Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-03-2024 20:57
Static task
static1
Behavioral task
behavioral1
Sample
3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe
Resource
win10v2004-20240226-en
General
-
Target
3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe
-
Size
337KB
-
MD5
6b50f4c0c2680b858660f4fac7da7997
-
SHA1
d072d2599c066127bbe7498a22d6be36cb2520a0
-
SHA256
3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9
-
SHA512
5a2d0145a027f6291d6b44e01f162877a90f75f9430244279c4ff3dad20a3bd7c7d8f3579e589d8f43855b936f81bdd6735cca4d1e075b35dc524a42593c3718
-
SSDEEP
6144:x10dQ9HvBKnLUJwsPnER47ST0vfnRX3yZY4J2laK92:xBHvwnLUO1R47S6fRny2n
Malware Config
Extracted
C:\HOW TO BACK FILES.txt
targetcompany
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2964 bcdedit.exe 1852 bcdedit.exe -
Renames multiple (2695) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\N: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\R: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\B: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\G: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\H: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\I: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\K: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\W: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\Z: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\L: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\Q: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\S: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\A: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\O: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\P: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\X: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\Y: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\V: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\D: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\E: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\J: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\T: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened (read-only) \??\U: 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746U.BMP 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_COL.HXC 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File created C:\Program Files\7-Zip\Lang\HOW TO BACK FILES.txt 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\HOW TO BACK FILES.txt 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HOW TO BACK FILES.txt 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\gradient.png 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR41F.GIF 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WZCNFLCT.CHM 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackgroundRTL.jpg 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02371_.WMF 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Windows Journal\ja-JP\PDIALOG.exe.mui 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfig.zip 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\HOW TO BACK FILES.txt 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Oslo 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14595_.GIF 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02039U.BMP 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File created C:\Program Files\VideoLAN\VLC\locale\am\HOW TO BACK FILES.txt 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\DVD Maker\bod_r.TTF 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\COUPON.POC 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00006_.WMF 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\JNGLE_01.MID 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00965_.WMF 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105380.WMF 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02062U.BMP 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\HOW TO BACK FILES.txt 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\HOW TO BACK FILES.txt 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01740_.GIF 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Earthy.gif 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCAL.XML 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL.DPV 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\HOW TO BACK FILES.txt 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUNGLE.GIF 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianResume.Dotx 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02169_.WMF 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.PPT 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME42.CSS 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB2B.BDR 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\HOW TO BACK FILES.txt 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_choosefont.gif 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_LightSpirit.gif 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\HOW TO BACK FILES.txt 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\it-IT\HOW TO BACK FILES.txt 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeDebugPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Token: SeTakeOwnershipPrivilege 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2020 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe 28 PID 2796 wrote to memory of 2020 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe 28 PID 2796 wrote to memory of 2020 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe 28 PID 2796 wrote to memory of 1756 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe 30 PID 2796 wrote to memory of 1756 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe 30 PID 2796 wrote to memory of 1756 2796 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe 30 PID 2020 wrote to memory of 2964 2020 cmd.exe 32 PID 2020 wrote to memory of 2964 2020 cmd.exe 32 PID 2020 wrote to memory of 2964 2020 cmd.exe 32 PID 1756 wrote to memory of 1852 1756 cmd.exe 33 PID 1756 wrote to memory of 1852 1756 cmd.exe 33 PID 1756 wrote to memory of 1852 1756 cmd.exe 33 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "1" 3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe"C:\Users\Admin\AppData\Local\Temp\3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2796 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2964
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1852
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD541be5d1090ac9d6e209b777647272263
SHA1aebff1e3f8c09f5e0f4dc8605fd2d7468f5ab8da
SHA256589b0e0205405f7c969325b231eaa7f6d5d97182a60057f0a9d384b928dc8c1e
SHA512f1f6a72195f53d424d8760611bc64a710b3e273196f6a2cd78799637e36db5fde247846d448cf878ef82b1ad1fccefb4fa610c8330492c922eae4e13f7290834