9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2

General

Target

9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
Size

260KB
MD5

105833e760b09cbde85e0077f9e9d49e
SHA1

3f08a1c94510574f013debac02f93fcdec7ab796
SHA256

9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2
SHA512

92258448944a1c9e95212ba2cda0cd172a08ca772712a93da4a7f456e622ce49a2c2e8f67ae332fd5bdad95548aa67202dc3e97db794b0fb05dabf6cb36e43ed
SSDEEP

6144:dT79rfiNK9tqna0atlq3w27v00L2gubvsznNH/f:dTprfga0P3cgz5f

Score

9^/10

ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 2 IoCs

Processes:

explorer.exesvchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bcf8801.exe	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bcf8801.exe:1	svchost.exe

Drops file in System32 directory 8 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe

description	pid	process	target process
PID 1380 set thread context of 824	1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1008 vssadmin.exe

pid	process
1008	vssadmin.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A989315-2F3E-4F27-9653-DE8A5C45D76E}\b2-de-03-54-62-3a	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A989315-2F3E-4F27-9653-DE8A5C45D76E}\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A989315-2F3E-4F27-9653-DE8A5C45D76E}	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-de-03-54-62-3a	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-de-03-54-62-3a\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A989315-2F3E-4F27-9653-DE8A5C45D76E}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-de-03-54-62-3a\WpadDecisionTime = c0efb4aecf00d901	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-de-03-54-62-3a\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A989315-2F3E-4F27-9653-DE8A5C45D76E}\WpadDecisionTime = c0efb4aecf00d901	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A989315-2F3E-4F27-9653-DE8A5C45D76E}\WpadNetworkName = "Network 2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe

NTFS ADS 2 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\bcf8801.exe:1 svchost.exe
File created C:\bcf8801\bcf8801.exe:1 svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\bcf8801.exe:1	svchost.exe
File created	C:\bcf8801\bcf8801.exe:1	svchost.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exesvchost.exe

pid	process
1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
1556	svchost.exe
1556	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1212

pid	process
1212

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exeexplorer.exe

pid	process
824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
1116	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 888 vssvc.exe
Token: SeRestorePrivilege 888 vssvc.exe
Token: SeAuditPrivilege 888 vssvc.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1212
1212
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

pid process

1212
1212
1212
1212
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe

pid process

1380 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe

description	pid	process
Token: SeBackupPrivilege	888	vssvc.exe
Token: SeRestorePrivilege	888	vssvc.exe
Token: SeAuditPrivilege	888	vssvc.exe

pid	process
1212
1212

pid	process
1212
1212
1212
1212

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exeexplorer.exe

description	pid	process	target process
PID 1380 wrote to memory of 824	1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
PID 1380 wrote to memory of 824	1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
PID 1380 wrote to memory of 824	1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
PID 1380 wrote to memory of 824	1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
PID 1380 wrote to memory of 824	1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
PID 1380 wrote to memory of 824	1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
PID 1380 wrote to memory of 824	1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
PID 1380 wrote to memory of 824	1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
PID 1380 wrote to memory of 824	1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
PID 1380 wrote to memory of 824	1380	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
PID 824 wrote to memory of 1116	824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	explorer.exe
PID 824 wrote to memory of 1116	824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	explorer.exe
PID 824 wrote to memory of 1116	824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	explorer.exe
PID 824 wrote to memory of 1116	824	9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe	explorer.exe
PID 1116 wrote to memory of 1556	1116	explorer.exe	svchost.exe
PID 1116 wrote to memory of 1556	1116	explorer.exe	svchost.exe
PID 1116 wrote to memory of 1556	1116	explorer.exe	svchost.exe
PID 1116 wrote to memory of 1556	1116	explorer.exe	svchost.exe
PID 1116 wrote to memory of 1008	1116	explorer.exe	vssadmin.exe
PID 1116 wrote to memory of 1008	1116	explorer.exe	vssadmin.exe
PID 1116 wrote to memory of 1008	1116	explorer.exe	vssadmin.exe
PID 1116 wrote to memory of 1008	1116	explorer.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
"C:\Users\Admin\AppData\Local\Temp\9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Admin\AppData\Local\Temp\9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
C:\Users\Admin\AppData\Local\Temp\9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\syswow64\explorer.exe
"C:\Windows\syswow64\explorer.exe"
3⤵
- Drops startup file
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\syswow64\svchost.exe
-k netsvcs
4⤵
- Drops startup file
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1556

C:\Windows\syswow64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:1008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:888

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bcf8801.exe:1
Filesize
551KB

MD5
30f505fa06a080a392c0b32ea5a59a24

SHA1
e6b9914684cd90c7e24a4d91a48cb5c8c71a20c5

SHA256
029746aa3914b912871ddf7ee534710841b43a7c5628ae289643dde7ca9db73a

SHA512
95ef3f31d8443df317cacb2ec13ab786e1fe2b533fb276bc6e4e76747f9050fd34b5806b4d79f2242588ef21a4cea0a7aeef7fbbd8ba9710a428b4f93208a909

Download Submit
C:\Users\Admin\AppData\Roaming\bcf8801.exe:1
Filesize
551KB

MD5
30f505fa06a080a392c0b32ea5a59a24

SHA1
e6b9914684cd90c7e24a4d91a48cb5c8c71a20c5

SHA256
029746aa3914b912871ddf7ee534710841b43a7c5628ae289643dde7ca9db73a

SHA512
95ef3f31d8443df317cacb2ec13ab786e1fe2b533fb276bc6e4e76747f9050fd34b5806b4d79f2242588ef21a4cea0a7aeef7fbbd8ba9710a428b4f93208a909

Download Submit
C:\bcf8801\bcf8801.exe:1
Filesize
551KB

MD5
30f505fa06a080a392c0b32ea5a59a24

SHA1
e6b9914684cd90c7e24a4d91a48cb5c8c71a20c5

SHA256
029746aa3914b912871ddf7ee534710841b43a7c5628ae289643dde7ca9db73a

SHA512
95ef3f31d8443df317cacb2ec13ab786e1fe2b533fb276bc6e4e76747f9050fd34b5806b4d79f2242588ef21a4cea0a7aeef7fbbd8ba9710a428b4f93208a909

Download Submit
memory/824-55-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/824-56-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/824-58-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/824-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/824-61-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/824-62-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/824-63-0x0000000000418DF0-mapping.dmp

Download
memory/824-65-0x0000000000240000-0x000000000024C000-memory.dmp

Filesize
48KB

Download
memory/824-70-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1008-78-0x0000000000000000-mapping.dmp

Download
memory/1116-74-0x00000000749F1000-0x00000000749F3000-memory.dmp

Filesize
8KB

Download
memory/1116-75-0x0000000000100000-0x000000000012B000-memory.dmp

Filesize
172KB

Download
memory/1116-72-0x0000000000000000-mapping.dmp

Download
memory/1212-69-0x0000000002670000-0x000000000267C000-memory.dmp

Filesize
48KB

Download
memory/1212-76-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1212-71-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1380-64-0x0000000000250000-0x0000000000254000-memory.dmp

Filesize
16KB

Download
memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1556-80-0x0000000000080000-0x00000000000AB000-memory.dmp

Filesize
172KB

Download
memory/1556-84-0x0000000000C10000-0x0000000000C9A000-memory.dmp

Filesize
552KB

Download
memory/1556-85-0x0000000002F50000-0x0000000003087000-memory.dmp

Filesize
1.2MB

Download
memory/1556-77-0x0000000000000000-mapping.dmp

Download
memory/1556-86-0x0000000003090000-0x00000000031F8000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads