Analysis
-
max time kernel
117s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-03-2024 08:58
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
HEUR-Trojan.Win32.exe
Resource
win10v2004-20240226-en
General
-
Target
HEUR-Trojan.Win32.exe
-
Size
604KB
-
MD5
8b6bc16fd137c09a08b02bbe1bb7d670
-
SHA1
c69a0f6c6f809c01db92ca658fcf1b643391a2b7
-
SHA256
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
-
SHA512
b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24
-
SSDEEP
6144:yYghlI5/u8f1mr+4RJ99MpDa52RX5wRDhOOU0qsR:yYKlYmDXEpDHRXP01
Malware Config
Extracted
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___WEUS_.txt
cerber
http://p27dokhpz2n7nvgr.onion/6A05-7A53-96EF-0446-9275
http://p27dokhpz2n7nvgr.12hygy.top/6A05-7A53-96EF-0446-9275
http://p27dokhpz2n7nvgr.14ewqv.top/6A05-7A53-96EF-0446-9275
http://p27dokhpz2n7nvgr.14vvrc.top/6A05-7A53-96EF-0446-9275
http://p27dokhpz2n7nvgr.129p1t.top/6A05-7A53-96EF-0446-9275
http://p27dokhpz2n7nvgr.1apgrn.top/6A05-7A53-96EF-0446-9275
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exeflow pid process 2181 696 mshta.exe 2184 696 mshta.exe 2186 696 mshta.exe 2188 696 mshta.exe 2190 696 mshta.exe -
Contacts a large (1094) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2200 netsh.exe 2388 netsh.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2060 cmd.exe -
Drops file in System32 directory 38 IoCs
Processes:
HEUR-Trojan.Win32.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote HEUR-Trojan.Win32.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
HEUR-Trojan.Win32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5EF2.bmp" HEUR-Trojan.Win32.exe -
Drops file in Program Files directory 20 IoCs
Processes:
HEUR-Trojan.Win32.exedescription ioc process File opened for modification \??\c:\program files (x86)\ HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files\ HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\bitcoin HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\powerpoint HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\steam HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\microsoft\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\the bat! HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\thunderbird HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\microsoft\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\microsoft\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote HEUR-Trojan.Win32.exe File opened for modification \??\c:\program files (x86)\onenote HEUR-Trojan.Win32.exe -
Drops file in Windows directory 64 IoCs
Processes:
HEUR-Trojan.Win32.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\ HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! HEUR-Trojan.Win32.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin HEUR-Trojan.Win32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1956 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Processes:
mshta.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 564 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
HEUR-Trojan.Win32.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 1736 HEUR-Trojan.Win32.exe Token: SeDebugPrivilege 1956 taskkill.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
HEUR-Trojan.Win32.exepid process 1736 HEUR-Trojan.Win32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
HEUR-Trojan.Win32.execmd.exedescription pid process target process PID 1736 wrote to memory of 2200 1736 HEUR-Trojan.Win32.exe netsh.exe PID 1736 wrote to memory of 2200 1736 HEUR-Trojan.Win32.exe netsh.exe PID 1736 wrote to memory of 2200 1736 HEUR-Trojan.Win32.exe netsh.exe PID 1736 wrote to memory of 2200 1736 HEUR-Trojan.Win32.exe netsh.exe PID 1736 wrote to memory of 2388 1736 HEUR-Trojan.Win32.exe netsh.exe PID 1736 wrote to memory of 2388 1736 HEUR-Trojan.Win32.exe netsh.exe PID 1736 wrote to memory of 2388 1736 HEUR-Trojan.Win32.exe netsh.exe PID 1736 wrote to memory of 2388 1736 HEUR-Trojan.Win32.exe netsh.exe PID 1736 wrote to memory of 696 1736 HEUR-Trojan.Win32.exe mshta.exe PID 1736 wrote to memory of 696 1736 HEUR-Trojan.Win32.exe mshta.exe PID 1736 wrote to memory of 696 1736 HEUR-Trojan.Win32.exe mshta.exe PID 1736 wrote to memory of 696 1736 HEUR-Trojan.Win32.exe mshta.exe PID 1736 wrote to memory of 564 1736 HEUR-Trojan.Win32.exe NOTEPAD.EXE PID 1736 wrote to memory of 564 1736 HEUR-Trojan.Win32.exe NOTEPAD.EXE PID 1736 wrote to memory of 564 1736 HEUR-Trojan.Win32.exe NOTEPAD.EXE PID 1736 wrote to memory of 564 1736 HEUR-Trojan.Win32.exe NOTEPAD.EXE PID 1736 wrote to memory of 2060 1736 HEUR-Trojan.Win32.exe cmd.exe PID 1736 wrote to memory of 2060 1736 HEUR-Trojan.Win32.exe cmd.exe PID 1736 wrote to memory of 2060 1736 HEUR-Trojan.Win32.exe cmd.exe PID 1736 wrote to memory of 2060 1736 HEUR-Trojan.Win32.exe cmd.exe PID 2060 wrote to memory of 1956 2060 cmd.exe taskkill.exe PID 2060 wrote to memory of 1956 2060 cmd.exe taskkill.exe PID 2060 wrote to memory of 1956 2060 cmd.exe taskkill.exe PID 2060 wrote to memory of 1956 2060 cmd.exe taskkill.exe PID 2060 wrote to memory of 1812 2060 cmd.exe PING.EXE PID 2060 wrote to memory of 1812 2060 cmd.exe PING.EXE PID 2060 wrote to memory of 1812 2060 cmd.exe PING.EXE PID 2060 wrote to memory of 1812 2060 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"1⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___RIURT3MD_.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Modifies system certificate store
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___WEUS_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "HEUR-Trojan.Win32.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\Local\Temp\Tar85E9.tmpFilesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___RIURT3MD_.htaFilesize
75KB
MD519afd37622f2c51659eeb776f2b88bab
SHA11d0baa71035b62528266837e9899039e9cbb15f5
SHA256d0e33af354d11b28ec404ed9d954b4da5d089493beb3b84766a4e4776a8b5c5c
SHA512d4fdeba792e8c04811f59eb916811196b19c0e1b93fa426d547846c16cb9553505246b5564b38eb4a0ac9b922491658c3815e6b06bc236579bf0287b85010a6b
-
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___WEUS_.txtFilesize
1KB
MD5bc00545ae4c3cb2518f989d55c463ec3
SHA1c5ee5c8d69a6637251dab5a313293cfc926f5c36
SHA25656c31d54805512df75bbd2ea20a98185d2aac515d5e6254b43342525d02b063f
SHA5129ac4d2d7c0d006e9ef8094d1afd004f913b5c029ef0a1a9c630c5d013b1630cd2e30148ec8ac691b6144c2c74e769a8a513d926019d17ffbc0bc7e7ffe562d08
-
memory/1736-5-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1736-30-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1736-25-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1736-14-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1736-94-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1736-13-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1736-1-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1736-136-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1736-2-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1736-0-0x0000000000220000-0x0000000000251000-memory.dmpFilesize
196KB