Analysis
-
max time kernel
191s -
max time network
191s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 12:14
Static task
static1
Behavioral task
behavioral1
Sample
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe
Resource
win7-20220718-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe
Resource
win10v2004-20220722-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe
-
Size
342KB
-
MD5
1363011ce43fdadbff9360a2e2716731
-
SHA1
d980ddf282aa7170c38caaa4fe73d05cf04d9fe6
-
SHA256
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc
-
SHA512
355c654a7226f6c68367f0ede1f294d84f5f2d8b70757c9c0b20546589971b5534d67b0a99360acca7d5a0251aca0339b55226e859d5d53637a5491533072feb
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\Recovery+dnmsb.txt
Family
teslacrypt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-4096.
More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-4096 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/C683CCD3C5648DB
2. http://kkd47eh4hdjshb5t.angortra.at/C683CCD3C5648DB
3. http://ytrest84y5i456hghadefdsd.pontogrot.com/C683CCD3C5648DB
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser
3. Type in the address bar: xlowfznrg4wf7dli.onion/C683CCD3C5648DB
4. Follow the instructions on the site.
---------------- IMPORTANT INFORMATION------------------------
*-*-* Your personal pages:
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/C683CCD3C5648DB
http://kkd47eh4hdjshb5t.angortra.at/C683CCD3C5648DB
http://ytrest84y5i456hghadefdsd.pontogrot.com/C683CCD3C5648DB
*-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/C683CCD3C5648DB
URLs
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/C683CCD3C5648DB
http://kkd47eh4hdjshb5t.angortra.at/C683CCD3C5648DB
http://ytrest84y5i456hghadefdsd.pontogrot.com/C683CCD3C5648DB
http://xlowfznrg4wf7dli.ONION/C683CCD3C5648DB
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
Processes:
hbscdxjxfody.exepid Process 1548 hbscdxjxfody.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 956 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
hbscdxjxfody.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run hbscdxjxfody.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\cddsdweituee = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\hbscdxjxfody.exe\"" hbscdxjxfody.exe -
Drops file in Program Files directory 64 IoCs
Processes:
hbscdxjxfody.exedescription ioc Process File opened for modification C:\Program Files\7-Zip\Lang\is.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\History.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt hbscdxjxfody.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt hbscdxjxfody.exe -
Drops file in Windows directory 2 IoCs
Processes:
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exedescription ioc Process File created C:\Windows\hbscdxjxfody.exe 5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe File opened for modification C:\Windows\hbscdxjxfody.exe 5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
hbscdxjxfody.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 hbscdxjxfody.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e hbscdxjxfody.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e hbscdxjxfody.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e hbscdxjxfody.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
hbscdxjxfody.exepid Process 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe 1548 hbscdxjxfody.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exehbscdxjxfody.exeWMIC.exedescription pid Process Token: SeDebugPrivilege 1664 5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe Token: SeDebugPrivilege 1548 hbscdxjxfody.exe Token: SeIncreaseQuotaPrivilege 1888 WMIC.exe Token: SeSecurityPrivilege 1888 WMIC.exe Token: SeTakeOwnershipPrivilege 1888 WMIC.exe Token: SeLoadDriverPrivilege 1888 WMIC.exe Token: SeSystemProfilePrivilege 1888 WMIC.exe Token: SeSystemtimePrivilege 1888 WMIC.exe Token: SeProfSingleProcessPrivilege 1888 WMIC.exe Token: SeIncBasePriorityPrivilege 1888 WMIC.exe Token: SeCreatePagefilePrivilege 1888 WMIC.exe Token: SeBackupPrivilege 1888 WMIC.exe Token: SeRestorePrivilege 1888 WMIC.exe Token: SeShutdownPrivilege 1888 WMIC.exe Token: SeDebugPrivilege 1888 WMIC.exe Token: SeSystemEnvironmentPrivilege 1888 WMIC.exe Token: SeRemoteShutdownPrivilege 1888 WMIC.exe Token: SeUndockPrivilege 1888 WMIC.exe Token: SeManageVolumePrivilege 1888 WMIC.exe Token: 33 1888 WMIC.exe Token: 34 1888 WMIC.exe Token: 35 1888 WMIC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exehbscdxjxfody.exedescription pid Process procid_target PID 1664 wrote to memory of 1548 1664 5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe 28 PID 1664 wrote to memory of 1548 1664 5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe 28 PID 1664 wrote to memory of 1548 1664 5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe 28 PID 1664 wrote to memory of 1548 1664 5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe 28 PID 1664 wrote to memory of 956 1664 5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe 29 PID 1664 wrote to memory of 956 1664 5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe 29 PID 1664 wrote to memory of 956 1664 5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe 29 PID 1664 wrote to memory of 956 1664 5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe 29 PID 1548 wrote to memory of 1888 1548 hbscdxjxfody.exe 31 PID 1548 wrote to memory of 1888 1548 hbscdxjxfody.exe 31 PID 1548 wrote to memory of 1888 1548 hbscdxjxfody.exe 31 PID 1548 wrote to memory of 1888 1548 hbscdxjxfody.exe 31 -
System policy modification 1 TTPs 2 IoCs
Processes:
hbscdxjxfody.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System hbscdxjxfody.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" hbscdxjxfody.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe"C:\Users\Admin\AppData\Local\Temp\5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\hbscdxjxfody.exeC:\Windows\hbscdxjxfody.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1548 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\5F5B25~1.EXE2⤵
- Deletes itself
PID:956
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342KB
MD51363011ce43fdadbff9360a2e2716731
SHA1d980ddf282aa7170c38caaa4fe73d05cf04d9fe6
SHA2565f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc
SHA512355c654a7226f6c68367f0ede1f294d84f5f2d8b70757c9c0b20546589971b5534d67b0a99360acca7d5a0251aca0339b55226e859d5d53637a5491533072feb
-
Filesize
342KB
MD51363011ce43fdadbff9360a2e2716731
SHA1d980ddf282aa7170c38caaa4fe73d05cf04d9fe6
SHA2565f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc
SHA512355c654a7226f6c68367f0ede1f294d84f5f2d8b70757c9c0b20546589971b5534d67b0a99360acca7d5a0251aca0339b55226e859d5d53637a5491533072feb
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e