ctblocker | d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe
Size

954KB
MD5

856cefc0c0bbe54ac88d71135c3437df
SHA1

a3175ff2386fb6a266743fba99e72549b5281d62
SHA256

d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79
SHA512

17d369d2ca266b72abbabb41405699f09934525175e230d7fa4342efa6242e0642a9b23f60c23934aa33e63cd7e31715356ce948ccabd3510274da028e99eb65
SSDEEP

24576:pWt9iMnSn9wESmhYJBg3CztbeNr5X4GOL8:Ut9iMnSn9wE8JqYtaNr5XsY

Score

10^/10

ctblocker ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-abrgzxi.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://pf5dahldauhrjxfd.onion.cab or http://pf5dahldauhrjxfd.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://pf5dahldauhrjxfd.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. PNTWLNP-5NWGYBY-HS7X4XB-DY6SQPM-BXFCXEV-MUHL6HZ-WGQFIHD-ZRMFJ4A I2FW5N3-37XBAXS-G447I4Z-JPRW5WY-JQJMJLE-7I3GVVO-4LT2PL7-7HYKKMN HJUN2YH-RV2ITAE-XAF5UTN-IQJYHI2-GC26EHO-UISSXP6-HUSJ7YY-IIMVDCG Follow the instructions on the server.

URLs

http://pf5dahldauhrjxfd.onion.cab

http://pf5dahldauhrjxfd.tor2web.org

http://pf5dahldauhrjxfd.onion/

Extracted

Path

C:\Users\Admin\Documents\!Decrypt-All-Files-abrgzxi.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://pf5dahldauhrjxfd.onion.cab or http://pf5dahldauhrjxfd.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://pf5dahldauhrjxfd.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. PNTWLNP-5NWGYBY-HS7X4XB-DY6SQPM-BXFCXEV-MUHL6HZ-WGQFIHD-ZRMFJ4A I2FW5N3-37XBAXS-G447I4Z-JPRW5WY-JQJMJLE-7I3GVVO-4LT2PL7-7HYKKMN HJUN2YH-RV2ITAE-XAF5UTN-IQJYHI2-GC26WVO-QRSSXP6-HUSJ7YY-IIMFPIT Follow the instructions on the server.

URLs

http://pf5dahldauhrjxfd.onion.cab

http://pf5dahldauhrjxfd.tor2web.org

http://pf5dahldauhrjxfd.onion/

Extracted

Path

C:\ProgramData\zlwdkgg.html

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://pf5dahldauhrjxfd.onion.cab or http://pf5dahldauhrjxfd.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org. 2. In the Tor Browser open the http://pf5dahldauhrjxfd.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. Follow the instructions on the server. The list of your encrypted files: Path File

URLs

http://pf5dahldauhrjxfd.onion.cab

http://pf5dahldauhrjxfd.tor2web.org

http://pf5dahldauhrjxfd.onion

Signatures

CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
ransomware ctblocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 4 IoCs

Processes:

pdfisga.exepdfisga.EXepdfisga.EXepdfisga.EXe

pid process

2020 pdfisga.exe
1464 pdfisga.EXe
1184 pdfisga.EXe
2032 pdfisga.EXe

pid	process
2020	pdfisga.exe
1464	pdfisga.EXe
1184	pdfisga.EXe
2032	pdfisga.EXe

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

svchost.exe

description	ioc	process
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\ReadClose.CRW.abrgzxi	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\DismountOpen.RAW.abrgzxi	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\GrantLimit.RAW.abrgzxi	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

pdfisga.EXe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation pdfisga.EXe
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini svchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	pdfisga.EXe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Drops file in System32 directory 1 IoCs

Processes:

pdfisga.EXe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	pdfisga.EXe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\!Decrypt-All-Files-abrgzxi.bmp"	Explorer.EXE

Suspicious use of SetThreadContext 3 IoCs

Processes:

d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exepdfisga.exepdfisga.EXe

description	pid	process	target process
PID 1048 set thread context of 948	1048	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXe
PID 2020 set thread context of 1464	2020	pdfisga.exe	pdfisga.EXe
PID 1184 set thread context of 2032	1184	pdfisga.EXe	pdfisga.EXe

Drops file in Program Files directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-abrgzxi.txt	svchost.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-abrgzxi.bmp	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1924 vssadmin.exe

pid	process
1924	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

pdfisga.EXe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	pdfisga.EXe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	pdfisga.EXe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	pdfisga.EXe

Modifies data under HKEY_USERS 20 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{dae07ae4-2a34-11ed-86c6-806e6f6e6963}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{dae07ae4-2a34-11ed-86c6-806e6f6e6963}\MaxCapacity = "15140"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00640061006500300037006100650034002d0032006100330034002d0031003100650064002d0038003600630036002d003800300036006500360066003600650036003900360033007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{dae07ae4-2a34-11ed-86c6-806e6f6e6963}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	svchost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXepdfisga.EXe

pid	process
948	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe
1464	pdfisga.EXe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

pdfisga.EXeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1464	pdfisga.EXe
Token: SeDebugPrivilege	1464	pdfisga.EXe
Token: SeShutdownPrivilege	1400	Explorer.EXE
Token: SeShutdownPrivilege	1400	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

pdfisga.EXe

pid process

2032 pdfisga.EXe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

pdfisga.EXe

pid process

2032 pdfisga.EXe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exepdfisga.exepdfisga.EXepdfisga.EXe

pid process

1048 d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe
2020 pdfisga.exe
1184 pdfisga.EXe
2032 pdfisga.EXe
2032 pdfisga.EXe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE

pid	process
2032	pdfisga.EXe

pid	process
2032	pdfisga.EXe

pid	process
1048	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe
2020	pdfisga.exe
1184	pdfisga.EXe
2032	pdfisga.EXe
2032	pdfisga.EXe

pid	process
1400	Explorer.EXE

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exetaskeng.exepdfisga.exepdfisga.EXesvchost.exepdfisga.EXe

description	pid	process	target process
PID 1048 wrote to memory of 948	1048	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXe
PID 1048 wrote to memory of 948	1048	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXe
PID 1048 wrote to memory of 948	1048	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXe
PID 1048 wrote to memory of 948	1048	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXe
PID 1048 wrote to memory of 948	1048	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXe
PID 1048 wrote to memory of 948	1048	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXe
PID 1048 wrote to memory of 948	1048	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe	d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXe
PID 768 wrote to memory of 2020	768	taskeng.exe	pdfisga.exe
PID 768 wrote to memory of 2020	768	taskeng.exe	pdfisga.exe
PID 768 wrote to memory of 2020	768	taskeng.exe	pdfisga.exe
PID 768 wrote to memory of 2020	768	taskeng.exe	pdfisga.exe
PID 2020 wrote to memory of 1464	2020	pdfisga.exe	pdfisga.EXe
PID 2020 wrote to memory of 1464	2020	pdfisga.exe	pdfisga.EXe
PID 2020 wrote to memory of 1464	2020	pdfisga.exe	pdfisga.EXe
PID 2020 wrote to memory of 1464	2020	pdfisga.exe	pdfisga.EXe
PID 2020 wrote to memory of 1464	2020	pdfisga.exe	pdfisga.EXe
PID 2020 wrote to memory of 1464	2020	pdfisga.exe	pdfisga.EXe
PID 2020 wrote to memory of 1464	2020	pdfisga.exe	pdfisga.EXe
PID 1464 wrote to memory of 592	1464	pdfisga.EXe	svchost.exe
PID 592 wrote to memory of 744	592	svchost.exe	DllHost.exe
PID 592 wrote to memory of 744	592	svchost.exe	DllHost.exe
PID 592 wrote to memory of 744	592	svchost.exe	DllHost.exe
PID 1464 wrote to memory of 1400	1464	pdfisga.EXe	Explorer.EXE
PID 1464 wrote to memory of 1924	1464	pdfisga.EXe	vssadmin.exe
PID 1464 wrote to memory of 1924	1464	pdfisga.EXe	vssadmin.exe
PID 1464 wrote to memory of 1924	1464	pdfisga.EXe	vssadmin.exe
PID 1464 wrote to memory of 1924	1464	pdfisga.EXe	vssadmin.exe
PID 1464 wrote to memory of 1184	1464	pdfisga.EXe	pdfisga.EXe
PID 1464 wrote to memory of 1184	1464	pdfisga.EXe	pdfisga.EXe
PID 1464 wrote to memory of 1184	1464	pdfisga.EXe	pdfisga.EXe
PID 1464 wrote to memory of 1184	1464	pdfisga.EXe	pdfisga.EXe
PID 1184 wrote to memory of 2032	1184	pdfisga.EXe	pdfisga.EXe
PID 1184 wrote to memory of 2032	1184	pdfisga.EXe	pdfisga.EXe
PID 1184 wrote to memory of 2032	1184	pdfisga.EXe	pdfisga.EXe
PID 1184 wrote to memory of 2032	1184	pdfisga.EXe	pdfisga.EXe
PID 1184 wrote to memory of 2032	1184	pdfisga.EXe	pdfisga.EXe
PID 1184 wrote to memory of 2032	1184	pdfisga.EXe	pdfisga.EXe
PID 1184 wrote to memory of 2032	1184	pdfisga.EXe	pdfisga.EXe
PID 592 wrote to memory of 1952	592	svchost.exe	DllHost.exe
PID 592 wrote to memory of 1952	592	svchost.exe	DllHost.exe
PID 592 wrote to memory of 1952	592	svchost.exe	DllHost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:1400

C:\Users\Admin\AppData\Local\Temp\d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe
"C:\Users\Admin\AppData\Local\Temp\d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048

C:\Users\Admin\AppData\Local\Temp\d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXe
"C:\Users\Admin\AppData\Local\Temp/d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79.EXe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:744

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:1952

C:\Windows\system32\taskeng.exe
taskeng.exe {6BA5B8A4-ED58-4357-8B16-308408FF3003} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:768

C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\pdfisga.EXe
"C:\Users\Admin\AppData\Local\Temp/pdfisga.EXe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows all
4⤵
- Interacts with shadow copies
PID:1924

C:\Users\Admin\AppData\Local\Temp\pdfisga.EXe
"C:\Users\Admin\AppData\Local\Temp\pdfisga.EXe" -u
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184

C:\Users\Admin\AppData\Local\Temp\pdfisga.EXe
"C:\Users\Admin\AppData\Local\Temp/pdfisga.EXe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2032

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\xptppml
Filesize
654B

MD5
9e399d5697fb2819c1662036024749d8

SHA1
12def11533993fab9e894039c9bc92d79e1620f8

SHA256
96ffd334aa66366b7bc393fdb538261574c7c488b89d7a445a203f31dfb5870a

SHA512
313136ffcdd1c1fbbd17664439acb9967785be2630926ce516036eba9dcb0d968ae39a397fa81b0e3f76d5c1be2127b8f80b194783d02a1542b2abc22ccfe06d

Download Submit
C:\ProgramData\Mozilla\xptppml
Filesize
654B

MD5
a42183c956fd1e97ff781903ffb2a187

SHA1
c44398228c866b9141d37a494efd72b8a5b8fbd3

SHA256
239d453a7600d593bd484986887b817a983d4fdc7b08a6ad1b03fab6499bbad6

SHA512
70b5e07536831b4abd176e4e8dc45f4cde6dae316ac411355f72444063c6e0c87f61090115f0ff1febd32705637dd4c0421750f2ef894bbda5d532ed1e205165

Download Submit
C:\ProgramData\Mozilla\xptppml
Filesize
654B

MD5
280833d8f3d449546280b23f61529182

SHA1
cb07eaf80710b1dba828dddae2d0de4a9e350c20

SHA256
7c5babb11343d46eff1b34c5de6ae3fc7b6576590dd60393cbeee377b8f85bfe

SHA512
84417cc9572d76100c74b52ae97e486ce2c27baa4fc3224d73735e922bf7b1050f620444ae2f778ff44779cd81611b4894849dd6b972b74e6e48d3205380ba63

Download Submit
C:\ProgramData\Mozilla\xptppml
Filesize
654B

MD5
7373315d28635fe40fcd87fe07e65043

SHA1
0286caecba99492776b019133f8158b8fc340316

SHA256
f7921d126aceb0a271ea7bf74051edf3016d43264f03392ec993e37fb0007a66

SHA512
de22618f49a73b0f4794f25e917af0af5b467c4d933c26d215f7af84de21effb9dec3306fbb6860f0f93080421f1c1d0625257d95ac273d86c46fc86e32e01a7

Download Submit
C:\ProgramData\zlwdkgg.html
Filesize
62KB

MD5
eaafd5ad96c6ada32099a7cfb15f1e3d

SHA1
c01e035b9c9cf7a5c14cb00d372b445e9f44b6d9

SHA256
10878f586a5d4779b3f5f0be95a88da81b0775532cf8be9cd3fa3e3f17fa1bb4

SHA512
b74d01281125a2599b645fd80457594c6c9d317f4c50ca47adda76ae6e9b2b2d8224bd56e7717642acd84970282da69bb09c4e2f77232532b05f402e06fec361

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
Filesize
954KB

MD5
856cefc0c0bbe54ac88d71135c3437df

SHA1
a3175ff2386fb6a266743fba99e72549b5281d62

SHA256
d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79

SHA512
17d369d2ca266b72abbabb41405699f09934525175e230d7fa4342efa6242e0642a9b23f60c23934aa33e63cd7e31715356ce948ccabd3510274da028e99eb65

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
Filesize
954KB

MD5
856cefc0c0bbe54ac88d71135c3437df

SHA1
a3175ff2386fb6a266743fba99e72549b5281d62

SHA256
d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79

SHA512
17d369d2ca266b72abbabb41405699f09934525175e230d7fa4342efa6242e0642a9b23f60c23934aa33e63cd7e31715356ce948ccabd3510274da028e99eb65

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
Filesize
954KB

MD5
856cefc0c0bbe54ac88d71135c3437df

SHA1
a3175ff2386fb6a266743fba99e72549b5281d62

SHA256
d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79

SHA512
17d369d2ca266b72abbabb41405699f09934525175e230d7fa4342efa6242e0642a9b23f60c23934aa33e63cd7e31715356ce948ccabd3510274da028e99eb65

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
Filesize
954KB

MD5
856cefc0c0bbe54ac88d71135c3437df

SHA1
a3175ff2386fb6a266743fba99e72549b5281d62

SHA256
d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79

SHA512
17d369d2ca266b72abbabb41405699f09934525175e230d7fa4342efa6242e0642a9b23f60c23934aa33e63cd7e31715356ce948ccabd3510274da028e99eb65

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
Filesize
954KB

MD5
856cefc0c0bbe54ac88d71135c3437df

SHA1
a3175ff2386fb6a266743fba99e72549b5281d62

SHA256
d6f34c4fb40c7f7cf66efbf0eb1bfd3a55089f65181d4d0c2de3c183f7527c79

SHA512
17d369d2ca266b72abbabb41405699f09934525175e230d7fa4342efa6242e0642a9b23f60c23934aa33e63cd7e31715356ce948ccabd3510274da028e99eb65

Download Submit
memory/592-91-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/592-87-0x00000000003E0000-0x0000000000457000-memory.dmp

Filesize
476KB

Download
memory/592-85-0x00000000003E0000-0x0000000000457000-memory.dmp

Filesize
476KB

Download
memory/744-90-0x0000000000000000-mapping.dmp

Download
memory/948-67-0x00000000008E0000-0x0000000000B2B000-memory.dmp

Filesize
2.3MB

Download
memory/948-56-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/948-57-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/948-64-0x00000000006C0000-0x00000000008DA000-memory.dmp

Filesize
2.1MB

Download
memory/948-61-0x0000000000401FA3-mapping.dmp

Download
memory/948-66-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/948-68-0x0000000000400000-0x00000000004A4600-memory.dmp

Filesize
657KB

Download
memory/948-60-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1048-59-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1048-62-0x00000000029F0000-0x0000000002A3C000-memory.dmp

Filesize
304KB

Download
memory/1048-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1184-98-0x0000000000000000-mapping.dmp

Download
memory/1184-108-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1464-84-0x00000000006D0000-0x000000000091B000-memory.dmp

Filesize
2.3MB

Download
memory/1464-78-0x0000000000401FA3-mapping.dmp

Download
memory/1924-97-0x0000000000000000-mapping.dmp

Download
memory/1952-114-0x0000000000000000-mapping.dmp

Download
memory/2020-79-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2020-70-0x0000000000000000-mapping.dmp

Download
memory/2032-106-0x0000000000401FA3-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads