Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 16:59
Behavioral task
behavioral1
Sample
9708006633.zip
Resource
win7-20230220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
9708006633.zip
Resource
win10v2004-20230220-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe
Resource
win7-20230220-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral4
Sample
1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral5
Sample
out.exe
Resource
win7-20230220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe
-
Size
235KB
-
MD5
f6f120d1262b88f79debb5d848ac7db9
-
SHA1
1339282f9b2d2a41326daf3cf284ec2ae8f0f93c
-
SHA256
1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
-
SHA512
1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd
-
SSDEEP
6144:c5vMUmRTTgwnfeP+Jx1cLNAIyBcc9WrEWUC4wQh/6BeX:/U8Tgufnx1cLNncgQWUUQh/+e
Malware Config
Extracted
Path
\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">515075E2126DC1FB74CC8970D65C0F5580286B0A0390E2F8E2DCC26D9162F06F83F3CE511DA9CE28B76662D1C784F9C7572BD15B4DBCC76F2038011177D08A91<br>6E68816FD04C13696C4D1B76F632729374AF9D2E49B2E8745430BD384DC3C288CFEF81696AC5CFBCA4FAF2EB7B203A563957B3EDF780FC4B3473351020C6<br>C6E98189807019241D8FC8F197B0D1224A02D5FF4831755630E1BFF3EFEE08ACBC8286028321A5D0C118F8DA931BF4965F7CA2912AC2FA92D2E6B1189719<br>4E58BD4D0C6A41F334210F7D82F93C968C81FC72FDA990BC80EBD2F122FE466FD526341E47EF18E899ADDDB2E466C6DDD842E1F3C0AA27118736BA8F43E4<br>81EF07CD2AA71E20704375528787C4F06F21C7FAB6F17CF0BA9BD09BAF5D1E8538C8301D935B6E14ED76F566158F0533D3FF5CD7097026F4F73215AD7689<br>DB16C3682CE18B49C233A7158A98384E4AA2D61246509F01F47D798A7601AEF6F92D3193E027623857909CDF6C3E27BEB7CA259AF6722F6B4D21A84633A2<br>8CC5112900319ACFCF0AE21E8627961BD4948D6AB5FB141C8D752925FDA8B55913290ACCFB10DF71ADF7C1601867D2716BBD4528F6D181CBACB8023BBD2A<br>0FBCE6D9D741F142FA6F147F06AA78472713A978BD55B171439C4CD089529A4E25F4DD90D512DB9A7F5ED54749787F1727B3313B2D3FDFD13CFEFDC741FC<br>A89A717A13D1D89BA13C87235C5F</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 16 IoCs
resource yara_rule behavioral4/memory/4448-134-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-175-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-176-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-792-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-793-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-794-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-795-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/2308-799-0x0000000000640000-0x00000000006F2000-memory.dmp family_medusalocker behavioral4/memory/4448-800-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-801-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-802-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-803-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-804-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-805-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-806-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker behavioral4/memory/4448-807-0x00000000001E0000-0x0000000000292000-memory.dmp family_medusalocker -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\MergeStop.tiff 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File renamed C:\Users\Admin\Pictures\MoveEnter.png => C:\Users\Admin\Pictures\MoveEnter.png.marlock07 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File renamed C:\Users\Admin\Pictures\OpenUnpublish.tif => C:\Users\Admin\Pictures\OpenUnpublish.tif.marlock07 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File renamed C:\Users\Admin\Pictures\PublishMount.tif => C:\Users\Admin\Pictures\PublishMount.tif.marlock07 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File renamed C:\Users\Admin\Pictures\ConvertFromSwitch.raw => C:\Users\Admin\Pictures\ConvertFromSwitch.raw.marlock07 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File renamed C:\Users\Admin\Pictures\FindGet.tif => C:\Users\Admin\Pictures\FindGet.tif.marlock07 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File renamed C:\Users\Admin\Pictures\JoinResolve.crw => C:\Users\Admin\Pictures\JoinResolve.crw.marlock07 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File renamed C:\Users\Admin\Pictures\LockClear.raw => C:\Users\Admin\Pictures\LockClear.raw.marlock07 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File renamed C:\Users\Admin\Pictures\MergeStop.tiff => C:\Users\Admin\Pictures\MergeStop.tiff.marlock07 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File renamed C:\Users\Admin\Pictures\OpenRename.crw => C:\Users\Admin\Pictures\OpenRename.crw.marlock07 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe -
Executes dropped EXE 1 IoCs
pid Process 2308 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral4/memory/4448-134-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-175-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-176-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-792-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-793-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-794-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-795-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/files/0x00040000000230da-796.dat upx behavioral4/files/0x00040000000230da-797.dat upx behavioral4/memory/2308-798-0x0000000000640000-0x00000000006F2000-memory.dmp upx behavioral4/memory/2308-799-0x0000000000640000-0x00000000006F2000-memory.dmp upx behavioral4/memory/4448-800-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-801-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-802-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-803-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-804-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-805-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-806-0x00000000001E0000-0x0000000000292000-memory.dmp upx behavioral4/memory/4448-807-0x00000000001E0000-0x0000000000292000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-144354903-2550862337-1367551827-1000\desktop.ini 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\S: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\V: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\E: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\J: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\M: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\Q: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\W: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\Y: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\Z: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\K: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\O: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\P: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\U: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\X: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\B: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\G: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\H: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\T: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\N: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\A: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\F: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\I: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe File opened (read-only) \??\L: 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1108 wmic.exe Token: SeSecurityPrivilege 1108 wmic.exe Token: SeTakeOwnershipPrivilege 1108 wmic.exe Token: SeLoadDriverPrivilege 1108 wmic.exe Token: SeSystemProfilePrivilege 1108 wmic.exe Token: SeSystemtimePrivilege 1108 wmic.exe Token: SeProfSingleProcessPrivilege 1108 wmic.exe Token: SeIncBasePriorityPrivilege 1108 wmic.exe Token: SeCreatePagefilePrivilege 1108 wmic.exe Token: SeBackupPrivilege 1108 wmic.exe Token: SeRestorePrivilege 1108 wmic.exe Token: SeShutdownPrivilege 1108 wmic.exe Token: SeDebugPrivilege 1108 wmic.exe Token: SeSystemEnvironmentPrivilege 1108 wmic.exe Token: SeRemoteShutdownPrivilege 1108 wmic.exe Token: SeUndockPrivilege 1108 wmic.exe Token: SeManageVolumePrivilege 1108 wmic.exe Token: 33 1108 wmic.exe Token: 34 1108 wmic.exe Token: 35 1108 wmic.exe Token: 36 1108 wmic.exe Token: SeIncreaseQuotaPrivilege 3352 wmic.exe Token: SeSecurityPrivilege 3352 wmic.exe Token: SeTakeOwnershipPrivilege 3352 wmic.exe Token: SeLoadDriverPrivilege 3352 wmic.exe Token: SeSystemProfilePrivilege 3352 wmic.exe Token: SeSystemtimePrivilege 3352 wmic.exe Token: SeProfSingleProcessPrivilege 3352 wmic.exe Token: SeIncBasePriorityPrivilege 3352 wmic.exe Token: SeCreatePagefilePrivilege 3352 wmic.exe Token: SeBackupPrivilege 3352 wmic.exe Token: SeRestorePrivilege 3352 wmic.exe Token: SeShutdownPrivilege 3352 wmic.exe Token: SeDebugPrivilege 3352 wmic.exe Token: SeSystemEnvironmentPrivilege 3352 wmic.exe Token: SeRemoteShutdownPrivilege 3352 wmic.exe Token: SeUndockPrivilege 3352 wmic.exe Token: SeManageVolumePrivilege 3352 wmic.exe Token: 33 3352 wmic.exe Token: 34 3352 wmic.exe Token: 35 3352 wmic.exe Token: 36 3352 wmic.exe Token: SeIncreaseQuotaPrivilege 2148 wmic.exe Token: SeSecurityPrivilege 2148 wmic.exe Token: SeTakeOwnershipPrivilege 2148 wmic.exe Token: SeLoadDriverPrivilege 2148 wmic.exe Token: SeSystemProfilePrivilege 2148 wmic.exe Token: SeSystemtimePrivilege 2148 wmic.exe Token: SeProfSingleProcessPrivilege 2148 wmic.exe Token: SeIncBasePriorityPrivilege 2148 wmic.exe Token: SeCreatePagefilePrivilege 2148 wmic.exe Token: SeBackupPrivilege 2148 wmic.exe Token: SeRestorePrivilege 2148 wmic.exe Token: SeShutdownPrivilege 2148 wmic.exe Token: SeDebugPrivilege 2148 wmic.exe Token: SeSystemEnvironmentPrivilege 2148 wmic.exe Token: SeRemoteShutdownPrivilege 2148 wmic.exe Token: SeUndockPrivilege 2148 wmic.exe Token: SeManageVolumePrivilege 2148 wmic.exe Token: 33 2148 wmic.exe Token: 34 2148 wmic.exe Token: 35 2148 wmic.exe Token: 36 2148 wmic.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4448 wrote to memory of 1108 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 87 PID 4448 wrote to memory of 1108 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 87 PID 4448 wrote to memory of 1108 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 87 PID 4448 wrote to memory of 3352 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 90 PID 4448 wrote to memory of 3352 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 90 PID 4448 wrote to memory of 3352 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 90 PID 4448 wrote to memory of 2148 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 92 PID 4448 wrote to memory of 2148 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 92 PID 4448 wrote to memory of 2148 4448 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe 92 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe"C:\Users\Admin\AppData\Local\Temp\1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4448 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3352
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
PID:2308
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
235KB
MD5f6f120d1262b88f79debb5d848ac7db9
SHA11339282f9b2d2a41326daf3cf284ec2ae8f0f93c
SHA2561bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
SHA5121067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd
-
Filesize
235KB
MD5f6f120d1262b88f79debb5d848ac7db9
SHA11339282f9b2d2a41326daf3cf284ec2ae8f0f93c
SHA2561bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
SHA5121067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd
-
Filesize
536B
MD53a590013b4401261f3d1e542bcf5fd7f
SHA18034af994e323cee8902bd84f5cef51b0618a55c
SHA2564fe17f3e25ed0082f6c4a04693df2702ab4572f36a4fb241d21e323cdef81310
SHA512ff20a65280e989a57d12a0fa8be30081ca9920b48e20c42d320127bc5c7b76674d0a5fbba607ffe77387c99f9700f05d10d48f18089033f01d9db80a98774253
-
Filesize
4KB
MD585fd036b7e514ec91be5a605d1501ce2
SHA1e239872b9e5cee2dd4b2cd85ee9f95ac581ef500
SHA256546ece5105bf338c077add059decf669f98443daeede17c3094be58afd4f5ad8
SHA5126653508b2a74eabee52b3841549a3be52101107d1c393ff7b32d53741f36b35cb1cbeba900b4eaf16a67f45ae2bf01ac29dbe5706c937870ca556673178dcc83