teslacrypt | eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d

General

Target

eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe
Size

352KB
MD5

7426abca716ab576b667c130dc31c470
SHA1

1e375576e068393dd947462dc16b9b8f685a346a
SHA256

eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d
SHA512

672f01eb4e71ff9442c4e8d9a1b2ee1459d6ffb41551df6c6a32ee91510e1f9e524e82ddabdb8620efb7f29cedca9a3abd2b071f4eb0a195a7140749923d3543
SSDEEP

6144:mS48iSC8d+s1ScRmCHY++2RaKcUu4lzyWHBzRrvF:BHC4xkB2ROOBVrv

Score

10^/10

teslacrypt persistence ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_ReCoVeRy_+ugeod.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/8AFF19DE6AB18461 2 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/8AFF19DE6AB18461 3 - http://yyre45dbvn2nhbefbmh.begumvelic.at/8AFF19DE6AB18461 If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/8AFF19DE6AB18461 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/8AFF19DE6AB18461 http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/8AFF19DE6AB18461 http://yyre45dbvn2nhbefbmh.begumvelic.at/8AFF19DE6AB18461 Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/8AFF19DE6AB18461

URLs

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/8AFF19DE6AB18461

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/8AFF19DE6AB18461

http://yyre45dbvn2nhbefbmh.begumvelic.at/8AFF19DE6AB18461

http://xlowfznrg4wf7dli.ONION/8AFF19DE6AB18461

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 1 IoCs

Processes:

bmrjnyuxlfpj.exe

pid process

3136 bmrjnyuxlfpj.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exebmrjnyuxlfpj.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	bmrjnyuxlfpj.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bmrjnyuxlfpj.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\RUN	bmrjnyuxlfpj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sgfcper = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\bmrjnyuxlfpj.exe"	bmrjnyuxlfpj.exe

Drops file in Program Files directory 64 IoCs

Processes:

bmrjnyuxlfpj.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\System\Ole DB\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\el-GR\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\System\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\System\ado\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\el-GR\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\th-TH\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-MX\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-GB\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\_ReCoVeRy_+ugeod.png	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-GB\_ReCoVeRy_+ugeod.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\et-EE\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\th-TH\_ReCoVeRy_+ugeod.html	bmrjnyuxlfpj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_200_percent.pak	bmrjnyuxlfpj.exe

Drops file in Windows directory 2 IoCs

Processes:

eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe

description	ioc	process
File created	C:\Windows\bmrjnyuxlfpj.exe	eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe
File opened for modification	C:\Windows\bmrjnyuxlfpj.exe	eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

bmrjnyuxlfpj.exe

pid	process
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe
3136	bmrjnyuxlfpj.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

Processes:

eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exebmrjnyuxlfpj.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4644	eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe
Token: SeDebugPrivilege	3136	bmrjnyuxlfpj.exe
Token: SeIncreaseQuotaPrivilege	340	WMIC.exe
Token: SeSecurityPrivilege	340	WMIC.exe
Token: SeTakeOwnershipPrivilege	340	WMIC.exe
Token: SeLoadDriverPrivilege	340	WMIC.exe
Token: SeSystemProfilePrivilege	340	WMIC.exe
Token: SeSystemtimePrivilege	340	WMIC.exe
Token: SeProfSingleProcessPrivilege	340	WMIC.exe
Token: SeIncBasePriorityPrivilege	340	WMIC.exe
Token: SeCreatePagefilePrivilege	340	WMIC.exe
Token: SeBackupPrivilege	340	WMIC.exe
Token: SeRestorePrivilege	340	WMIC.exe
Token: SeShutdownPrivilege	340	WMIC.exe
Token: SeDebugPrivilege	340	WMIC.exe
Token: SeSystemEnvironmentPrivilege	340	WMIC.exe
Token: SeRemoteShutdownPrivilege	340	WMIC.exe
Token: SeUndockPrivilege	340	WMIC.exe
Token: SeManageVolumePrivilege	340	WMIC.exe
Token: 33	340	WMIC.exe
Token: 34	340	WMIC.exe
Token: 35	340	WMIC.exe
Token: 36	340	WMIC.exe
Token: SeIncreaseQuotaPrivilege	340	WMIC.exe
Token: SeSecurityPrivilege	340	WMIC.exe
Token: SeTakeOwnershipPrivilege	340	WMIC.exe
Token: SeLoadDriverPrivilege	340	WMIC.exe
Token: SeSystemProfilePrivilege	340	WMIC.exe
Token: SeSystemtimePrivilege	340	WMIC.exe
Token: SeProfSingleProcessPrivilege	340	WMIC.exe
Token: SeIncBasePriorityPrivilege	340	WMIC.exe
Token: SeCreatePagefilePrivilege	340	WMIC.exe
Token: SeBackupPrivilege	340	WMIC.exe
Token: SeRestorePrivilege	340	WMIC.exe
Token: SeShutdownPrivilege	340	WMIC.exe
Token: SeDebugPrivilege	340	WMIC.exe
Token: SeSystemEnvironmentPrivilege	340	WMIC.exe
Token: SeRemoteShutdownPrivilege	340	WMIC.exe
Token: SeUndockPrivilege	340	WMIC.exe
Token: SeManageVolumePrivilege	340	WMIC.exe
Token: 33	340	WMIC.exe
Token: 34	340	WMIC.exe
Token: 35	340	WMIC.exe
Token: 36	340	WMIC.exe
Token: SeBackupPrivilege	4320	vssvc.exe
Token: SeRestorePrivilege	4320	vssvc.exe
Token: SeAuditPrivilege	4320	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exebmrjnyuxlfpj.exe

description	pid	process	target process
PID 4644 wrote to memory of 3136	4644	eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe	bmrjnyuxlfpj.exe
PID 4644 wrote to memory of 3136	4644	eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe	bmrjnyuxlfpj.exe
PID 4644 wrote to memory of 3136	4644	eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe	bmrjnyuxlfpj.exe
PID 4644 wrote to memory of 1608	4644	eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe	cmd.exe
PID 4644 wrote to memory of 1608	4644	eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe	cmd.exe
PID 4644 wrote to memory of 1608	4644	eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe	cmd.exe
PID 3136 wrote to memory of 340	3136	bmrjnyuxlfpj.exe	WMIC.exe
PID 3136 wrote to memory of 340	3136	bmrjnyuxlfpj.exe	WMIC.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

bmrjnyuxlfpj.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	bmrjnyuxlfpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bmrjnyuxlfpj.exe

C:\Users\Admin\AppData\Local\Temp\eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe
"C:\Users\Admin\AppData\Local\Temp\eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\bmrjnyuxlfpj.exe
  C:\Windows\bmrjnyuxlfpj.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3136
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\EEC360~1.EXE
  2⤵
  PID:1608

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bmrjnyuxlfpj.exe

Filesize
352KB

MD5
7426abca716ab576b667c130dc31c470

SHA1
1e375576e068393dd947462dc16b9b8f685a346a

SHA256
eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d

SHA512
672f01eb4e71ff9442c4e8d9a1b2ee1459d6ffb41551df6c6a32ee91510e1f9e524e82ddabdb8620efb7f29cedca9a3abd2b071f4eb0a195a7140749923d3543

Download Submit
C:\Windows\bmrjnyuxlfpj.exe

Filesize
352KB

MD5
7426abca716ab576b667c130dc31c470

SHA1
1e375576e068393dd947462dc16b9b8f685a346a

SHA256
eec3604acc91abae3343db62517ef3a8e9a222b6ef86660ba7b20173dc91ba4d

SHA512
672f01eb4e71ff9442c4e8d9a1b2ee1459d6ffb41551df6c6a32ee91510e1f9e524e82ddabdb8620efb7f29cedca9a3abd2b071f4eb0a195a7140749923d3543

Download Submit
memory/340-149-0x0000000000000000-mapping.dmp

Download
memory/1608-143-0x0000000000000000-mapping.dmp

Download
memory/3136-139-0x0000000000000000-mapping.dmp

Download
memory/3136-148-0x0000000002100000-0x0000000002186000-memory.dmp

Filesize
536KB

Download
memory/4644-135-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4644-142-0x0000000002220000-0x00000000022A6000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads