1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77

General

Target

1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
Size

200KB
MD5

7372c9a138bb854972452263abab1dc5
SHA1

ad247b2428fac6d07bdd9628cddaa18004840e6c
SHA256

1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77
SHA512

3c882b3514c6314ebde04d35748464d4aba3eceb567c1b7ee87f4cf565cf192af3195d21151ef024b2fd19f151beb449fbd28105354a71764b46dbfba5fc1184
SSDEEP

3072:dbOTRwYckApvw14pcODvX/kyeAYcWNzs2C3Zm4YvrCtMNX/eTvpdXfabI5F8lbj4:lOsZiKRJWWYj7eTxdH5qlGuqJH

Score

9^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\pictures\CopyCompare.tiff	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

Drops startup file 1 IoCs

Processes:

1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\how_to_decrypt.hta	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops desktop.ini file(s) 29 IoCs

Processes:

1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

description	ioc	process
File opened for modification	\??\c:\users\public\music\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\contacts\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\documents\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\downloads\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\favorites\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\desktop\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\$recycle.bin\s-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\3d objects\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\pictures\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\music\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\documents\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\pictures\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\pictures\saved pictures\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\videos\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\pictures\camera roll\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\accountpictures\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\desktop\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\downloads\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\onedrive\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\searches\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\videos\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\saved games\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\libraries\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\favorites\links\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\links\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

pid	process
1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

WMIC.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3496	WMIC.exe
Token: SeSecurityPrivilege	3496	WMIC.exe
Token: SeTakeOwnershipPrivilege	3496	WMIC.exe
Token: SeLoadDriverPrivilege	3496	WMIC.exe
Token: SeSystemProfilePrivilege	3496	WMIC.exe
Token: SeSystemtimePrivilege	3496	WMIC.exe
Token: SeProfSingleProcessPrivilege	3496	WMIC.exe
Token: SeIncBasePriorityPrivilege	3496	WMIC.exe
Token: SeCreatePagefilePrivilege	3496	WMIC.exe
Token: SeBackupPrivilege	3496	WMIC.exe
Token: SeRestorePrivilege	3496	WMIC.exe
Token: SeShutdownPrivilege	3496	WMIC.exe
Token: SeDebugPrivilege	3496	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3496	WMIC.exe
Token: SeRemoteShutdownPrivilege	3496	WMIC.exe
Token: SeUndockPrivilege	3496	WMIC.exe
Token: SeManageVolumePrivilege	3496	WMIC.exe
Token: 33	3496	WMIC.exe
Token: 34	3496	WMIC.exe
Token: 35	3496	WMIC.exe
Token: 36	3496	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3496	WMIC.exe
Token: SeSecurityPrivilege	3496	WMIC.exe
Token: SeTakeOwnershipPrivilege	3496	WMIC.exe
Token: SeLoadDriverPrivilege	3496	WMIC.exe
Token: SeSystemProfilePrivilege	3496	WMIC.exe
Token: SeSystemtimePrivilege	3496	WMIC.exe
Token: SeProfSingleProcessPrivilege	3496	WMIC.exe
Token: SeIncBasePriorityPrivilege	3496	WMIC.exe
Token: SeCreatePagefilePrivilege	3496	WMIC.exe
Token: SeBackupPrivilege	3496	WMIC.exe
Token: SeRestorePrivilege	3496	WMIC.exe
Token: SeShutdownPrivilege	3496	WMIC.exe
Token: SeDebugPrivilege	3496	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3496	WMIC.exe
Token: SeRemoteShutdownPrivilege	3496	WMIC.exe
Token: SeUndockPrivilege	3496	WMIC.exe
Token: SeManageVolumePrivilege	3496	WMIC.exe
Token: 33	3496	WMIC.exe
Token: 34	3496	WMIC.exe
Token: 35	3496	WMIC.exe
Token: 36	3496	WMIC.exe
Token: SeBackupPrivilege	4308	vssvc.exe
Token: SeRestorePrivilege	4308	vssvc.exe
Token: SeAuditPrivilege	4308	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

mshta.exe

pid	process
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe
8936	mshta.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.execmd.exe

description	pid	process	target process
PID 1052 wrote to memory of 3608	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 3608	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 3608	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 2376	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 2376	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 2376	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 4632	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 4632	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 4632	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 3540	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 3540	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 3540	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 4160	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 4160	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 4160	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 3432	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 3432	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 1052 wrote to memory of 3432	1052	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	cmd.exe
PID 3540 wrote to memory of 3496	3540	cmd.exe	WMIC.exe
PID 3540 wrote to memory of 3496	3540	cmd.exe	WMIC.exe
PID 3540 wrote to memory of 3496	3540	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
"C:\Users\Admin\AppData\Local\Temp\1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe"
1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "vssadmin delete shadows /all /quiet"
  2⤵
  PID:3608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0"
  2⤵
  PID:2376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "wbadmin DELETE BACKUP -keepVersions:0"
  2⤵
  PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "wmic SHADOWCOPY DELETE"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic SHADOWCOPY DELETE
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "bcdedit /set {default} recoveryenabled No"
  2⤵
  PID:4160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
  2⤵
  PID:3432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4104

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\how_to_decrypt.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Suspicious use of FindShellTrayWindow
PID:8936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

1

T1107

Credential Access

Credentials in Files

1

T1081

Discovery

Network Service Scanning

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini

Filesize
935B

MD5
81e668c5ebaf2e43805a6e5b868cfe07

SHA1
e9b2befbea440df40ba09212a2e9a26dcb185b2a

SHA256
fba9d8512c3210858e33191fe1da3b6d39d33be4ceb69ed500350214da111a3a

SHA512
bfb37b3f4eeb1d295a12c1ff962ec28c5d9ef894ddc0c9f8e12efdd54eb7b786508f47037e151b126f87c845d52471ba672a5a3fc4bc4e98b25f6f6d2878cfa9

Download Submit
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini

Filesize
935B

MD5
13409c6683976f6c32b5f9f0e61e5d78

SHA1
b8e3a35289f5fe612f64553e7236830ede083e76

SHA256
b1855c0ae029174838bd0f74cb686ca09e72cdfb83046873a244b7f331d72ed0

SHA512
e6826b55f8a35867e0b3c7bcc80e3b122912d94d524f93970802575e3174921c76209a83da51f0fc2a03066e1c115dbf002294fd129eba1e850425576173f875

Download Submit
C:\Users\Admin\Desktop\how_to_decrypt.hta

Filesize
5KB

MD5
b2f40fed23a467dbc77444c95ee1c201

SHA1
2357c995006321221e972f8f45d825928e189992

SHA256
db756eb4feaa4cfd13573dc5078a9d32a7dcb661dd93f1dcdd7b5c6bb8d7590d

SHA512
517a5406a5a05b539d2eb73d679e843b612f3286eedeb2c3c23471499830ef99414f01f237044047c8ba100bc4096934c9549c46a5156a0cbab1064aa7605541

Download Submit
memory/2376-133-0x0000000000000000-mapping.dmp

Download
memory/3432-137-0x0000000000000000-mapping.dmp

Download
memory/3496-138-0x0000000000000000-mapping.dmp

Download
memory/3540-135-0x0000000000000000-mapping.dmp

Download
memory/3608-132-0x0000000000000000-mapping.dmp

Download
memory/4160-136-0x0000000000000000-mapping.dmp

Download
memory/4632-134-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads