Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
27-09-2023 08:36
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe
Resource
win10v2004-20230915-en
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe
-
Size
1.9MB
-
MD5
1b87684768db892932be3f0661c54251
-
SHA1
e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
-
SHA256
65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
-
SHA512
0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82
-
SSDEEP
24576:jx4Ul0rrIOGz9I6U7AeyGvHynlLghECQl4L529dktxtPCv1ri+J/ac//zWOYopmB:mUl0/2kHW8ECQl4wi+snopp2vQ
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
F:\info.hta
Signatures
-
Detect rhadamanthys stealer shellcode 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2628-19-0x00000000020C0000-0x00000000024C0000-memory.dmp family_rhadamanthys behavioral1/memory/2628-20-0x00000000020C0000-0x00000000024C0000-memory.dmp family_rhadamanthys behavioral1/memory/2628-21-0x00000000020C0000-0x00000000024C0000-memory.dmp family_rhadamanthys behavioral1/memory/2628-22-0x00000000020C0000-0x00000000024C0000-memory.dmp family_rhadamanthys behavioral1/memory/2628-32-0x00000000020C0000-0x00000000024C0000-memory.dmp family_rhadamanthys -
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exedescription pid process target process PID 2628 created 1280 2628 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe Explorer.EXE -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 1948 bcdedit.exe 568 bcdedit.exe 1556 bcdedit.exe 1448 bcdedit.exe -
Renames multiple (312) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exewbadmin.exepid process 1996 wbadmin.exe 996 wbadmin.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Deletes itself 1 IoCs
Processes:
certreq.exepid process 2772 certreq.exe -
Drops startup file 3 IoCs
Processes:
ot{G7.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ot{G7.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\ot{G7.exe ot{G7.exe -
Executes dropped EXE 15 IoCs
Processes:
ot{G7.exeot{G7.exe2rYyz.exe2rYyz.exe2rYyz.exe2rYyz.exe2rYyz.exe2rYyz.exe2rYyz.exe2rYyz.exe2rYyz.exe2rYyz.exe2rYyz.exeot{G7.exeot{G7.exepid process 1540 ot{G7.exe 2964 ot{G7.exe 2820 2rYyz.exe 2724 2rYyz.exe 2920 2rYyz.exe 2876 2rYyz.exe 1596 2rYyz.exe 2716 2rYyz.exe 2928 2rYyz.exe 2888 2rYyz.exe 3008 2rYyz.exe 2932 2rYyz.exe 2916 2rYyz.exe 592 ot{G7.exe 996 ot{G7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook certreq.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ot{G7.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ot{G7 = "C:\\Users\\Admin\\AppData\\Local\\ot{G7.exe" ot{G7.exe Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\ot{G7 = "C:\\Users\\Admin\\AppData\\Local\\ot{G7.exe" ot{G7.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
ot{G7.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini ot{G7.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini ot{G7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini ot{G7.exe File opened for modification C:\Users\Public\Videos\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OCC48JZO\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini ot{G7.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini ot{G7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\9ZA6L5EC\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ot{G7.exe File opened for modification C:\Users\Public\Desktop\desktop.ini ot{G7.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini ot{G7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini ot{G7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ot{G7.exe File opened for modification C:\Users\Public\Downloads\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\S14V3QJ7\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HFUNQS4P\desktop.ini ot{G7.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini ot{G7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\Searches\desktop.ini ot{G7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ot{G7.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-607259312-1573743425-2763420908-1000\desktop.ini ot{G7.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini ot{G7.exe File opened for modification C:\Users\Public\desktop.ini ot{G7.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini ot{G7.exe File opened for modification C:\Program Files (x86)\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ot{G7.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-607259312-1573743425-2763420908-1000\desktop.ini ot{G7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini ot{G7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ot{G7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ot{G7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ot{G7.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini ot{G7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\Links\desktop.ini ot{G7.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI ot{G7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini ot{G7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\Music\desktop.ini ot{G7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ot{G7.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini ot{G7.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini ot{G7.exe File opened for modification C:\Users\Public\Documents\desktop.ini ot{G7.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FZ6PR11S\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ot{G7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ot{G7.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exeot{G7.exeot{G7.exedescription pid process target process PID 900 set thread context of 2628 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe PID 1540 set thread context of 2964 1540 ot{G7.exe ot{G7.exe PID 592 set thread context of 996 592 ot{G7.exe ot{G7.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ot{G7.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\NETWORK.ELM ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00218_.WMF ot{G7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_On.png ot{G7.exe File created C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01168_.WMF ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185798.WMF ot{G7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll ot{G7.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBAR.DPV ot{G7.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDEBARVERTBB.DPV.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html ot{G7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui ot{G7.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk ot{G7.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200279.WMF.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME55.CSS ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\COMBOBOX.JPG ot{G7.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\common.js ot{G7.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll ot{G7.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\setup.ini.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01563_.WMF ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME28.CSS ot{G7.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialMergeLetter.dotx.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\init.js ot{G7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD ot{G7.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\PREVIEW.GIF.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg ot{G7.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105292.WMF.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up.png ot{G7.exe File created C:\Program Files\Java\jre7\lib\jfr.jar.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174635.WMF ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115839.GIF ot{G7.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right.gif.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00234_.WMF ot{G7.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART14.BDR.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.JS.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll ot{G7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe ot{G7.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PRRTINST.WMF ot{G7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\RSSFeeds.html ot{G7.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak ot{G7.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00197_.WMF.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay.css ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLPROXY.DLL ot{G7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\OUTDR_01.MID ot{G7.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll.id[A8F4A2BE-3483].[[email protected]].8base ot{G7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
certreq.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 certreq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString certreq.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2056 vssadmin.exe 2732 vssadmin.exe -
Processes:
mshta.exemshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exeSecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.execertreq.exe2rYyz.exeot{G7.exepid process 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe 2628 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe 2628 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe 2628 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe 2628 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe 2772 certreq.exe 2772 certreq.exe 2772 certreq.exe 2772 certreq.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2820 2rYyz.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe 2964 ot{G7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exeot{G7.exe2rYyz.exeot{G7.exeot{G7.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe Token: SeDebugPrivilege 1540 ot{G7.exe Token: SeDebugPrivilege 2820 2rYyz.exe Token: SeDebugPrivilege 592 ot{G7.exe Token: SeDebugPrivilege 2964 ot{G7.exe Token: SeBackupPrivilege 1228 vssvc.exe Token: SeRestorePrivilege 1228 vssvc.exe Token: SeAuditPrivilege 1228 vssvc.exe Token: SeIncreaseQuotaPrivilege 2576 WMIC.exe Token: SeSecurityPrivilege 2576 WMIC.exe Token: SeTakeOwnershipPrivilege 2576 WMIC.exe Token: SeLoadDriverPrivilege 2576 WMIC.exe Token: SeSystemProfilePrivilege 2576 WMIC.exe Token: SeSystemtimePrivilege 2576 WMIC.exe Token: SeProfSingleProcessPrivilege 2576 WMIC.exe Token: SeIncBasePriorityPrivilege 2576 WMIC.exe Token: SeCreatePagefilePrivilege 2576 WMIC.exe Token: SeBackupPrivilege 2576 WMIC.exe Token: SeRestorePrivilege 2576 WMIC.exe Token: SeShutdownPrivilege 2576 WMIC.exe Token: SeDebugPrivilege 2576 WMIC.exe Token: SeSystemEnvironmentPrivilege 2576 WMIC.exe Token: SeRemoteShutdownPrivilege 2576 WMIC.exe Token: SeUndockPrivilege 2576 WMIC.exe Token: SeManageVolumePrivilege 2576 WMIC.exe Token: 33 2576 WMIC.exe Token: 34 2576 WMIC.exe Token: 35 2576 WMIC.exe Token: SeIncreaseQuotaPrivilege 2576 WMIC.exe Token: SeSecurityPrivilege 2576 WMIC.exe Token: SeTakeOwnershipPrivilege 2576 WMIC.exe Token: SeLoadDriverPrivilege 2576 WMIC.exe Token: SeSystemProfilePrivilege 2576 WMIC.exe Token: SeSystemtimePrivilege 2576 WMIC.exe Token: SeProfSingleProcessPrivilege 2576 WMIC.exe Token: SeIncBasePriorityPrivilege 2576 WMIC.exe Token: SeCreatePagefilePrivilege 2576 WMIC.exe Token: SeBackupPrivilege 2576 WMIC.exe Token: SeRestorePrivilege 2576 WMIC.exe Token: SeShutdownPrivilege 2576 WMIC.exe Token: SeDebugPrivilege 2576 WMIC.exe Token: SeSystemEnvironmentPrivilege 2576 WMIC.exe Token: SeRemoteShutdownPrivilege 2576 WMIC.exe Token: SeUndockPrivilege 2576 WMIC.exe Token: SeManageVolumePrivilege 2576 WMIC.exe Token: 33 2576 WMIC.exe Token: 34 2576 WMIC.exe Token: 35 2576 WMIC.exe Token: SeBackupPrivilege 112 wbengine.exe Token: SeRestorePrivilege 112 wbengine.exe Token: SeSecurityPrivilege 112 wbengine.exe Token: SeIncreaseQuotaPrivilege 2820 WMIC.exe Token: SeSecurityPrivilege 2820 WMIC.exe Token: SeTakeOwnershipPrivilege 2820 WMIC.exe Token: SeLoadDriverPrivilege 2820 WMIC.exe Token: SeSystemProfilePrivilege 2820 WMIC.exe Token: SeSystemtimePrivilege 2820 WMIC.exe Token: SeProfSingleProcessPrivilege 2820 WMIC.exe Token: SeIncBasePriorityPrivilege 2820 WMIC.exe Token: SeCreatePagefilePrivilege 2820 WMIC.exe Token: SeBackupPrivilege 2820 WMIC.exe Token: SeRestorePrivilege 2820 WMIC.exe Token: SeShutdownPrivilege 2820 WMIC.exe Token: SeDebugPrivilege 2820 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exeSecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exeot{G7.exe2rYyz.exedescription pid process target process PID 900 wrote to memory of 2628 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe PID 900 wrote to memory of 2628 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe PID 900 wrote to memory of 2628 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe PID 900 wrote to memory of 2628 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe PID 900 wrote to memory of 2628 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe PID 900 wrote to memory of 2628 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe PID 900 wrote to memory of 2628 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe PID 900 wrote to memory of 2628 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe PID 900 wrote to memory of 2628 900 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe PID 2628 wrote to memory of 2772 2628 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe certreq.exe PID 2628 wrote to memory of 2772 2628 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe certreq.exe PID 2628 wrote to memory of 2772 2628 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe certreq.exe PID 2628 wrote to memory of 2772 2628 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe certreq.exe PID 2628 wrote to memory of 2772 2628 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe certreq.exe PID 2628 wrote to memory of 2772 2628 SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe certreq.exe PID 1540 wrote to memory of 2964 1540 ot{G7.exe ot{G7.exe PID 1540 wrote to memory of 2964 1540 ot{G7.exe ot{G7.exe PID 1540 wrote to memory of 2964 1540 ot{G7.exe ot{G7.exe PID 1540 wrote to memory of 2964 1540 ot{G7.exe ot{G7.exe PID 1540 wrote to memory of 2964 1540 ot{G7.exe ot{G7.exe PID 1540 wrote to memory of 2964 1540 ot{G7.exe ot{G7.exe PID 1540 wrote to memory of 2964 1540 ot{G7.exe ot{G7.exe PID 1540 wrote to memory of 2964 1540 ot{G7.exe ot{G7.exe PID 1540 wrote to memory of 2964 1540 ot{G7.exe ot{G7.exe PID 1540 wrote to memory of 2964 1540 ot{G7.exe ot{G7.exe PID 1540 wrote to memory of 2964 1540 ot{G7.exe ot{G7.exe PID 2820 wrote to memory of 2920 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2920 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2920 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2920 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2724 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2724 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2724 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2724 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2876 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2876 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2876 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2876 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 1596 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 1596 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 1596 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 1596 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2716 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2716 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2716 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2716 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2928 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2928 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2928 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2928 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2888 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2888 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2888 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2888 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 3008 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 3008 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 3008 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 3008 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2932 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2932 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2932 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2932 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2916 2820 2rYyz.exe 2rYyz.exe PID 2820 wrote to memory of 2916 2820 2rYyz.exe 2rYyz.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe -
outlook_win_path 1 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2387.19648.17401.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Deletes itself
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:2772
-
C:\Users\Admin\AppData\Local\Microsoft\ot{G7.exe"C:\Users\Admin\AppData\Local\Microsoft\ot{G7.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Microsoft\ot{G7.exeC:\Users\Admin\AppData\Local\Microsoft\ot{G7.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\Users\Admin\AppData\Local\Microsoft\ot{G7.exe"C:\Users\Admin\AppData\Local\Microsoft\ot{G7.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:592 -
C:\Users\Admin\AppData\Local\Microsoft\ot{G7.exeC:\Users\Admin\AppData\Local\Microsoft\ot{G7.exe4⤵
- Executes dropped EXE
PID:996 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2244
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2056 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1948 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:568 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:1996 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:812
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
- Modifies Windows Firewall
PID:532 -
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
- Modifies Windows Firewall
PID:2584 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"3⤵
- Modifies Internet Explorer settings
PID:3016 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"3⤵
- Modifies Internet Explorer settings
PID:2972 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"3⤵
- Modifies Internet Explorer settings
PID:2904 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"3⤵
- Modifies Internet Explorer settings
PID:2920 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2928
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2732 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1556 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1448 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:996
-
C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe"C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exeC:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe2⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exeC:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe2⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exeC:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe2⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exeC:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe2⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exeC:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe2⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exeC:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe2⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exeC:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe2⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exeC:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe2⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exeC:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe2⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Microsoft\2rYyz.exeC:\Users\Admin\AppData\Local\Microsoft\2rYyz.exe2⤵
- Executes dropped EXE
PID:2724
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:112
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1388
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1688
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.id[A8F4A2BE-3483].[[email protected]].8base
Filesize189.5MB
MD52a22233409a4d4336d629f11408d44c0
SHA101fefacadc46178e0dd202d73ac5b1729a8234c6
SHA256f902b1e11e728e9c4876952d7c4782e6597b4d036337e26f713fa811786bc6dc
SHA512f1836e9cd1e914924986b5647d1bbd73e51e755c6f84e1710115268b114a942222a17bd83832e88f705e3b498ef0968deedca83bae9d6bf36e82db5b048638c1
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
250KB
MD52931ff8f30f41984e58e2bb3d4c82000
SHA1c71353633077fadacbe07ed6e2939262f89f9ad3
SHA256ab0af2ff7ab695e35c31343278ef0bde960dc88554f015034eb16cad94d6a9b7
SHA5120a807c28c1b81c348c35c379dca1185e366993288a45c176c5619cf324acca655abf81dc42683404de2f0cdc2c8781db681964188d6037a30d64ac78f45067f0
-
Filesize
261KB
MD5614d1cd9e8513df074caa93ac0aeeb2e
SHA15a4fb3bac3521d7cb9a403dc9239a9cf1db9cd89
SHA2563d805293a70df3a5e1e392ee05ed7b88eda054ee97072eac5590baecfc44cb74
SHA51211f191ce52d4c3997433a4a0bcdd7d80f0da2940fb2ed87b0ed304ca39c81fc646bf56917c65be75c484db5f57c8e89754361125477d7bbde9ec8b2bfb30e289
-
Filesize
261KB
MD5614d1cd9e8513df074caa93ac0aeeb2e
SHA15a4fb3bac3521d7cb9a403dc9239a9cf1db9cd89
SHA2563d805293a70df3a5e1e392ee05ed7b88eda054ee97072eac5590baecfc44cb74
SHA51211f191ce52d4c3997433a4a0bcdd7d80f0da2940fb2ed87b0ed304ca39c81fc646bf56917c65be75c484db5f57c8e89754361125477d7bbde9ec8b2bfb30e289
-
Filesize
261KB
MD5614d1cd9e8513df074caa93ac0aeeb2e
SHA15a4fb3bac3521d7cb9a403dc9239a9cf1db9cd89
SHA2563d805293a70df3a5e1e392ee05ed7b88eda054ee97072eac5590baecfc44cb74
SHA51211f191ce52d4c3997433a4a0bcdd7d80f0da2940fb2ed87b0ed304ca39c81fc646bf56917c65be75c484db5f57c8e89754361125477d7bbde9ec8b2bfb30e289
-
Filesize
261KB
MD5614d1cd9e8513df074caa93ac0aeeb2e
SHA15a4fb3bac3521d7cb9a403dc9239a9cf1db9cd89
SHA2563d805293a70df3a5e1e392ee05ed7b88eda054ee97072eac5590baecfc44cb74
SHA51211f191ce52d4c3997433a4a0bcdd7d80f0da2940fb2ed87b0ed304ca39c81fc646bf56917c65be75c484db5f57c8e89754361125477d7bbde9ec8b2bfb30e289
-
Filesize
261KB
MD5614d1cd9e8513df074caa93ac0aeeb2e
SHA15a4fb3bac3521d7cb9a403dc9239a9cf1db9cd89
SHA2563d805293a70df3a5e1e392ee05ed7b88eda054ee97072eac5590baecfc44cb74
SHA51211f191ce52d4c3997433a4a0bcdd7d80f0da2940fb2ed87b0ed304ca39c81fc646bf56917c65be75c484db5f57c8e89754361125477d7bbde9ec8b2bfb30e289
-
Filesize
5KB
MD5c5f9ec542a8671eb0e364c618de61a3e
SHA14a9085549050f3d411c53f87bc8a216dc0cf47a5
SHA256e7ed417cafc275ca36eed25baab91fb431d7c6598fff5f9fdd7ad3259610159f
SHA51219eef45225ceea8efe733b004becf8ebcf82fcc9388040d9cbd0c7588a6982ff08dccf2d68d9b345f51a1303398e3a74217209da5c5de3c9c35ff031537116fa
-
Filesize
5KB
MD5c5f9ec542a8671eb0e364c618de61a3e
SHA14a9085549050f3d411c53f87bc8a216dc0cf47a5
SHA256e7ed417cafc275ca36eed25baab91fb431d7c6598fff5f9fdd7ad3259610159f
SHA51219eef45225ceea8efe733b004becf8ebcf82fcc9388040d9cbd0c7588a6982ff08dccf2d68d9b345f51a1303398e3a74217209da5c5de3c9c35ff031537116fa
-
Filesize
5KB
MD5c5f9ec542a8671eb0e364c618de61a3e
SHA14a9085549050f3d411c53f87bc8a216dc0cf47a5
SHA256e7ed417cafc275ca36eed25baab91fb431d7c6598fff5f9fdd7ad3259610159f
SHA51219eef45225ceea8efe733b004becf8ebcf82fcc9388040d9cbd0c7588a6982ff08dccf2d68d9b345f51a1303398e3a74217209da5c5de3c9c35ff031537116fa
-
Filesize
5KB
MD5c5f9ec542a8671eb0e364c618de61a3e
SHA14a9085549050f3d411c53f87bc8a216dc0cf47a5
SHA256e7ed417cafc275ca36eed25baab91fb431d7c6598fff5f9fdd7ad3259610159f
SHA51219eef45225ceea8efe733b004becf8ebcf82fcc9388040d9cbd0c7588a6982ff08dccf2d68d9b345f51a1303398e3a74217209da5c5de3c9c35ff031537116fa
-
Filesize
5KB
MD5c5f9ec542a8671eb0e364c618de61a3e
SHA14a9085549050f3d411c53f87bc8a216dc0cf47a5
SHA256e7ed417cafc275ca36eed25baab91fb431d7c6598fff5f9fdd7ad3259610159f
SHA51219eef45225ceea8efe733b004becf8ebcf82fcc9388040d9cbd0c7588a6982ff08dccf2d68d9b345f51a1303398e3a74217209da5c5de3c9c35ff031537116fa