Analysis
- max time kernel
159s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
20/10/2022, 09:02
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target file.exe
- Size 194KB
- Sample221020-kzfhpsefdj
- SHA256 18aa090e0b3d0a2a34083e13726f78c8efd60cf5c0a425859a4fa2dfd6330423
- MD5 e23c95d91c7786c48e5273833610046f
- SHA1 cafcb78b479773cb1ddd5dfeeb3861e967a3772c
- SHA512 061c8716a8c14d7fa1527a5b86e94c1c5b6348d095bd3d64ea4db8e66717de91a2b411c22a4d5fa01c622d82118d2037cf3faefa6de7adc54d648c3daefc2697
- SSDEEP 3072:6VXmjRFVXL0tfRw05oEZJfrR/jaPDsexSFqnuFMnN0K3/dRhz:oGRFdLCZwoZJfJkDRjnuFO0gx
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
djvu
C2
-
http://winnlinne.com/lancer/get.php
Attributes
-
extension
.tury
-
offline_id
Uz66zEbmA32arcxwT81zZhkb23026oHz5iSp8qt1
-
payload_url
http://rgyui.top/dl/build2.exe
http://winnlinne.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-o7UXxOstmw Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0585Jhyjd
rsa_pubkey.plain
Extracted
Family
-
danabot
Attributes
-
embedded_hash
56951C922035D696BFCE443750496462
-
type
loader
Signatures
- Detected Djvu ransomware 9 IoCs
resource yara_rule behavioral2/memory/3488-162-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3488-164-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1380-167-0x0000000002270000-0x000000000238B000-memory.dmp family_djvu behavioral2/memory/3488-170-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3488-175-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3488-183-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/944-193-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/944-191-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/944-195-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu - Detects Smokeloader packer 2 IoCs
resource yara_rule behavioral2/memory/4644-133-0x0000000000590000-0x0000000000599000-memory.dmp family_smokeloader behavioral2/memory/5016-140-0x0000000000580000-0x0000000000589000-memory.dmp family_smokeloader - Djvu Ransomware
Ransomware which is a variant of the STOP family.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 7 IoCs
pid Process 5016 6A72.exe 3968 7272.exe 1380 EBD9.exe 3488 EBD9.exe 2044 CFF.exe 3456 EBD9.exe 944 EBD9.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation EBD9.exe - Loads dropped DLL 1 IoCs
pid Process 176 regsvr32.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 4036 icacls.exe - Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ba6bd237-a6f5-49fd-9bc5-95ecda6135c9\\EBD9.exe\" --AutoStart" EBD9.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 52 api.2ip.ua 53 api.2ip.ua - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1380 set thread context of 3488 1380 EBD9.exe 92 PID 3456 set thread context of 944 3456 EBD9.exe 103 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 45 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7272.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6A72.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6A72.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7272.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7272.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6A72.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4644 file.exe 4644 file.exe 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2740 Process not Found - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4644 file.exe 5016 6A72.exe 3968 7272.exe 2740 Process not Found 2740 Process not Found 2740 Process not Found 2740 Process not Found - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeShutdownPrivilege 2740 Process not Found Token: SeCreatePagefilePrivilege 2740 Process not Found Token: SeShutdownPrivilege 2740 Process not Found Token: SeCreatePagefilePrivilege 2740 Process not Found Token: SeShutdownPrivilege 2740 Process not Found Token: SeCreatePagefilePrivilege 2740 Process not Found Token: SeShutdownPrivilege 732 svchost.exe Token: SeShutdownPrivilege 732 svchost.exe Token: SeCreatePagefilePrivilege 732 svchost.exe Token: SeShutdownPrivilege 2740 Process not Found Token: SeCreatePagefilePrivilege 2740 Process not Found - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 2740 wrote to memory of 5016 2740 Process not Found 82 PID 2740 wrote to memory of 5016 2740 Process not Found 82 PID 2740 wrote to memory of 5016 2740 Process not Found 82 PID 2740 wrote to memory of 3968 2740 Process not Found 83 PID 2740 wrote to memory of 3968 2740 Process not Found 83 PID 2740 wrote to memory of 3968 2740 Process not Found 83 PID 2740 wrote to memory of 1380 2740 Process not Found 86 PID 2740 wrote to memory of 1380 2740 Process not Found 86 PID 2740 wrote to memory of 1380 2740 Process not Found 86 PID 2740 wrote to memory of 4884 2740 Process not Found 88 PID 2740 wrote to memory of 4884 2740 Process not Found 88 PID 2740 wrote to memory of 1948 2740 Process not Found 89 PID 2740 wrote to memory of 1948 2740 Process not Found 89 PID 2740 wrote to memory of 1948 2740 Process not Found 89 PID 2740 wrote to memory of 1948 2740 Process not Found 89 PID 4884 wrote to memory of 176 4884 regsvr32.exe 90 PID 4884 wrote to memory of 176 4884 regsvr32.exe 90 PID 4884 wrote to memory of 176 4884 regsvr32.exe 90 PID 2740 wrote to memory of 3772 2740 Process not Found 91 PID 2740 wrote to memory of 3772 2740 Process not Found 91 PID 2740 wrote to memory of 3772 2740 Process not Found 91 PID 1380 wrote to memory of 3488 1380 EBD9.exe 92 PID 1380 wrote to memory of 3488 1380 EBD9.exe 92 PID 1380 wrote to memory of 3488 1380 EBD9.exe 92 PID 1380 wrote to memory of 3488 1380 EBD9.exe 92 PID 1380 wrote to memory of 3488 1380 EBD9.exe 92 PID 1380 wrote to memory of 3488 1380 EBD9.exe 92 PID 1380 wrote to memory of 3488 1380 EBD9.exe 92 PID 1380 wrote to memory of 3488 1380 EBD9.exe 92 PID 1380 wrote to memory of 3488 1380 EBD9.exe 92 PID 1380 wrote to memory of 3488 1380 EBD9.exe 92 PID 2740 wrote to memory of 2044 2740 Process not Found 95 PID 2740 wrote to memory of 2044 2740 Process not Found 95 PID 2740 wrote to memory of 2044 2740 Process not Found 95 PID 3488 wrote to memory of 4036 3488 EBD9.exe 97 PID 3488 wrote to memory of 4036 3488 EBD9.exe 97 PID 3488 wrote to memory of 4036 3488 EBD9.exe 97 PID 3488 wrote to memory of 3456 3488 EBD9.exe 98 PID 3488 wrote to memory of 3456 3488 EBD9.exe 98 PID 3488 wrote to memory of 3456 3488 EBD9.exe 98 PID 2044 wrote to memory of 3884 2044 CFF.exe 100 PID 2044 wrote to memory of 3884 2044 CFF.exe 100 PID 2044 wrote to memory of 3884 2044 CFF.exe 100 PID 3456 wrote to memory of 944 3456 EBD9.exe 103 PID 3456 wrote to memory of 944 3456 EBD9.exe 103 PID 3456 wrote to memory of 944 3456 EBD9.exe 103 PID 3456 wrote to memory of 944 3456 EBD9.exe 103 PID 3456 wrote to memory of 944 3456 EBD9.exe 103 PID 3456 wrote to memory of 944 3456 EBD9.exe 103 PID 3456 wrote to memory of 944 3456 EBD9.exe 103 PID 3456 wrote to memory of 944 3456 EBD9.exe 103 PID 3456 wrote to memory of 944 3456 EBD9.exe 103 PID 3456 wrote to memory of 944 3456 EBD9.exe 103 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4644
-
C:\Users\Admin\AppData\Local\Temp\6A72.exeC:\Users\Admin\AppData\Local\Temp\6A72.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5016
-
C:\Users\Admin\AppData\Local\Temp\7272.exeC:\Users\Admin\AppData\Local\Temp\7272.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3968
-
C:\Users\Admin\AppData\Local\Temp\EBD9.exeC:\Users\Admin\AppData\Local\Temp\EBD9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\EBD9.exeC:\Users\Admin\AppData\Local\Temp\EBD9.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\ba6bd237-a6f5-49fd-9bc5-95ecda6135c9" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\EBD9.exe"C:\Users\Admin\AppData\Local\Temp\EBD9.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\EBD9.exe"C:\Users\Admin\AppData\Local\Temp\EBD9.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
PID:944
-
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\EFA3.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\EFA3.dll2⤵
- Loads dropped DLL
PID:176
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:1948
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\CFF.exeC:\Users\Admin\AppData\Local\Temp\CFF.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:3884
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:732
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x508 0x50c1⤵PID:5052
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\6A72.exe
- Size 193KB
- SHA256 d7b7d7150d8282dfdfc0de64b54f2c66c82b5e21d180c2dc3566a3205186278f
- MD5 056e389ed68b6441edc19c32cae3c36f
- SHA1 e8eca80ac1eddd46702ea1f0bda93c537f611928
- SHA512 61b3054a7a1f053516cfbdc3167ed044c72f36a2b155391283d5d8030e71ebab941d6ba6dcfef8b7a439b10bdeefb9020b122d4901cda8f741151b1708decbad
- SSDEEP 3072:z2XOjuimzLDWEBXM05Ftyv4P8/hWQ2oOX0Kfj3:KOuimzLR5McEgkZWQ2TX0O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\6A72.exe
- Size 193KB
- SHA256 d7b7d7150d8282dfdfc0de64b54f2c66c82b5e21d180c2dc3566a3205186278f
- MD5 056e389ed68b6441edc19c32cae3c36f
- SHA1 e8eca80ac1eddd46702ea1f0bda93c537f611928
- SHA512 61b3054a7a1f053516cfbdc3167ed044c72f36a2b155391283d5d8030e71ebab941d6ba6dcfef8b7a439b10bdeefb9020b122d4901cda8f741151b1708decbad
- SSDEEP 3072:z2XOjuimzLDWEBXM05Ftyv4P8/hWQ2oOX0Kfj3:KOuimzLR5McEgkZWQ2TX0O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7272.exe
- Size 195KB
- SHA256 ad7f2ed48ed234dddbb96f3d781704307f0d9def1ea5291d1832597f7aea2e92
- MD5 0b4f3864efb93d7c5413cb9eaabf587a
- SHA1 a8a2b31f8ec57b0d7488f725af213248c6cccfb9
- SHA512 1e475d0622d671f632b6f31a1de4f0a06d64a1b8329ec03496af16780c7e92249b0dde22a9c8fa69692762bc23f42cbc0e6cd194ef3a0b78296956d422601c22
- SSDEEP 3072:cXe44bLy3EtE5YOGvYeRuCbvoU0b1xqU9cCV0Kgp4HElE:Yx4bL+ClkQtM//qU9cCV0n4HE+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7272.exe
- Size 195KB
- SHA256 ad7f2ed48ed234dddbb96f3d781704307f0d9def1ea5291d1832597f7aea2e92
- MD5 0b4f3864efb93d7c5413cb9eaabf587a
- SHA1 a8a2b31f8ec57b0d7488f725af213248c6cccfb9
- SHA512 1e475d0622d671f632b6f31a1de4f0a06d64a1b8329ec03496af16780c7e92249b0dde22a9c8fa69692762bc23f42cbc0e6cd194ef3a0b78296956d422601c22
- SSDEEP 3072:cXe44bLy3EtE5YOGvYeRuCbvoU0b1xqU9cCV0Kgp4HElE:Yx4bL+ClkQtM//qU9cCV0n4HE+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CFF.exe
- Size 1.2MB
- SHA256 3d71d4985c8c7b1183fcee2a969b6267f72e6f3a99f794e52e01229d1e7e5bf0
- MD5 e6c9669200bcd09bc7d634ed43d23c06
- SHA1 caa393016b0e944f6fb53424161b48b449b0f46b
- SHA512 5adc06a84be2dacfd266da58d2323bfeae214e1e87ab8cfeae98d7ff6bb39c4b0796aeb0da5a23572a259702584b586cfcc8109044a3f2226e7afe32f8cfcec4
- SSDEEP 24576:SJqfD1HJ1XxdUtLYPH9bS0Wt3E88ms27uWsttFBNStPYSascP18O3N:SJaLjUmPHnWt3HjuWsNBNSdYSidN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CFF.exe
- Size 1.2MB
- SHA256 3d71d4985c8c7b1183fcee2a969b6267f72e6f3a99f794e52e01229d1e7e5bf0
- MD5 e6c9669200bcd09bc7d634ed43d23c06
- SHA1 caa393016b0e944f6fb53424161b48b449b0f46b
- SHA512 5adc06a84be2dacfd266da58d2323bfeae214e1e87ab8cfeae98d7ff6bb39c4b0796aeb0da5a23572a259702584b586cfcc8109044a3f2226e7afe32f8cfcec4
- SSDEEP 24576:SJqfD1HJ1XxdUtLYPH9bS0Wt3E88ms27uWsttFBNStPYSascP18O3N:SJaLjUmPHnWt3HjuWsNBNSdYSidN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EBD9.exe
- Size 713KB
- SHA256 ee58c869d7a419d55fe3e6a8cf001ffff107d5d922951b3999b79b2b6c7e1c27
- MD5 b7bc860cee7201e0c810642890a03246
- SHA1 d9edc9d61baf9d8cad3f840bba699ffd9219cce0
- SHA512 5e65e33f02c937167a03d283ab6510aab82f221d11ef3c65833bbf669df89136418889e09c5d2d6b6221fe3a47da3bb363a485b9f5ea210cfde35d7b50f7a594
- SSDEEP 12288:+sStMiFoDs026KEj5iBiAIqNsPst+EKsf6fkQzOhheBT+upZTpy/bIdYS8I5DoGn:+sfit/6KEVmiAZNaQ7Ksf+crACuDpCbq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EBD9.exe
- Size 713KB
- SHA256 ee58c869d7a419d55fe3e6a8cf001ffff107d5d922951b3999b79b2b6c7e1c27
- MD5 b7bc860cee7201e0c810642890a03246
- SHA1 d9edc9d61baf9d8cad3f840bba699ffd9219cce0
- SHA512 5e65e33f02c937167a03d283ab6510aab82f221d11ef3c65833bbf669df89136418889e09c5d2d6b6221fe3a47da3bb363a485b9f5ea210cfde35d7b50f7a594
- SSDEEP 12288:+sStMiFoDs026KEj5iBiAIqNsPst+EKsf6fkQzOhheBT+upZTpy/bIdYS8I5DoGn:+sfit/6KEVmiAZNaQ7Ksf+crACuDpCbq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EBD9.exe
- Size 713KB
- SHA256 ee58c869d7a419d55fe3e6a8cf001ffff107d5d922951b3999b79b2b6c7e1c27
- MD5 b7bc860cee7201e0c810642890a03246
- SHA1 d9edc9d61baf9d8cad3f840bba699ffd9219cce0
- SHA512 5e65e33f02c937167a03d283ab6510aab82f221d11ef3c65833bbf669df89136418889e09c5d2d6b6221fe3a47da3bb363a485b9f5ea210cfde35d7b50f7a594
- SSDEEP 12288:+sStMiFoDs026KEj5iBiAIqNsPst+EKsf6fkQzOhheBT+upZTpy/bIdYS8I5DoGn:+sfit/6KEVmiAZNaQ7Ksf+crACuDpCbq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EBD9.exe
- Size 713KB
- SHA256 ee58c869d7a419d55fe3e6a8cf001ffff107d5d922951b3999b79b2b6c7e1c27
- MD5 b7bc860cee7201e0c810642890a03246
- SHA1 d9edc9d61baf9d8cad3f840bba699ffd9219cce0
- SHA512 5e65e33f02c937167a03d283ab6510aab82f221d11ef3c65833bbf669df89136418889e09c5d2d6b6221fe3a47da3bb363a485b9f5ea210cfde35d7b50f7a594
- SSDEEP 12288:+sStMiFoDs026KEj5iBiAIqNsPst+EKsf6fkQzOhheBT+upZTpy/bIdYS8I5DoGn:+sfit/6KEVmiAZNaQ7Ksf+crACuDpCbq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EBD9.exe
- Size 713KB
- SHA256 ee58c869d7a419d55fe3e6a8cf001ffff107d5d922951b3999b79b2b6c7e1c27
- MD5 b7bc860cee7201e0c810642890a03246
- SHA1 d9edc9d61baf9d8cad3f840bba699ffd9219cce0
- SHA512 5e65e33f02c937167a03d283ab6510aab82f221d11ef3c65833bbf669df89136418889e09c5d2d6b6221fe3a47da3bb363a485b9f5ea210cfde35d7b50f7a594
- SSDEEP 12288:+sStMiFoDs026KEj5iBiAIqNsPst+EKsf6fkQzOhheBT+upZTpy/bIdYS8I5DoGn:+sfit/6KEVmiAZNaQ7Ksf+crACuDpCbq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EFA3.dll
- Size 1.8MB
- SHA256 223759e9e0c53c73d5255e47c1b455d7ccda1d050809446300485c0747d16981
- MD5 4dca89f3a66ae9ac204beea85d7a3d75
- SHA1 5cc81459e35f27a79047c4e041a65739cc91a067
- SHA512 67dd36ca578ae7bfe3ebd167f193fe35513841aaa3a5f3124c4a1ae04241c554a0ff26a9afcee4e3ad4aaa8528b96e99a89192c7f1fc22dead81ad9af36a4906
- SSDEEP 49152:5s3IkmHGmu8UDV3CXTlkhSPbvWYV3UFSBXH+f:5s4zHpulADd/1U0X+f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EFA3.dll
- Size 1.8MB
- SHA256 223759e9e0c53c73d5255e47c1b455d7ccda1d050809446300485c0747d16981
- MD5 4dca89f3a66ae9ac204beea85d7a3d75
- SHA1 5cc81459e35f27a79047c4e041a65739cc91a067
- SHA512 67dd36ca578ae7bfe3ebd167f193fe35513841aaa3a5f3124c4a1ae04241c554a0ff26a9afcee4e3ad4aaa8528b96e99a89192c7f1fc22dead81ad9af36a4906
- SSDEEP 49152:5s3IkmHGmu8UDV3CXTlkhSPbvWYV3UFSBXH+f:5s4zHpulADd/1U0X+f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ba6bd237-a6f5-49fd-9bc5-95ecda6135c9\EBD9.exe
- Size 713KB
- SHA256 ee58c869d7a419d55fe3e6a8cf001ffff107d5d922951b3999b79b2b6c7e1c27
- MD5 b7bc860cee7201e0c810642890a03246
- SHA1 d9edc9d61baf9d8cad3f840bba699ffd9219cce0
- SHA512 5e65e33f02c937167a03d283ab6510aab82f221d11ef3c65833bbf669df89136418889e09c5d2d6b6221fe3a47da3bb363a485b9f5ea210cfde35d7b50f7a594
- SSDEEP 12288:+sStMiFoDs026KEj5iBiAIqNsPst+EKsf6fkQzOhheBT+upZTpy/bIdYS8I5DoGn:+sfit/6KEVmiAZNaQ7Ksf+crACuDpCbq
- MD5 SHA1 SHA512 SSDEEP