Overview
overview
10Static
static
3b6fdf9369a...ee.exe
windows7-x64
10b6fdf9369a...ee.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3disembarkation.dll
windows7-x64
1disembarkation.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10-02-2024 18:16
Static task
static1
Behavioral task
behavioral1
Sample
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
disembarkation.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
disembarkation.dll
Resource
win10v2004-20231222-en
General
-
Target
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
-
Size
227KB
-
MD5
5cf53ff2d717d768c88fa264934f3361
-
SHA1
63b8ba6b63a44df24f359707c27006901d36244b
-
SHA256
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee
-
SHA512
ffc16845c12c165771b331e0d351b552849d17645e884038e0c97cf3479567da28eea1e88a88f00942e5291c01efb5630771476d3726d544917c227300e33c86
-
SSDEEP
3072:bwJ52Y7ZoH5XJaZ45ku0GJutpaNeVBnLlzcpOpTTOxtgOgEsFB3:bwHysZPEutpaNeVFloclT7esFB3
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.hta
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exeflow pid process 3272 1400 mshta.exe 3274 1400 mshta.exe 3276 1400 mshta.exe 3279 1400 mshta.exe 3281 1400 mshta.exe -
Contacts a large (1094) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1744 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exepid process 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp139.bmp" b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exedescription pid process target process PID 2968 set thread context of 2976 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe -
Drops file in Program Files directory 6 IoCs
Processes:
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.hta b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1636 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exepid process 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exeWMIC.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe Token: SeIncreaseQuotaPrivilege 2840 WMIC.exe Token: SeSecurityPrivilege 2840 WMIC.exe Token: SeTakeOwnershipPrivilege 2840 WMIC.exe Token: SeLoadDriverPrivilege 2840 WMIC.exe Token: SeSystemProfilePrivilege 2840 WMIC.exe Token: SeSystemtimePrivilege 2840 WMIC.exe Token: SeProfSingleProcessPrivilege 2840 WMIC.exe Token: SeIncBasePriorityPrivilege 2840 WMIC.exe Token: SeCreatePagefilePrivilege 2840 WMIC.exe Token: SeBackupPrivilege 2840 WMIC.exe Token: SeRestorePrivilege 2840 WMIC.exe Token: SeShutdownPrivilege 2840 WMIC.exe Token: SeDebugPrivilege 2840 WMIC.exe Token: SeSystemEnvironmentPrivilege 2840 WMIC.exe Token: SeRemoteShutdownPrivilege 2840 WMIC.exe Token: SeUndockPrivilege 2840 WMIC.exe Token: SeManageVolumePrivilege 2840 WMIC.exe Token: 33 2840 WMIC.exe Token: 34 2840 WMIC.exe Token: 35 2840 WMIC.exe Token: SeIncreaseQuotaPrivilege 2840 WMIC.exe Token: SeSecurityPrivilege 2840 WMIC.exe Token: SeTakeOwnershipPrivilege 2840 WMIC.exe Token: SeLoadDriverPrivilege 2840 WMIC.exe Token: SeSystemProfilePrivilege 2840 WMIC.exe Token: SeSystemtimePrivilege 2840 WMIC.exe Token: SeProfSingleProcessPrivilege 2840 WMIC.exe Token: SeIncBasePriorityPrivilege 2840 WMIC.exe Token: SeCreatePagefilePrivilege 2840 WMIC.exe Token: SeBackupPrivilege 2840 WMIC.exe Token: SeRestorePrivilege 2840 WMIC.exe Token: SeShutdownPrivilege 2840 WMIC.exe Token: SeDebugPrivilege 2840 WMIC.exe Token: SeSystemEnvironmentPrivilege 2840 WMIC.exe Token: SeRemoteShutdownPrivilege 2840 WMIC.exe Token: SeUndockPrivilege 2840 WMIC.exe Token: SeManageVolumePrivilege 2840 WMIC.exe Token: 33 2840 WMIC.exe Token: 34 2840 WMIC.exe Token: 35 2840 WMIC.exe Token: SeBackupPrivilege 2528 vssvc.exe Token: SeRestorePrivilege 2528 vssvc.exe Token: SeAuditPrivilege 2528 vssvc.exe Token: SeDebugPrivilege 1636 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mshta.exepid process 1400 mshta.exe 1400 mshta.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exeb6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.execmd.execmd.exedescription pid process target process PID 2968 wrote to memory of 2976 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe PID 2968 wrote to memory of 2976 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe PID 2968 wrote to memory of 2976 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe PID 2968 wrote to memory of 2976 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe PID 2968 wrote to memory of 2976 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe PID 2968 wrote to memory of 2976 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe PID 2968 wrote to memory of 2976 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe PID 2968 wrote to memory of 2976 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe PID 2968 wrote to memory of 2976 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe PID 2968 wrote to memory of 2976 2968 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe PID 2976 wrote to memory of 2592 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe cmd.exe PID 2976 wrote to memory of 2592 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe cmd.exe PID 2976 wrote to memory of 2592 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe cmd.exe PID 2976 wrote to memory of 2592 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe cmd.exe PID 2592 wrote to memory of 2840 2592 cmd.exe WMIC.exe PID 2592 wrote to memory of 2840 2592 cmd.exe WMIC.exe PID 2592 wrote to memory of 2840 2592 cmd.exe WMIC.exe PID 2976 wrote to memory of 1400 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe mshta.exe PID 2976 wrote to memory of 1400 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe mshta.exe PID 2976 wrote to memory of 1400 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe mshta.exe PID 2976 wrote to memory of 1400 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe mshta.exe PID 2976 wrote to memory of 1744 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe cmd.exe PID 2976 wrote to memory of 1744 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe cmd.exe PID 2976 wrote to memory of 1744 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe cmd.exe PID 2976 wrote to memory of 1744 2976 b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe cmd.exe PID 1744 wrote to memory of 1636 1744 cmd.exe taskkill.exe PID 1744 wrote to memory of 1636 1744 cmd.exe taskkill.exe PID 1744 wrote to memory of 1636 1744 cmd.exe taskkill.exe PID 1744 wrote to memory of 568 1744 cmd.exe PING.EXE PID 1744 wrote to memory of 568 1744 cmd.exe PING.EXE PID 1744 wrote to memory of 568 1744 cmd.exe PING.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe"C:\Users\Admin\AppData\Local\Temp\b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe"C:\Users\Admin\AppData\Local\Temp\b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe"2⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\README.hta"3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:1400
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\system32\taskkill.exetaskkill /f /im "b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
PID:568
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5461933609a2e7419128303f2cb9c7446
SHA1d33626fa7fb39a9c9cc6e63aab131154f35f8418
SHA2561db0ac9c8e6dcf2fbee3a9fc2f440e33d1a177f6d78488b2e9f22d62411c9a29
SHA512e595fd46b5e25afe75af32caa302f2b14fc2fc3abb236f53595d80489cd2b489c1fbd5ecaccad34a8b3d6da8359cec4d98792345e82d9b69b5f94c92545c532e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
24KB
MD51bea7d9e09e15e62b38474e87b5c1041
SHA1e5003f5894fe17b517a07a35a270c73506398a5e
SHA256b8bb9c23722c115730f68c1de7e970cab39b7e4a581edc1759cecdd0b2288297
SHA512de552003490a1df588360aea93508375034770d48fc03b680895a5da22430ecd05d64c2b0f6f6e00c30a899c219fb39e4a26803588ff1856a8465b80ef1b7395
-
Filesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d