Overview
overview
10Static
static
10samples5.zip
windows7-x64
1samples5.zip
windows10-2004-x64
1104b5623d8...d3.exe
windows7-x64
1104b5623d8...d3.exe
windows10-2004-x64
1160010289c...02.exe
windows7-x64
1160010289c...02.exe
windows10-2004-x64
11a757d4aa5...6f.exe
windows7-x64
11a757d4aa5...6f.exe
windows10-2004-x64
121ff399e57...56.dll
windows7-x64
121ff399e57...56.dll
windows10-2004-x64
13c311150e2...bf.exe
windows7-x64
13c311150e2...bf.exe
windows10-2004-x64
13efe068c64...0f.exe
windows7-x64
33efe068c64...0f.exe
windows10-2004-x64
3403be0442e...17.exe
windows7-x64
10403be0442e...17.exe
windows10-2004-x64
1049c96478e9...66.exe
windows7-x64
649c96478e9...66.exe
windows10-2004-x64
65154914351...a7.exe
windows7-x64
15154914351...a7.exe
windows10-2004-x64
1616ea8ac34...858437
windows7-x64
1616ea8ac34...858437
windows10-2004-x64
16a637e90e0...bc.exe
windows7-x64
106a637e90e0...bc.exe
windows10-2004-x64
9759c06eedc...4c.dll
windows7-x64
10759c06eedc...4c.dll
windows10-2004-x64
1085cad059cc...20.exe
windows7-x64
185cad059cc...20.exe
windows10-2004-x64
18ca6b7929e...3c.exe
windows7-x64
108ca6b7929e...3c.exe
windows10-2004-x64
990ef3f841b...77.exe
windows7-x64
990ef3f841b...77.exe
windows10-2004-x64
9Analysis
-
max time kernel
31s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 15:27
Behavioral task
behavioral1
Sample
samples5.zip
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
samples5.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
104b5623d8edd7e56d7e824d900ef57cc085ad7b2935c794af58de87d4f8c2d3.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
104b5623d8edd7e56d7e824d900ef57cc085ad7b2935c794af58de87d4f8c2d3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
160010289cc38de42f7b75fa817a6ef7931bfd8aa1370fb09559b2e035e05702.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
160010289cc38de42f7b75fa817a6ef7931bfd8aa1370fb09559b2e035e05702.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
1a757d4aa506d48a09ed5cf0c8f21b6d65a55f5e8aa736873a9e523c4278156f.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
1a757d4aa506d48a09ed5cf0c8f21b6d65a55f5e8aa736873a9e523c4278156f.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
21ff399e57cc306a1ae1daab6009ea40c8aa96c39296d0f8781626de6bd19256.dll
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
21ff399e57cc306a1ae1daab6009ea40c8aa96c39296d0f8781626de6bd19256.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
3c311150e20d76edd9274cec783068667637b6b5f3b6e1a5031a8605b895fabf.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
3c311150e20d76edd9274cec783068667637b6b5f3b6e1a5031a8605b895fabf.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
3efe068c644c96fff2a25a7351da85bad86949878df3c7cad76d83ad2f2c340f.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
3efe068c644c96fff2a25a7351da85bad86949878df3c7cad76d83ad2f2c340f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
49c96478e9d2b16219a7c86f031c5d8b241ae43550ce2fc2bea1d98fa90aa766.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
49c96478e9d2b16219a7c86f031c5d8b241ae43550ce2fc2bea1d98fa90aa766.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
5154914351d1abdc308c8a76474a19560a4624194feb98118d0710efb6804aa7.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
5154914351d1abdc308c8a76474a19560a4624194feb98118d0710efb6804aa7.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
616ea8ac34ae403d7094d53c0db11a24348f6e48eff80e254a93a1593f858437
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
616ea8ac34ae403d7094d53c0db11a24348f6e48eff80e254a93a1593f858437
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral24
Sample
6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral25
Sample
759c06eedcadd60ebd2aa3790eefa40d505044080cea4e1477d845611f322b4c.dll
Resource
win7-20231129-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral26
Sample
759c06eedcadd60ebd2aa3790eefa40d505044080cea4e1477d845611f322b4c.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral27
Sample
85cad059cca352e70188c1744521100651a787ebabdaa8261badb0f3b6bb5020.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
85cad059cca352e70188c1744521100651a787ebabdaa8261badb0f3b6bb5020.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
8ca6b7929ece89d8d9050ae9f1e6c1b3dfa87217272e114e464160dce036463c.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral30
Sample
8ca6b7929ece89d8d9050ae9f1e6c1b3dfa87217272e114e464160dce036463c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral31
Sample
90ef3f841bef457a352a092f2367a0de89d812318df6b2293876d5746281c777.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
90ef3f841bef457a352a092f2367a0de89d812318df6b2293876d5746281c777.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe
-
Size
31KB
-
MD5
408358751abe67dcf31de9a955253724
-
SHA1
81c19445c96f0b4346ae6b4036ff18c8c44db0ed
-
SHA256
403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17
-
SHA512
ffc1425bfca8e5e1b78a43bac829b8930ade14b017c12e0218c44e594f2d559ca9f2060b204eb07115f2bbd4111199ea061852f1742763cfdc80a9808e9bc8aa
-
SSDEEP
384:bMBQl5CVzAW054SrIVuLRR0b3ZpUyXhVgeHy3jfSG+wKmOL1MCEdYdOiHNFx2khV:bMBQWVM6Srtlab7MC6wThw4
Score
10/10
Malware Config
Extracted
Path
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\decrypt_Last_Chance.html
Ransom Note
<!DOCTYPE html>
<html>
<title>TargetWare Decryption Information</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<head>
<link rel="stylesheet" href="https://fonts.googleapis.com/icon?family=Material+Icons">
</head>
<link rel="stylesheet" href="https://www.w3schools.com/w3css/4/w3.css">
<STYLE type="text/css">
BODY { background-color: rgb(246, 246, 246); }
</STYLE>
<body>
<div class="w3-container w3-center " >
<img src="https://www.seekpng.com/png/detail/227-2279324_oops-oops-png.png">
<div class="w3-container w3-border w3-small w3-content">
<div class="w3-panel w3-border-top w3-border-bottom w3-border-black w3-pale-gray " >
<b>Dear Curexa, it`s only a warning to you. <br><br>
Also we can wipe your systems but give you chance <br><br>
Contact us within 48 hours for get more details ;) We also steal your databases with Prescriptions and Patient info.<br><br>
<br><br>
What happened to your files?<br><br>
We completed target attack on your company.<br>
All your files were encrypted by a <br>
strong encryption with RSA2048 .<br>
Our software not decryptable for free !<br>
Try search in Google : MMM Ransomware, Triple M ransomware</b> ;)<br>
</div>
</div>
<div class="w3-container w3-border w3-small w3-content">
<div class="w3-panel w3-border-top w3-border-bottom w3-border-black w3-pale-gray w3-content">
<b>Recomendations</b><br>
Do not attempt to recover the files yourself.You might corrupt your files.<br>
We rewrite all old blocks on your HDD and you can`t recover files with <br>
Recuva ,Acronis etc...<br>
<br>
.
</div>
</div>
<div class="w3-container w3-border w3-small w3-content">
<div class="w3-panel w3-border-top w3-border-bottom w3-border-black w3-pale-gray w3-content">
<b>How decrypt files?</b><br><br>
Your uniq ID it`s <b>CRX202304</b>.<br>
You have only 48 hours for contact with us.<br>
Write within this time to email [email protected] or if you don`t get answer within 12 hours to Jabber (use Psi+ or Pidgin clients)<b> [email protected] </b><br>
In first message write your uniq ID <b>CRX202304</b><br><br>
</div>
</div>
</div>
</body>
</html>
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\45C7A2A43DE1AB7A657C74142699649A 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\E8E54E9E790243C82B6F70BA46D3F977 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIDE.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_mr.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\CloseRemove.eps 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\1EC83863C3BEC064A0AC99FD84499FEF.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-localization-l1-2-0.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\D77F65E56589F8868A37496BAC740C94.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\325E2A02826CEA60B81999478C2BCA4E.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Google\Update\Install\{3A7B460C-9B9D-48E3-A988-99F835A97944}\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\8ABC7D7876B2270F992D448A70289122 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\0F556CC9DCC23D1D425BA8A83BDB5CA7 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.ILGeneration.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\D749A96FC74E3B351E1DEAD84F8175BA 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\System\ado\8B365A2D482A5E1C67CBFDB3B1AEEAD9 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\C57B0561B5A7177BDA9B1B6D6976EC1A 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\ACF990ADA721C5125B94566BE680BFA8.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\69D03FD7699D25A2B1A3FFC8AE3A9F09.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\2627823DBC774688090387240809460C.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\9E4432DDC35440DD9D6076A244167EBD 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\43A383ABCB23C9CB7D29945B796A07DA.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\6A69835F107DBDFA13745C8B0F927E79 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\91728E897F5EAC494BA32677E5AD69A3 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\9FEA4CA2CDCFAE24C9A97DB15A989AB5 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\3F9F314E90AA426818B9BEA10A798D4F.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.IsolatedStorage.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_43.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\ADBE9326DCEE97209676B5EB9B7FC41F 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Internet Explorer\27B17CD7BE64A29C9024FF58D8282747.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AE359BEB9A1E39FF32F002C939723738.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\653650FAD3FA64497D110DCDC3AB1D0C 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\E9235893C6BC9EEF3E9EF407B2A92AE6 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.TypeConverter.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\159B356565CE6B47A0C5EC908E1E3D39 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\7-Zip\E5E401CFC22F9D05E4253DC2E85BC72F 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\5A401B1C648D307503E454F94ABD588C 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\620953B9C75662CC52FFDFC7B1C932A8.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\F9D2CE9C9986196F81F68F7D6880229B.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\6BAE3B833F44AB99AD01003DE226841A.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\D3CB0F57EF0B6ED8243E7171CCF71948 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\E7A262B0B5E4AE795D64456B02A0B8C0 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\7-Zip\4DD601DBD2257D527119EF1DB59F9312 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.Win32.Primitives.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\05579A67C359DAD4D59362156DBA1C0B.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\51C9278EAC92822C1B38DF909E85738A 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\79D04B29754131A47D01FCADF599366B.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\985CC5474DE059D2672E9C6CDD61EF45 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\0F556CC9DCC23D1D425BA8A83BDB5CA7.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\5B6AF57BDC7E653C6F7C2D8A090A3D9A.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\CAEBB0649458640DD10D9029A45686F5 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\4E30D294DAFED4CA3D20B1C4D0836758.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC\Microsoft.mshtml\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC\Microsoft.StdFormat\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\ISymWrapper\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\0215D74DBD5607AA315F50C293B0790D 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\AA20EBB51A426C8D6E21DE6ED7679D3D.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\apppatch\CustomSDB\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\apppatch\ja-JP\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_64\ISymWrapper\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\3937AB96597170DCBCBE0C2F4E85F099 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\DC620F48F9C64F1D885EAB377F6E3740 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\B6AD193D87FB0D402A1844323BCE9251.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\2D5AB7F8BE5E5178DF991CD4AC7ECD9F.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Windows\twain_32.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\PresentationCore\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\BF357354E305DE437122308102B7ADA4.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\appcompat\appraiser\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CB99FEB2BF7B1E766CE49C4054343DBE 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\1BE8BFC07C04D17F2CB6AAF79DEA6B5D 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\Microsoft.Interop.Security.AzRoles.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\53A01E23C375BE9337A802516F55F975 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\8626068180D185B63A61731D14B5F4B2 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\3789B5B5BD18C46CBACC6CF7C374D3D2 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\System.EnterpriseServices\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\25B5AE7E95F11244174D05944A8C0ACF.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Windows\Professional.xml 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Windows\assembly\pubpol24.dat 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CB99FEB2BF7B1E766CE49C4054343DBE.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\C5410E0A8AE1753D930DE26CCA52804E.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\32CDB6E26E036C152F8937DDB4019D37 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\71B2D24F4938E12E53264F8F635FD4F2.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\8C8C815589200AD1BCAAA42B76E08E41 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\42E061ED089023F15A8755B009ECC4E6 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\BC2F460FBF4314AA2AC2364BCF551F9D 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\3937AB96597170DCBCBE0C2F4E85F099.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\addins\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\E415D6C4914005F60FDA8007A6205A79.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\apppatch\AppPatch64\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\1BE8BFC07C04D17F2CB6AAF79DEA6B5D.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\8C8C815589200AD1BCAAA42B76E08E41.info 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\MSBuild\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_64\MSBuild\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File created C:\Windows\assembly\GAC_32\mscorlib\decrypt_Last_Chance.html 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe File opened for modification C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll 403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe"C:\Users\Admin\AppData\Local\Temp\403be0442e847aee7ca7553e19672112450f2e034180a1f57eb8a6d7d39b8d17.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5b20e472b04a6314c755aef583d7e5b84
SHA1697f540da9cc422e6d26e4fe831511f258613060
SHA256640ea8f8f8538fddfbb338ec2db57f5c32a99d67c1057e15bbb7ccc16e932711
SHA5124d2bd2d01847cad32cfc502b97976fea3628647aa3217cbd9efcacf0ed43e9a19c75b1fdb72e1b46f20f2f79316ccd7b216b4cb64325748ff0a7067abdd19d2b