin\Documents\inhqv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet6⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\55E1C4~1.EXE3⤵
- Deletes itself
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\inhqv.exeFilesize
4KB
MD5307074acffa41e69ae7449338accbac4
SHA1d880915f78361db3b15ff18b0d3239a5d2a6a997
SHA256a5d3ed693c85298bd8f1c116bb16f78e032364143c76da2e22b3d0de29182380
SHA512aba5ffe7ec7342ba381927d3ff995f339b1837faab30e0fe48ed38b2da636b4e38b969a23c1c87271e54862522098775cb2f695c22a42b7a81d7f4e88fefa426
-
C:\Windows\dbwsmidoe.exeFilesize
620KB
MD55f685fae5cf582995387f342f60b5e23
SHA1f99aa09d283e441e42edb46ae48c58f6ac8011ce
SHA25655e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e
SHA512dc3793c5699e53ccb818787b5f60d866e1a4ab78ac08a0ba0e53db6a3810dfb829f67bf372acf54dcde768d8a7ae9434a213fd7391605b65e4290df5cb5b6ce5
-
C:\Windows\dbwsmidoe.exeFilesize
620KB
MD55f685fae5cf582995387f342f60b5e23
SHA1f99aa09d283e441e42edb46ae48c58f6ac8011ce
SHA25655e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e
SHA512dc3793c5699e53ccb818787b5f60d866e1a4ab78ac08a0ba0e53db6a3810dfb829f67bf372acf54dcde768d8a7ae9434a213fd7391605b65e4290df5cb5b6ce5
-
C:\Windows\dbwsmidoe.exeFilesize
620KB
MD55f685fae5cf582995387f342f60b5e23
SHA1f99aa09d283e441e42edb46ae48c58f6ac8011ce
SHA25655e1c4d76da8b185f8a68481bcbcdec3ed44f75dc04845e4a2a66ac0e5f6140e
SHA512dc3793c5699e53ccb818787b5f60d866e1a4ab78ac08a0ba0e53db6a3810dfb829f67bf372acf54dcde768d8a7ae9434a213fd7391605b65e4290df5cb5b6ce5
-
\Users\Admin\Documents\inhqv.exeFilesize
4KB
MD5307074acffa41e69ae7449338accbac4
SHA1d880915f78361db3b15ff18b0d3239a5d2a6a997
SHA256a5d3ed693c85298bd8f1c116bb16f78e032364143c76da2e22b3d0de29182380
SHA512aba5ffe7ec7342ba381927d3ff995f339b1837faab30e0fe48ed38b2da636b4e38b969a23c1c87271e54862522098775cb2f695c22a42b7a81d7f4e88fefa426
-
memory/940-76-0x0000000000000000-mapping.dmp
-
memory/976-68-0x0000000000340000-0x0000000000343000-memory.dmpFilesize
12KB
-
memory/976-55-0x0000000000340000-0x0000000000343000-memory.dmpFilesize
12KB
-
memory/976-54-0x00000000768F1000-0x00000000768F3000-memory.dmpFilesize
8KB
-
memory/1452-98-0x0000000000000000-mapping.dmp
-
memory/1476-72-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1476-61-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1476-67-0x000000000045AC26-mapping.dmp
-
memory/1476-56-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1476-66-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1476-64-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1476-77-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1476-63-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1476-57-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1476-71-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1476-59-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1508-95-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1508-96-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1508-94-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1508-90-0x000000000045AC26-mapping.dmp
-
memory/1748-73-0x0000000000000000-mapping.dmp
-
memory/1912-101-0x0000000000000000-mapping.dmp