hxxp://www[.]tekdefense[.]com/downloads/malware-samples/340s[.]exe[.]zip

Analysis

max time kernel
209s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.tekdefense.com/downloads/malware-samples/340s.exe.zip

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1616	340s.exe
1988	esnoa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{88639091-556D-BCA0-31AC-F731FC59ED33} = "C:\\Users\\Admin\\AppData\\Roaming\\Dygao\\esnoa.exe"	esnoa.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1616 set thread context of 2972	1616	340s.exe	113

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\340s.exe.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1388	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
752	taskmgr.exe
752	taskmgr.exe
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
1988	esnoa.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
1988	esnoa.exe
1988	esnoa.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
1988	esnoa.exe
1988	esnoa.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
1988	esnoa.exe
1988	esnoa.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
1988	esnoa.exe
1988	esnoa.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2064	7zFM.exe
752	taskmgr.exe
1420	7zFM.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2452	firefox.exe
Token: SeDebugPrivilege	2452	firefox.exe
Token: SeDebugPrivilege	2452	firefox.exe
Token: SeRestorePrivilege	2064	7zFM.exe
Token: 35	2064	7zFM.exe
Token: SeSecurityPrivilege	2064	7zFM.exe
Token: SeDebugPrivilege	752	taskmgr.exe
Token: SeSystemProfilePrivilege	752	taskmgr.exe
Token: SeCreateGlobalPrivilege	752	taskmgr.exe
Token: 33	752	taskmgr.exe
Token: SeIncBasePriorityPrivilege	752	taskmgr.exe
Token: SeRestorePrivilege	1420	7zFM.exe
Token: 35	1420	7zFM.exe
Token: SeSecurityPrivilege	1420	7zFM.exe
Token: SeSecurityPrivilege	1420	7zFM.exe
Token: SeSecurityPrivilege	1420	7zFM.exe
Token: SeRestorePrivilege	2776	7zFM.exe
Token: 35	2776	7zFM.exe
Token: SeSecurityPrivilege	2776	7zFM.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
2452	firefox.exe
2452	firefox.exe
2452	firefox.exe
2452	firefox.exe
2064	7zFM.exe
2064	7zFM.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
1420	7zFM.exe
1420	7zFM.exe
1420	7zFM.exe
1420	7zFM.exe
2776	7zFM.exe
2776	7zFM.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
2452	firefox.exe
2452	firefox.exe
2452	firefox.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2452	firefox.exe
2452	firefox.exe
2452	firefox.exe
2452	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2452	2772	firefox.exe	55
PID 2772 wrote to memory of 2452	2772	firefox.exe	55
PID 2772 wrote to memory of 2452	2772	firefox.exe	55
PID 2772 wrote to memory of 2452	2772	firefox.exe	55
PID 2772 wrote to memory of 2452	2772	firefox.exe	55
PID 2772 wrote to memory of 2452	2772	firefox.exe	55
PID 2772 wrote to memory of 2452	2772	firefox.exe	55
PID 2772 wrote to memory of 2452	2772	firefox.exe	55
PID 2772 wrote to memory of 2452	2772	firefox.exe	55
PID 2772 wrote to memory of 2452	2772	firefox.exe	55
PID 2772 wrote to memory of 2452	2772	firefox.exe	55
PID 2452 wrote to memory of 3792	2452	firefox.exe	89
PID 2452 wrote to memory of 3792	2452	firefox.exe	89
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 2144	2452	firefox.exe	90
PID 2452 wrote to memory of 3248	2452	firefox.exe	91
PID 2452 wrote to memory of 3248	2452	firefox.exe	91
PID 2452 wrote to memory of 3248	2452	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2300

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3812

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:4684

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:4672

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
1⤵
PID:2912

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:3864

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4748

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://www.tekdefense.com/downloads/malware-samples/340s.exe.zip"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://www.tekdefense.com/downloads/malware-samples/340s.exe.zip
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2452.0.360836586\70102158" -parentBuildID 20221007134813 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 20860 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {771557cc-8382-428c-9604-c2697f26f044} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" 1964 1653d7d9058 gpu
    3⤵
    PID:3792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2452.1.1186748185\1997460787" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 21676 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5366d02-df1c-446e-aba2-6cbdddac7484} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" 2384 16530d71c58 socket
    3⤵
    - Checks processor information in registry
    PID:2144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2452.2.1733330722\716667382" -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 3144 -prefsLen 21714 -prefMapSize 232645 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7899480e-7432-4573-8ddb-c4a2a7cf26c6} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" 2948 165413f3158 tab
    3⤵
    PID:3248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2452.3.236591982\1300473557" -childID 2 -isForBrowser -prefsHandle 3632 -prefMapHandle 3628 -prefsLen 26359 -prefMapSize 232645 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8ed20bd-7325-4b58-b834-98b0c7a91f6e} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" 3644 16530d68758 tab
    3⤵
    PID:4016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2452.5.576543537\1191525669" -childID 4 -isForBrowser -prefsHandle 5436 -prefMapHandle 5364 -prefsLen 26633 -prefMapSize 232645 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87facef9-ac33-480d-8564-5dad05d0c8f0} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" 5352 16544555e58 tab
    3⤵
    PID:2692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2452.6.501739774\1528722948" -childID 5 -isForBrowser -prefsHandle 5340 -prefMapHandle 5344 -prefsLen 26633 -prefMapSize 232645 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d8ea7dc-0eab-44e2-9ffc-2edca326be6d} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" 5224 16544556758 tab
    3⤵
    PID:1160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2452.4.253023678\818591263" -childID 3 -isForBrowser -prefsHandle 5220 -prefMapHandle 5216 -prefsLen 26633 -prefMapSize 232645 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ff89429-0070-448b-a73b-fc26500a19f2} 2452 "\\.\pipe\gecko-crash-server-pipe.2452" 5224 16544558258 tab
    3⤵
    PID:2616

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3404

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3896

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3748

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3164
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\340s.exe.zip"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2064
- C:\Users\Admin\Desktop\340s.exe
  "C:\Users\Admin\Desktop\340s.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1616
- - C:\Users\Admin\AppData\Roaming\Dygao\esnoa.exe
    "C:\Users\Admin\AppData\Roaming\Dygao\esnoa.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpade8a93f.bat"
    3⤵
    PID:2972
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:752
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Roaming\Dygao\esnoa.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1420
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Roaming\Dygao\tyghhfg.zip"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2776
- - C:\Windows\notepad.exe
    "C:\Windows\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\7zO8DA3DF4A\esnoa.exe"
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1388

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3268

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:552

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4044

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1668

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:3656

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
765fd2fdea4b53c5b42304abd9a9e1c4

SHA1
a2eaab59ccbdee092f26392a46b9682f3150a68d

SHA256
e3bd03a84fd7006fcc74ecac4786601c359b08701705c66ed038ecbfc0340a7c

SHA512
3457365e5d81a9fb5c6cabd780998d17ab06fa5e0423b697256772679536d20e086ae59859644e1e7614bad5d5be3d958864b5c5d3d563c294a1ebc9ed96212e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO8DA3DF4A\esnoa.exe

Filesize
348KB

MD5
553877fc160523d45bcd6390d32587a1

SHA1
7b62e4fe6fab14b08ef5a6c99639cd55185ed31a

SHA256
1cddee7c56bb52ae1a0238f5c194d84cd3f9498c893852e44640d4d91d3c8f69

SHA512
c58df5ec486eae814b4c45cc8716c82a67cada89e5b44ce5a2f99b8f8b2f4669f678b6c261d3a9e3bf9ef5f72125aa4fc6496196a56f28a607e1e76852ee0de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpade8a93f.bat

Filesize
165B

MD5
caa7ad71f1139f7267fcd118d533018b

SHA1
8f3debacc573220c5c43c1420f7da011d634a670

SHA256
04a233bd5cb9fd8d9ad1de92fb73cd734b1f6eb2befdc6f054f23447c4ccf626

SHA512
89e28fb5a19b586aeb61fa9c6ddf9ecb27647b5cd62507ee118b96ff942856597ee8b650483c002edf0e344c52c5e8722939489e452b5e0dcc2ec69aeeb76235

Download Submit
C:\Users\Admin\AppData\Roaming\Dygao\esnoa.exe

Filesize
348KB

MD5
553877fc160523d45bcd6390d32587a1

SHA1
7b62e4fe6fab14b08ef5a6c99639cd55185ed31a

SHA256
1cddee7c56bb52ae1a0238f5c194d84cd3f9498c893852e44640d4d91d3c8f69

SHA512
c58df5ec486eae814b4c45cc8716c82a67cada89e5b44ce5a2f99b8f8b2f4669f678b6c261d3a9e3bf9ef5f72125aa4fc6496196a56f28a607e1e76852ee0de4

Download Submit
C:\Users\Admin\AppData\Roaming\Dygao\esnoa.exe

Filesize
348KB

MD5
553877fc160523d45bcd6390d32587a1

SHA1
7b62e4fe6fab14b08ef5a6c99639cd55185ed31a

SHA256
1cddee7c56bb52ae1a0238f5c194d84cd3f9498c893852e44640d4d91d3c8f69

SHA512
c58df5ec486eae814b4c45cc8716c82a67cada89e5b44ce5a2f99b8f8b2f4669f678b6c261d3a9e3bf9ef5f72125aa4fc6496196a56f28a607e1e76852ee0de4

Download Submit
C:\Users\Admin\AppData\Roaming\Dygao\esnoa.exe

Filesize
348KB

MD5
553877fc160523d45bcd6390d32587a1

SHA1
7b62e4fe6fab14b08ef5a6c99639cd55185ed31a

SHA256
1cddee7c56bb52ae1a0238f5c194d84cd3f9498c893852e44640d4d91d3c8f69

SHA512
c58df5ec486eae814b4c45cc8716c82a67cada89e5b44ce5a2f99b8f8b2f4669f678b6c261d3a9e3bf9ef5f72125aa4fc6496196a56f28a607e1e76852ee0de4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\prefs-1.js

Filesize
6KB

MD5
08f9b7a50681a7cc5d2fbd1e156260ba

SHA1
bfd74fb318ef80eb711c15e4b3b00b78c9d0edbc

SHA256
4c08cb43d535bbdb30c1d13f23ef87e738d3e02ac149f676466cb47457ed67a7

SHA512
7fbeab02cd4f184ccd5af089582ec3ac787df0bf4d5040694b98f11babe8487aa40460e1f8b35e65651135d5e5db4da58bcf96134dcece790b9c100e662c70ce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\prefs-1.js

Filesize
6KB

MD5
5babc50752472e9d0828361a757b63f4

SHA1
2707efb9ad63dad7b637832b8a2dd1fc17897871

SHA256
b307e595517efcc0245d167e4432e0bd1a4bf59cdb553b04ea764592d2e00572

SHA512
857e6194d8aee95f271f3cc67c2f57ac75c9301c3ffa7f442077205d86f977f514d46ccd6fad3ee9470e910dee7b3c14377963132b2d681ffbbe7a3902cb4d9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\prefs.js

Filesize
6KB

MD5
7871a6175c73b03ddabc7446d687f465

SHA1
c4fe1fa3dbac37080d05e5f0bc2ee6243248cb60

SHA256
486f7d263ff81d1f3e75a6e50768114c7d76383059fc138370d273e1d7ad6fa6

SHA512
533165c173305a4f0468351f55993d3d8d42ea0c83e4bc38673716237688bf258daaee1f5194307ae2b5b1671392fb05e839bb7463c43355fb0c3b507186de3f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\t9nv4f6k.default-release\sessionstore.jsonlz4

Filesize
880B

MD5
41f366722a85a5deda0e2f3758502f18

SHA1
a084b34529f1cd70cbca4900754d6216cf7311b3

SHA256
c9038c71fa9cf048c0d8d207a1852c549069158d4b57bcb6acef731f1b076591

SHA512
8fec20199491a94efb88279da6f0d8a98a6df5df3a243027c52baafecb954f3aea3af5c1e4acc4418416f6f80ef77d759b37ba0721b2c28caea845a942c69db9

Download Submit
C:\Users\Admin\Desktop\340s.exe

Filesize
348KB

MD5
48cd89827939b3a8976d9bb0993bc338

SHA1
dd1e7e6cae69fd7520cef4269af3e0318af42bfa

SHA256
761de33e1c3d08865f5f2d0cfc84c3b5401c7915a2953ca6b8c2fddbb007556b

SHA512
48067b6478e79b812e8b7f3e47a79ce2975a15c7d8ccbac006066c0daae4e2dd9446b2510e379f6d1acb15ffe3d6e28f9315c49f83017dd485a186023c1522df

Download Submit
C:\Users\Admin\Desktop\340s.exe

Filesize
348KB

MD5
48cd89827939b3a8976d9bb0993bc338

SHA1
dd1e7e6cae69fd7520cef4269af3e0318af42bfa

SHA256
761de33e1c3d08865f5f2d0cfc84c3b5401c7915a2953ca6b8c2fddbb007556b

SHA512
48067b6478e79b812e8b7f3e47a79ce2975a15c7d8ccbac006066c0daae4e2dd9446b2510e379f6d1acb15ffe3d6e28f9315c49f83017dd485a186023c1522df

Download Submit
C:\Users\Admin\Downloads\340s.exe.zip

Filesize
274KB

MD5
27cb168f160b065e3a3f4c8305b6a7e6

SHA1
fac125aebc3c05ed06343e0a531f87c4779a7365

SHA256
78cb65344e391ac016cac2f0281256b63705cf397218de7613bf34d1cf06b0b5

SHA512
c5389137c423b829099175921368e8e936675f8a16d0fa216e28d6d81d86e7caa6c515d68cc61655f1869ff1fd786b2344a0ddf8fc088dad77affea8ebc4f98e

Download Submit
C:\Users\Admin\Downloads\340s.jk6Mtdtw.exe.zip.part

Filesize
274KB

MD5
27cb168f160b065e3a3f4c8305b6a7e6

SHA1
fac125aebc3c05ed06343e0a531f87c4779a7365

SHA256
78cb65344e391ac016cac2f0281256b63705cf397218de7613bf34d1cf06b0b5

SHA512
c5389137c423b829099175921368e8e936675f8a16d0fa216e28d6d81d86e7caa6c515d68cc61655f1869ff1fd786b2344a0ddf8fc088dad77affea8ebc4f98e

Download Submit
memory/752-279-0x0000029B079E0000-0x0000029B079E1000-memory.dmp

Filesize
4KB

Download
memory/752-278-0x0000029B079E0000-0x0000029B079E1000-memory.dmp

Filesize
4KB

Download
memory/752-277-0x0000029B079E0000-0x0000029B079E1000-memory.dmp

Filesize
4KB

Download
memory/752-276-0x0000029B079E0000-0x0000029B079E1000-memory.dmp

Filesize
4KB

Download
memory/752-274-0x0000029B079E0000-0x0000029B079E1000-memory.dmp

Filesize
4KB

Download
memory/752-275-0x0000029B079E0000-0x0000029B079E1000-memory.dmp

Filesize
4KB

Download
memory/752-270-0x0000029B079E0000-0x0000029B079E1000-memory.dmp

Filesize
4KB

Download
memory/752-269-0x0000029B079E0000-0x0000029B079E1000-memory.dmp

Filesize
4KB

Download
memory/752-268-0x0000029B079E0000-0x0000029B079E1000-memory.dmp

Filesize
4KB

Download
memory/752-280-0x0000029B079E0000-0x0000029B079E1000-memory.dmp

Filesize
4KB

Download
memory/1616-242-0x0000000002340000-0x0000000002386000-memory.dmp

Filesize
280KB

Download
memory/1616-236-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1616-241-0x0000000002340000-0x0000000002386000-memory.dmp

Filesize
280KB

Download
memory/1616-239-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1616-222-0x00000000022A0000-0x00000000022E6000-memory.dmp

Filesize
280KB

Download
memory/1616-223-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1616-224-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1616-252-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1616-254-0x00000000022A0000-0x00000000022E6000-memory.dmp

Filesize
280KB

Download
memory/1616-225-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1616-226-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1616-234-0x0000000002340000-0x0000000002386000-memory.dmp

Filesize
280KB

Download
memory/1616-240-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1616-235-0x0000000002340000-0x0000000002386000-memory.dmp

Filesize
280KB

Download
memory/1616-237-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1616-238-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1988-232-0x0000000002140000-0x0000000002186000-memory.dmp

Filesize
280KB

Download
memory/1988-233-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1988-264-0x0000000002140000-0x0000000002186000-memory.dmp

Filesize
280KB

Download
memory/1988-266-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1988-247-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1988-245-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2972-260-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2972-261-0x0000000000F60000-0x0000000000FA6000-memory.dmp

Filesize
280KB

Download
memory/2972-258-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2972-262-0x0000000000F60000-0x0000000000FA6000-memory.dmp

Filesize
280KB

Download
memory/2972-256-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2972-255-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2972-259-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2972-257-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2972-246-0x0000000000F60000-0x0000000000FA6000-memory.dmp

Filesize
280KB

Download