Analysis
-
max time kernel
120s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2022 17:14
Static task
static1
Behavioral task
behavioral1
Sample
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe
Resource
win10v2004-20220721-en
General
-
Target
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe
-
Size
260KB
-
MD5
1e9f4b8a2f1074905ace1f44b7eef0b4
-
SHA1
60bee8fde046ad2f568622278ccdd892928da008
-
SHA256
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976
-
SHA512
dc4bd5d98acbba93a5d1360047c1061b39e9d5c144f7a0f025166f647d2b5ed090fde99dd3e9680bf23f2dec3947ba2098df6a8cce49bdfcbbbbf53056bdf579
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\_README_NCYLLK_.hta
http://avsxrcoq2q5fgrw2.tor2web.org/A161-6896-47BD-0408-2C6B
http://avsxrcoq2q5fgrw2.onion/A161-6896-47BD-0408-2C6B
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 6 IoCs
Processes:
mshta.exeflow pid process 1206 4448 mshta.exe 1208 4448 mshta.exe 1209 4448 mshta.exe 1218 4448 mshta.exe 1221 4448 mshta.exe 1222 4448 mshta.exe -
Contacts a large (591) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\splitexpand.tiff 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe -
Processes:
resource yara_rule behavioral2/memory/3144-134-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3144-135-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3144-136-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3144-139-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe -
Drops startup file 1 IoCs
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe -
Loads dropped DLL 1 IoCs
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exepid process 3108 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{BD6B384F-E866-4BEC-BD74-EDFEE53A465D}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9C3E4A6F-EECA-497E-80F8-110BF4029C5D}.catalogItem svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5748.bmp" 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exedescription pid process target process PID 3108 set thread context of 3144 3108 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe -
Drops file in Program Files directory 20 IoCs
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exedescription ioc process File opened for modification \??\c:\program files (x86)\ 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\bitcoin 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\steam 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\powerpoint 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\excel 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\microsoft\office 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\office 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\outlook 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\thunderbird 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\word 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files\ 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\microsoft\word 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\onenote 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe File opened for modification \??\c:\program files (x86)\the bat! 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe -
Drops file in Windows directory 1 IoCs
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exedescription ioc process File opened for modification \??\c:\windows\ 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1752 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000_Classes\Local Settings 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exepid process 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exepid process 3108 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeShutdownPrivilege 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe Token: SeCreatePagefilePrivilege 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe Token: 33 2244 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2244 AUDIODG.EXE Token: SeDebugPrivilege 1752 taskkill.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.execmd.exedescription pid process target process PID 3108 wrote to memory of 3144 3108 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe PID 3108 wrote to memory of 3144 3108 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe PID 3108 wrote to memory of 3144 3108 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe PID 3108 wrote to memory of 3144 3108 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe PID 3144 wrote to memory of 4448 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe mshta.exe PID 3144 wrote to memory of 4448 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe mshta.exe PID 3144 wrote to memory of 4448 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe mshta.exe PID 3144 wrote to memory of 1240 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe cmd.exe PID 3144 wrote to memory of 1240 3144 5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe cmd.exe PID 1240 wrote to memory of 1752 1240 cmd.exe taskkill.exe PID 1240 wrote to memory of 1752 1240 cmd.exe taskkill.exe PID 1240 wrote to memory of 4496 1240 cmd.exe PING.EXE PID 1240 wrote to memory of 4496 1240 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe"C:\Users\Admin\AppData\Local\Temp\5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe"C:\Users\Admin\AppData\Local\Temp\5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe"2⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\_README_NCYLLK_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
- Blocklisted process makes network request
PID:4448
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\system32\taskkill.exetaskkill /f /im "5b9c5e47fec1a301d09e49d1b7e5c5aa78b6bc94a1b36136f17f4babbf358976.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1752
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
PID:4496
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:332
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4ac 0x4a81⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5b4448396ac213093d10e6f4bc2ba90a3
SHA1e77e7ae76a7cef5bd5bfce6bbddcd0e0842e86a3
SHA256c83d7b3f769269eaadac64b254efd6072a1edddd653ca434f7a07a2b80e139ed
SHA512567083d089660c6fdd2d77c14e5afe9704b1e0e98cf777c6b0a382b44dbd6c023c683ab1c1dbd4687dc604554b7d03e6d6a79e02eff2feccd134f0cf5c4d6dec
-
Filesize
11KB
MD5a4dd044bcd94e9b3370ccf095b31f896
SHA117c78201323ab2095bc53184aa8267c9187d5173
SHA2562e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
SHA51287335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a