Analysis
-
max time kernel
153s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 13:49
Static task
static1
Behavioral task
behavioral1
Sample
af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe
-
Size
380KB
-
MD5
09d90808ed7d4e9e7738fead37273b54
-
SHA1
17fff1085882a35f656515805bde691da1730c08
-
SHA256
af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e
-
SHA512
e29879105ceaa1a04d3498c495df8c699512626ffd9243216bbb98d653a9c3ad013ad79fa2a86767b671427fa62a55c82c54033ef70581d9f7eb6c86cea33ac4
-
SSDEEP
6144:DjNn/yINdVCIlr7m7H6+OWiWlAam4REDEAAYVKeYfqzDyGKM9bifvDNWT5kwhQWw:HU8exTIWlKiEDkveYfqzHw7IT5kwKWce
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\Recovery+wtgqu.txt
Family
teslacrypt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-4096.
More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-4096 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/458DBF1AE2DBA9F
2. http://tes543berda73i48fsdfsd.keratadze.at/458DBF1AE2DBA9F
3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/458DBF1AE2DBA9F
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser
3. Type in the address bar: xlowfznrg4wf7dli.onion/458DBF1AE2DBA9F
4. Follow the instructions on the site.
---------------- IMPORTANT INFORMATION------------------------
*-*-* Your personal pages:
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/458DBF1AE2DBA9F
http://tes543berda73i48fsdfsd.keratadze.at/458DBF1AE2DBA9F
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/458DBF1AE2DBA9F
*-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/458DBF1AE2DBA9F
URLs
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/458DBF1AE2DBA9F
http://tes543berda73i48fsdfsd.keratadze.at/458DBF1AE2DBA9F
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/458DBF1AE2DBA9F
http://xlowfznrg4wf7dli.ONION/458DBF1AE2DBA9F
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
ljhyglfisiar.exeljhyglfisiar.exepid Process 4688 ljhyglfisiar.exe 636 ljhyglfisiar.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exeljhyglfisiar.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation ljhyglfisiar.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ljhyglfisiar.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run ljhyglfisiar.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hohtujjxbauk = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\ljhyglfisiar.exe\"" ljhyglfisiar.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exeljhyglfisiar.exedescription pid Process procid_target PID 4584 set thread context of 4788 4584 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 81 PID 4688 set thread context of 636 4688 ljhyglfisiar.exe 85 -
Drops file in Program Files directory 64 IoCs
Processes:
ljhyglfisiar.exedescription ioc Process File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sl-SI\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\System\msadc\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\en-US\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-CA\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sk-SK\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_200_percent.pak ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\System\msadc\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\Recovery+wtgqu.png ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\Recovery+wtgqu.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\Services\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\TextConv\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Recovery+wtgqu.html ljhyglfisiar.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\Recovery+wtgqu.html ljhyglfisiar.exe -
Drops file in Windows directory 2 IoCs
Processes:
af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exedescription ioc Process File created C:\Windows\ljhyglfisiar.exe af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe File opened for modification C:\Windows\ljhyglfisiar.exe af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ljhyglfisiar.exepid Process 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe 636 ljhyglfisiar.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exeljhyglfisiar.exeWMIC.exevssvc.exedescription pid Process Token: SeDebugPrivilege 4788 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe Token: SeDebugPrivilege 636 ljhyglfisiar.exe Token: SeIncreaseQuotaPrivilege 5068 WMIC.exe Token: SeSecurityPrivilege 5068 WMIC.exe Token: SeTakeOwnershipPrivilege 5068 WMIC.exe Token: SeLoadDriverPrivilege 5068 WMIC.exe Token: SeSystemProfilePrivilege 5068 WMIC.exe Token: SeSystemtimePrivilege 5068 WMIC.exe Token: SeProfSingleProcessPrivilege 5068 WMIC.exe Token: SeIncBasePriorityPrivilege 5068 WMIC.exe Token: SeCreatePagefilePrivilege 5068 WMIC.exe Token: SeBackupPrivilege 5068 WMIC.exe Token: SeRestorePrivilege 5068 WMIC.exe Token: SeShutdownPrivilege 5068 WMIC.exe Token: SeDebugPrivilege 5068 WMIC.exe Token: SeSystemEnvironmentPrivilege 5068 WMIC.exe Token: SeRemoteShutdownPrivilege 5068 WMIC.exe Token: SeUndockPrivilege 5068 WMIC.exe Token: SeManageVolumePrivilege 5068 WMIC.exe Token: 33 5068 WMIC.exe Token: 34 5068 WMIC.exe Token: 35 5068 WMIC.exe Token: 36 5068 WMIC.exe Token: SeIncreaseQuotaPrivilege 5068 WMIC.exe Token: SeSecurityPrivilege 5068 WMIC.exe Token: SeTakeOwnershipPrivilege 5068 WMIC.exe Token: SeLoadDriverPrivilege 5068 WMIC.exe Token: SeSystemProfilePrivilege 5068 WMIC.exe Token: SeSystemtimePrivilege 5068 WMIC.exe Token: SeProfSingleProcessPrivilege 5068 WMIC.exe Token: SeIncBasePriorityPrivilege 5068 WMIC.exe Token: SeCreatePagefilePrivilege 5068 WMIC.exe Token: SeBackupPrivilege 5068 WMIC.exe Token: SeRestorePrivilege 5068 WMIC.exe Token: SeShutdownPrivilege 5068 WMIC.exe Token: SeDebugPrivilege 5068 WMIC.exe Token: SeSystemEnvironmentPrivilege 5068 WMIC.exe Token: SeRemoteShutdownPrivilege 5068 WMIC.exe Token: SeUndockPrivilege 5068 WMIC.exe Token: SeManageVolumePrivilege 5068 WMIC.exe Token: 33 5068 WMIC.exe Token: 34 5068 WMIC.exe Token: 35 5068 WMIC.exe Token: 36 5068 WMIC.exe Token: SeBackupPrivilege 4888 vssvc.exe Token: SeRestorePrivilege 4888 vssvc.exe Token: SeAuditPrivilege 4888 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exeaf1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exeljhyglfisiar.exeljhyglfisiar.exedescription pid Process procid_target PID 4584 wrote to memory of 4788 4584 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 81 PID 4584 wrote to memory of 4788 4584 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 81 PID 4584 wrote to memory of 4788 4584 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 81 PID 4584 wrote to memory of 4788 4584 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 81 PID 4584 wrote to memory of 4788 4584 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 81 PID 4584 wrote to memory of 4788 4584 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 81 PID 4584 wrote to memory of 4788 4584 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 81 PID 4584 wrote to memory of 4788 4584 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 81 PID 4584 wrote to memory of 4788 4584 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 81 PID 4584 wrote to memory of 4788 4584 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 81 PID 4788 wrote to memory of 4688 4788 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 82 PID 4788 wrote to memory of 4688 4788 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 82 PID 4788 wrote to memory of 4688 4788 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 82 PID 4788 wrote to memory of 4476 4788 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 83 PID 4788 wrote to memory of 4476 4788 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 83 PID 4788 wrote to memory of 4476 4788 af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe 83 PID 4688 wrote to memory of 636 4688 ljhyglfisiar.exe 85 PID 4688 wrote to memory of 636 4688 ljhyglfisiar.exe 85 PID 4688 wrote to memory of 636 4688 ljhyglfisiar.exe 85 PID 4688 wrote to memory of 636 4688 ljhyglfisiar.exe 85 PID 4688 wrote to memory of 636 4688 ljhyglfisiar.exe 85 PID 4688 wrote to memory of 636 4688 ljhyglfisiar.exe 85 PID 4688 wrote to memory of 636 4688 ljhyglfisiar.exe 85 PID 4688 wrote to memory of 636 4688 ljhyglfisiar.exe 85 PID 4688 wrote to memory of 636 4688 ljhyglfisiar.exe 85 PID 4688 wrote to memory of 636 4688 ljhyglfisiar.exe 85 PID 636 wrote to memory of 5068 636 ljhyglfisiar.exe 86 PID 636 wrote to memory of 5068 636 ljhyglfisiar.exe 86 -
System policy modification 1 TTPs 2 IoCs
Processes:
ljhyglfisiar.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ljhyglfisiar.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" ljhyglfisiar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe"C:\Users\Admin\AppData\Local\Temp\af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe"C:\Users\Admin\AppData\Local\Temp\af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\ljhyglfisiar.exeC:\Windows\ljhyglfisiar.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\ljhyglfisiar.exeC:\Windows\ljhyglfisiar.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:636 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
PID:5068
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\AF1150~1.EXE3⤵PID:4476
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4888
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD509d90808ed7d4e9e7738fead37273b54
SHA117fff1085882a35f656515805bde691da1730c08
SHA256af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e
SHA512e29879105ceaa1a04d3498c495df8c699512626ffd9243216bbb98d653a9c3ad013ad79fa2a86767b671427fa62a55c82c54033ef70581d9f7eb6c86cea33ac4
-
Filesize
380KB
MD509d90808ed7d4e9e7738fead37273b54
SHA117fff1085882a35f656515805bde691da1730c08
SHA256af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e
SHA512e29879105ceaa1a04d3498c495df8c699512626ffd9243216bbb98d653a9c3ad013ad79fa2a86767b671427fa62a55c82c54033ef70581d9f7eb6c86cea33ac4
-
Filesize
380KB
MD509d90808ed7d4e9e7738fead37273b54
SHA117fff1085882a35f656515805bde691da1730c08
SHA256af1150b6bc76db56a05401c3b6dcb5ec5bef272f0dca74725a7618126f4e4e6e
SHA512e29879105ceaa1a04d3498c495df8c699512626ffd9243216bbb98d653a9c3ad013ad79fa2a86767b671427fa62a55c82c54033ef70581d9f7eb6c86cea33ac4