c27436b227e3fe0c343cf27f9696865e74e07047ee54aa3bd1e7e32ad853d583

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe
Size

1.9MB
MD5

dd56ec4f23743414581e3e3b8bff5efa
SHA1

9852e771cc191380a02e65b3efa5ed2d0aa09c87
SHA256

6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af
SHA512

6c8f9f519a30ccf98f64967bf8e3c922fcf54a2d1f584b501907c0353e3cd1391253472b39b344948e61c7185bd793a145c034d71ecdb09e2668ca85a355a0e0
SSDEEP

49152:MUOD1KJg/zjrYNjlCnhSYgZE8Xsh050F3Vsb5EX1QxoYiXYiOmPy:MUODawfYoYf

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe

Executes dropped EXE 1 IoCs

pid	Process
2780	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe

Loads dropped DLL 2 IoCs

pid	Process
2100	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe
1372	Process not Found

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\HasLUAShield	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\PropertySheetHandlers\ShimLayer Property Page	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shell\open	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runas\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\open	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-68"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shell\open\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\EditFlags = 00000000	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command\DelegateExecute = "{ea72d00e-4960-42fa-ba92-7792a7944c1d}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler\ = "{86C86720-42A0-1069-A2E8-08002B30309D}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\FriendlyTypeName = "@%SystemRoot%\\System32\\acppage.dll,-6002"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\Extended	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\ = "Compatibility"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\SuppressionPolicyEx = "{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\PropertySheetHandlers	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\DefaultIcon	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command\DelegateExecute = "{ea72d00e-4960-42fa-ba92-7792a7944c1d}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\ContextMenuHandlers\Compatibility\ = "{1d27f844-3a1f-4410-85ac-14651078412d}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\DropHandler	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "Application"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\edit\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\ = "MS-DOS Application"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\DefaultIcon	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\ContextMenuHandlers	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\Extended	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility\ = "{1d27f844-3a1f-4410-85ac-14651078412d}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ = "Windows Batch File"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\open\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\ = "@shell32.dll,-50944"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}\ = "{1531d583-8375-4d3f-b5fb-d23bbd169f22}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\PropertySheetHandlers\ShimLayer Property Page	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runasuser\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\EditFlags = 30040000	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\DefaultIcon	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\ContextMenuHandlers	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runas	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "%1"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shellex\DropHandler	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runasuser\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon\ = "%SystemRoot%\\System32\\shell32.dll,2"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\ = "@shell32.dll,-50944"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runas	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\EditFlags = 30000000	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\EditFlags = "0"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\FriendlyTypeName = "@%SystemRoot%\\System32\\shell32.dll,-8464"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\HasLUAShield	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runasuser	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\print\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runas\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runasuser	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\EditFlags = 38070000	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\SuppressionPolicyEx = "{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler\ = "{86C86720-42A0-1069-A2E8-08002B30309D}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\EditFlags = 00000000	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\open	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\PropertySheetHandlers\ShimLayer Property Page	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\EditFlags = 30000000	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shell\open	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\FriendlyTypeName = "@%SystemRoot%\\System32\\shell32.dll,-8464"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\FriendlyTypeName = "@%SystemRoot%\\System32\\shell32.dll,-10156"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\HasLUAShield	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\ContextMenuHandlers\ = "Compatibility"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon\ = "%SystemRoot%\\System32\\shell32.dll,2"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler\ = "{86C86720-42A0-1069-A2E8-08002B30309D}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.exe	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\Extended	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\EditFlags = 30040000	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\edit\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\ = "@shell32.dll,-50944"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "%1"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\ = "Compatibility"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.com\PersistentHandler\	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility\ = "{1d27f844-3a1f-4410-85ac-14651078412d}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\DropHandler	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.bat\PersistentHandler\	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ = "Windows Batch File"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\print\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\EditFlags = "0"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shell\open\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\ = "@shell32.dll,-50944"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runasuser	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\ContextMenuHandlers	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.bat	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\DefaultIcon	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shellex\DropHandler	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\DefaultIcon	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\EditFlags = 00000000	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\FriendlyTypeName = "@%SystemRoot%\\System32\\acppage.dll,-6002"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\open\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\ContextMenuHandlers	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\DropHandler	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\Content Type = "application/x-msdownload"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.com	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\ = "MS-DOS Application"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\EditFlags = 38070000	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler\ = "{098f2470-bae0-11cd-b579-08002b30bfeb}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command\DelegateExecute = "{ea72d00e-4960-42fa-ba92-7792a7944c1d}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runas\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runas\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command\DelegateExecute = "{ea72d00e-4960-42fa-ba92-7792a7944c1d}"	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\PropertySheetHandlers\ShimLayer Property Page	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runas	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runasuser\command	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\EditFlags = 00000000	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\HasLUAShield	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2020	Notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
2780	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe
Token: SeDebugPrivilege	2780	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2780	2100	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe	29
PID 2100 wrote to memory of 2780	2100	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe	29
PID 2100 wrote to memory of 2780	2100	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe	29
PID 2100 wrote to memory of 2780	2100	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe	29
PID 2780 wrote to memory of 2020	2780	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe	33
PID 2780 wrote to memory of 2020	2780	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe	33
PID 2780 wrote to memory of 2020	2780	6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe
"C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
  C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\System32\Notepad.exe
    Notepad.exe C:\Users\Admin\Desktop\Rkill.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe

Filesize
581KB

MD5
aa06c32c46fa65dcb7ab284f4364dcec

SHA1
e20a450dc827123a8e6de6c54229fe54668deaeb

SHA256
4b8ccdb9de55e61bf8d27143e8362bd9b2fb1ea9b734b9372bc5424febbba9c4

SHA512
66beba51426400c7cce93c3c09fad7347896336dd120f890a815309434b6cf25d8a0413851e8c4f95ecaf3991591a421c334445d82dc10ee56927fbfc5fe24e1

Download Submit
C:\Users\Admin\Desktop\Rkill.txt

Filesize
4KB

MD5
783f13aaef6b8ee61f99ceadabaf225f

SHA1
3a841c26bc068183e81c408caf957dc31ea83038

SHA256
16ea3fb6a06e1c89ea34715c156f7b293a9ec9fa57d53bf61b7521f4f8e4d4d0

SHA512
440b4abf006e972f17a253df4abd0e4fc62a54584a69ecceb9d2dc44471f5bf03ed1919e435121cf00557a303f7c84a9d015877186ea5ba28d56f46f933c2f18

Download Submit
C:\Users\Admin\Desktop\Rkill.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe

Filesize
1.1MB

MD5
48fc85cba4a27dddb52283ca94db3d61

SHA1
275513b755211b9d7fdba817e53be73ec89934bb

SHA256
2546a59e3cf17e474a639b015eecac8ffcac037fada4c04a1bb0524380ee2e9d

SHA512
3dc10ed6162e3b81e3746fc7bf578c5825206c0e5b7d5c9dff3646c626c0891f09cbc37d4c9a52fd0ae8522e1bf8868f6d0eaa8ae1debe1d0d336a30589f452c

Download Submit