abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d

General

Target

abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe
Size

480KB
MD5

3bb8bae41ded94cb3f961f992b5598ff
SHA1

81b32fc9b49fe072afe3dade910ae59df6afbf25
SHA256

abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d
SHA512

3e9001f9fe23bd85fa36599fb5027516698e25ba6e7232bef84e4491840359505125be51841cceecea428c010087da64d61f302e7305df8ac9843fdec3ebedd0
SSDEEP

6144:ELPR3Ff6La0csj61smJp/KynSjLR+guvNH+JWUiuX1UJbiPBy9x:K3Ff70cZsmJpBnG+dFHAPnUBMcx

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-575491160-2295418218-1540667289-1000\_ReCoVeRy_+eiwqm.txt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So , there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: * http://t54ndnku456ngkwsudqer.wallymac.com/AB0C85B23396F56 * http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/AB0C85B23396F56 * http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/AB0C85B23396F56 If for some reasons the addresses are not available, follow these steps 1 Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 After a successful installation, run the browser 3 Type in the address bar: xlowfznrg4wf7dli.onion/AB0C85B23396F56 4 Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://t54ndnku456ngkwsudqer.wallymac.com/AB0C85B23396F56 http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/AB0C85B23396F56 http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/AB0C85B23396F56 Your personal pages TOR Browser xlowfznrg4wf7dli. onion/AB0C85B23396F56

URLs

http://t54ndnku456ngkwsudqer.wallymac.com/AB0C85B23396F56

http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/AB0C85B23396F56

http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/AB0C85B23396F56

http://xlowfznrg4wf7dli.onion/AB0C85B23396F56

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 1 IoCs

Processes:

yjxkousmwvot.exe

pid process

1656 yjxkousmwvot.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

520 cmd.exe

pid	process
520	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

yjxkousmwvot.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\SOFTWARE\MicROsoft\WINDOWS\CurrentVersion\RUN	yjxkousmwvot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ieuwsuf = "C:\\Windows\\SYSTEM32\\CMD.EXE /C START C:\\Windows\\yjxkousmwvot.exe"	yjxkousmwvot.exe

Drops file in Program Files directory 64 IoCs

Processes:

yjxkousmwvot.exe

description	ioc	process
File opened for modification	C:\Program Files\DVD Maker\de-DE\_ReCoVeRy_+eiwqm.html	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\_ReCoVeRy_+eiwqm.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\_ReCoVeRy_+eiwqm.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\_ReCoVeRy_+eiwqm.html	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrome.7z	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\System\ja-JP\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\_ReCoVeRy_+eiwqm.html	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\_ReCoVeRy_+eiwqm.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\_ReCoVeRy_+eiwqm.html	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\_ReCoVeRy_+eiwqm.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\_ReCoVeRy_+eiwqm.html	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\bg.pak	yjxkousmwvot.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\_ReCoVeRy_+eiwqm.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\_ReCoVeRy_+eiwqm.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\_ReCoVeRy_+eiwqm.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\_ReCoVeRy_+eiwqm.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\am.pak	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\_ReCoVeRy_+eiwqm.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\_ReCoVeRy_+eiwqm.html	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\_ReCoVeRy_+eiwqm.html	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\Logo.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\_ReCoVeRy_+eiwqm.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\_ReCoVeRy_+eiwqm.html	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\ja-JP\_ReCoVeRy_+eiwqm.txt	yjxkousmwvot.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\_ReCoVeRy_+eiwqm.png	yjxkousmwvot.exe

Drops file in Windows directory 2 IoCs

Processes:

abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe

description	ioc	process
File opened for modification	C:\Windows\yjxkousmwvot.exe	abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe
File created	C:\Windows\yjxkousmwvot.exe	abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

yjxkousmwvot.exe

pid	process
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe
1656	yjxkousmwvot.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exeyjxkousmwvot.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	968	abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe
Token: SeDebugPrivilege	1656	yjxkousmwvot.exe
Token: SeIncreaseQuotaPrivilege	1568	WMIC.exe
Token: SeSecurityPrivilege	1568	WMIC.exe
Token: SeTakeOwnershipPrivilege	1568	WMIC.exe
Token: SeLoadDriverPrivilege	1568	WMIC.exe
Token: SeSystemProfilePrivilege	1568	WMIC.exe
Token: SeSystemtimePrivilege	1568	WMIC.exe
Token: SeProfSingleProcessPrivilege	1568	WMIC.exe
Token: SeIncBasePriorityPrivilege	1568	WMIC.exe
Token: SeCreatePagefilePrivilege	1568	WMIC.exe
Token: SeBackupPrivilege	1568	WMIC.exe
Token: SeRestorePrivilege	1568	WMIC.exe
Token: SeShutdownPrivilege	1568	WMIC.exe
Token: SeDebugPrivilege	1568	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1568	WMIC.exe
Token: SeRemoteShutdownPrivilege	1568	WMIC.exe
Token: SeUndockPrivilege	1568	WMIC.exe
Token: SeManageVolumePrivilege	1568	WMIC.exe
Token: 33	1568	WMIC.exe
Token: 34	1568	WMIC.exe
Token: 35	1568	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1568	WMIC.exe
Token: SeSecurityPrivilege	1568	WMIC.exe
Token: SeTakeOwnershipPrivilege	1568	WMIC.exe
Token: SeLoadDriverPrivilege	1568	WMIC.exe
Token: SeSystemProfilePrivilege	1568	WMIC.exe
Token: SeSystemtimePrivilege	1568	WMIC.exe
Token: SeProfSingleProcessPrivilege	1568	WMIC.exe
Token: SeIncBasePriorityPrivilege	1568	WMIC.exe
Token: SeCreatePagefilePrivilege	1568	WMIC.exe
Token: SeBackupPrivilege	1568	WMIC.exe
Token: SeRestorePrivilege	1568	WMIC.exe
Token: SeShutdownPrivilege	1568	WMIC.exe
Token: SeDebugPrivilege	1568	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1568	WMIC.exe
Token: SeRemoteShutdownPrivilege	1568	WMIC.exe
Token: SeUndockPrivilege	1568	WMIC.exe
Token: SeManageVolumePrivilege	1568	WMIC.exe
Token: 33	1568	WMIC.exe
Token: 34	1568	WMIC.exe
Token: 35	1568	WMIC.exe
Token: SeBackupPrivilege	2004	vssvc.exe
Token: SeRestorePrivilege	2004	vssvc.exe
Token: SeAuditPrivilege	2004	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exeyjxkousmwvot.exe

description	pid	process	target process
PID 968 wrote to memory of 1656	968	abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe	yjxkousmwvot.exe
PID 968 wrote to memory of 1656	968	abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe	yjxkousmwvot.exe
PID 968 wrote to memory of 1656	968	abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe	yjxkousmwvot.exe
PID 968 wrote to memory of 1656	968	abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe	yjxkousmwvot.exe
PID 968 wrote to memory of 520	968	abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe	cmd.exe
PID 968 wrote to memory of 520	968	abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe	cmd.exe
PID 968 wrote to memory of 520	968	abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe	cmd.exe
PID 968 wrote to memory of 520	968	abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe	cmd.exe
PID 1656 wrote to memory of 1568	1656	yjxkousmwvot.exe	WMIC.exe
PID 1656 wrote to memory of 1568	1656	yjxkousmwvot.exe	WMIC.exe
PID 1656 wrote to memory of 1568	1656	yjxkousmwvot.exe	WMIC.exe
PID 1656 wrote to memory of 1568	1656	yjxkousmwvot.exe	WMIC.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

yjxkousmwvot.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yjxkousmwvot.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	yjxkousmwvot.exe

C:\Users\Admin\AppData\Local\Temp\abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe
"C:\Users\Admin\AppData\Local\Temp\abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\yjxkousmwvot.exe
C:\Windows\yjxkousmwvot.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1656

C:\Windows\System32\wbem\WMIC.exe
"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\ABE4D0~1.EXE
2⤵
- Deletes itself
PID:520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\yjxkousmwvot.exe

Filesize
480KB

MD5
3bb8bae41ded94cb3f961f992b5598ff

SHA1
81b32fc9b49fe072afe3dade910ae59df6afbf25

SHA256
abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d

SHA512
3e9001f9fe23bd85fa36599fb5027516698e25ba6e7232bef84e4491840359505125be51841cceecea428c010087da64d61f302e7305df8ac9843fdec3ebedd0

Download Submit
C:\Windows\yjxkousmwvot.exe

Filesize
480KB

MD5
3bb8bae41ded94cb3f961f992b5598ff

SHA1
81b32fc9b49fe072afe3dade910ae59df6afbf25

SHA256
abe4d0fe62e083e04e8c55a9988cdf97a6b1d0229771874ee8c46488d1bdc10d

SHA512
3e9001f9fe23bd85fa36599fb5027516698e25ba6e7232bef84e4491840359505125be51841cceecea428c010087da64d61f302e7305df8ac9843fdec3ebedd0

Download Submit
memory/520-62-0x0000000000000000-mapping.dmp

Download
memory/968-54-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/968-55-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/968-59-0x00000000002A0000-0x0000000000326000-memory.dmp

Filesize
536KB

Download
memory/1568-70-0x0000000000000000-mapping.dmp

Download
memory/1656-60-0x0000000000000000-mapping.dmp

Download
memory/1656-64-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/1656-68-0x0000000001C60000-0x0000000001CE6000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads