Analysis
-
max time kernel
167s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-03-2024 20:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe
-
Size
384KB
-
MD5
adfedffccba08228a1f1addaeb0ad537
-
SHA1
8439a711ec759254f207eaac8162049062de2c0d
-
SHA256
1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0
-
SHA512
3d58224ba47c24ee7af5a3173b77a83082c978d44467d740e4b0b77e0ae727a34843d8a6fdf54c5ba7536d9b5c46c69f39175a7eacaccde905a4b00c47bbe351
-
SSDEEP
6144:zBeJdbHCHcRgJUdarnrIM+PbeEnvutw2cfMuXrvEnODd0cpMLnJV6Xlxq+:zBCdG4g2rM+PFgCM+rcOd0l/elxz
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+etslc.txt
Family
teslacrypt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with AES
More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES
How did this happen ?
!!! Specially for your PC was generated personal AES KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/7726A37C30D32E39
2. http://tes543berda73i48fsdfsd.keratadze.at/7726A37C30D32E39
3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/7726A37C30D32E39
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser
3. Type in the address bar: xlowfznrg4wf7dli.onion/7726A37C30D32E39
4. Follow the instructions on the site.
---------------- IMPORTANT INFORMATION------------------------
*-*-* Your personal pages:
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/7726A37C30D32E39
http://tes543berda73i48fsdfsd.keratadze.at/7726A37C30D32E39
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/7726A37C30D32E39
*-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/7726A37C30D32E39
URLs
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/7726A37C30D32E39
http://tes543berda73i48fsdfsd.keratadze.at/7726A37C30D32E39
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/7726A37C30D32E39
http://xlowfznrg4wf7dli.ONION/7726A37C30D32E39
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (164) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 584 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2820 iannnskkynfv.exe 2916 iannnskkynfv.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\qfusibarqalh = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\iannnskkynfv.exe\"" iannnskkynfv.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3000 set thread context of 2560 3000 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 29 PID 2820 set thread context of 2916 2820 iannnskkynfv.exe 33 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png iannnskkynfv.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\_RECOVERY_+etslc.png iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\_RECOVERY_+etslc.txt iannnskkynfv.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\_RECOVERY_+etslc.txt iannnskkynfv.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt iannnskkynfv.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\_RECOVERY_+etslc.html iannnskkynfv.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\_RECOVERY_+etslc.png iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\_RECOVERY_+etslc.png iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\_RECOVERY_+etslc.png iannnskkynfv.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_RECOVERY_+etslc.html iannnskkynfv.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\_RECOVERY_+etslc.png iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\_RECOVERY_+etslc.html iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\_RECOVERY_+etslc.html iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\_RECOVERY_+etslc.txt iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\_RECOVERY_+etslc.png iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\_RECOVERY_+etslc.txt iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\_RECOVERY_+etslc.txt iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DissolveNoise.png iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\_RECOVERY_+etslc.txt iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_RECOVERY_+etslc.txt iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\_RECOVERY_+etslc.txt iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\_RECOVERY_+etslc.png iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\_RECOVERY_+etslc.txt iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv iannnskkynfv.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt iannnskkynfv.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\_RECOVERY_+etslc.txt iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\System\ado\_RECOVERY_+etslc.txt iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\_RECOVERY_+etslc.html iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png iannnskkynfv.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png iannnskkynfv.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak iannnskkynfv.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak iannnskkynfv.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\_RECOVERY_+etslc.png iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\_RECOVERY_+etslc.png iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\_RECOVERY_+etslc.html iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\_RECOVERY_+etslc.html iannnskkynfv.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt iannnskkynfv.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\_RECOVERY_+etslc.html iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png iannnskkynfv.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png iannnskkynfv.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_RECOVERY_+etslc.png iannnskkynfv.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\iannnskkynfv.exe 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe File opened for modification C:\Windows\iannnskkynfv.exe 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe 2916 iannnskkynfv.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2560 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe Token: SeDebugPrivilege 2916 iannnskkynfv.exe Token: SeIncreaseQuotaPrivilege 1160 WMIC.exe Token: SeSecurityPrivilege 1160 WMIC.exe Token: SeTakeOwnershipPrivilege 1160 WMIC.exe Token: SeLoadDriverPrivilege 1160 WMIC.exe Token: SeSystemProfilePrivilege 1160 WMIC.exe Token: SeSystemtimePrivilege 1160 WMIC.exe Token: SeProfSingleProcessPrivilege 1160 WMIC.exe Token: SeIncBasePriorityPrivilege 1160 WMIC.exe Token: SeCreatePagefilePrivilege 1160 WMIC.exe Token: SeBackupPrivilege 1160 WMIC.exe Token: SeRestorePrivilege 1160 WMIC.exe Token: SeShutdownPrivilege 1160 WMIC.exe Token: SeDebugPrivilege 1160 WMIC.exe Token: SeSystemEnvironmentPrivilege 1160 WMIC.exe Token: SeRemoteShutdownPrivilege 1160 WMIC.exe Token: SeUndockPrivilege 1160 WMIC.exe Token: SeManageVolumePrivilege 1160 WMIC.exe Token: 33 1160 WMIC.exe Token: 34 1160 WMIC.exe Token: 35 1160 WMIC.exe Token: SeIncreaseQuotaPrivilege 1160 WMIC.exe Token: SeSecurityPrivilege 1160 WMIC.exe Token: SeTakeOwnershipPrivilege 1160 WMIC.exe Token: SeLoadDriverPrivilege 1160 WMIC.exe Token: SeSystemProfilePrivilege 1160 WMIC.exe Token: SeSystemtimePrivilege 1160 WMIC.exe Token: SeProfSingleProcessPrivilege 1160 WMIC.exe Token: SeIncBasePriorityPrivilege 1160 WMIC.exe Token: SeCreatePagefilePrivilege 1160 WMIC.exe Token: SeBackupPrivilege 1160 WMIC.exe Token: SeRestorePrivilege 1160 WMIC.exe Token: SeShutdownPrivilege 1160 WMIC.exe Token: SeDebugPrivilege 1160 WMIC.exe Token: SeSystemEnvironmentPrivilege 1160 WMIC.exe Token: SeRemoteShutdownPrivilege 1160 WMIC.exe Token: SeUndockPrivilege 1160 WMIC.exe Token: SeManageVolumePrivilege 1160 WMIC.exe Token: 33 1160 WMIC.exe Token: 34 1160 WMIC.exe Token: 35 1160 WMIC.exe Token: SeBackupPrivilege 1940 vssvc.exe Token: SeRestorePrivilege 1940 vssvc.exe Token: SeAuditPrivilege 1940 vssvc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2560 3000 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 29 PID 3000 wrote to memory of 2560 3000 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 29 PID 3000 wrote to memory of 2560 3000 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 29 PID 3000 wrote to memory of 2560 3000 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 29 PID 3000 wrote to memory of 2560 3000 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 29 PID 3000 wrote to memory of 2560 3000 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 29 PID 3000 wrote to memory of 2560 3000 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 29 PID 3000 wrote to memory of 2560 3000 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 29 PID 3000 wrote to memory of 2560 3000 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 29 PID 3000 wrote to memory of 2560 3000 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 29 PID 2560 wrote to memory of 2820 2560 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 30 PID 2560 wrote to memory of 2820 2560 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 30 PID 2560 wrote to memory of 2820 2560 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 30 PID 2560 wrote to memory of 2820 2560 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 30 PID 2560 wrote to memory of 584 2560 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 31 PID 2560 wrote to memory of 584 2560 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 31 PID 2560 wrote to memory of 584 2560 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 31 PID 2560 wrote to memory of 584 2560 1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe 31 PID 2820 wrote to memory of 2916 2820 iannnskkynfv.exe 33 PID 2820 wrote to memory of 2916 2820 iannnskkynfv.exe 33 PID 2820 wrote to memory of 2916 2820 iannnskkynfv.exe 33 PID 2820 wrote to memory of 2916 2820 iannnskkynfv.exe 33 PID 2820 wrote to memory of 2916 2820 iannnskkynfv.exe 33 PID 2820 wrote to memory of 2916 2820 iannnskkynfv.exe 33 PID 2820 wrote to memory of 2916 2820 iannnskkynfv.exe 33 PID 2820 wrote to memory of 2916 2820 iannnskkynfv.exe 33 PID 2820 wrote to memory of 2916 2820 iannnskkynfv.exe 33 PID 2820 wrote to memory of 2916 2820 iannnskkynfv.exe 33 PID 2916 wrote to memory of 1160 2916 iannnskkynfv.exe 34 PID 2916 wrote to memory of 1160 2916 iannnskkynfv.exe 34 PID 2916 wrote to memory of 1160 2916 iannnskkynfv.exe 34 PID 2916 wrote to memory of 1160 2916 iannnskkynfv.exe 34 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System iannnskkynfv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" iannnskkynfv.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe"C:\Users\Admin\AppData\Local\Temp\1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe"C:\Users\Admin\AppData\Local\Temp\1093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\iannnskkynfv.exeC:\Windows\iannnskkynfv.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\iannnskkynfv.exeC:\Windows\iannnskkynfv.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2916 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\1093EB~1.EXE3⤵
- Deletes itself
PID:584
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5dc1f526f024c349242cd70eca6bd6dcd
SHA11ef6540e3a5db405dc715110e0a7647b274574f0
SHA256b2e01067650af16d91ee882d862e459caa2f4707ee9f7e0ac8d6df07681a11a6
SHA512d6844b21e2087b06126adde6532773d4e480123779ee3100ca6e69430b8f7df8e92a6e913a0d33c0bed2ca3e9683f4c0538675216313ff0f6b35c97986536529
-
Filesize
63KB
MD5ec2fc3a16004ace0ba266d5f0977c4ff
SHA19ff3266ef5cbf0690da583cbcc9e465679c8b8c2
SHA2567f7d1f7d65f7f72de1319b5aeccabe7a55f28684b79edc710068fc680626ccdb
SHA512c8ba73b2129f0221aafc552b9134664ad382a9944499ccbc6e7187f583adc56a9083cdf6422e47e90dd4146c5ff06d26999001d31f86af2841ccf7f93eb74aa8
-
Filesize
1KB
MD5912c6b5ca5717026a5b7a9dcb6e25136
SHA188b9609b96a1e06f2c9296c4a27bf57181e3aa3c
SHA2565952cfddf363fcfcab9fcf4a4889fbe7e4f8ba7421bf55ef6fb6caa0a95fdb40
SHA512ef815203da4c40df6e4ed2e1674c479fffdb58c8a124f5caabdd7ee7bd530bca2da4609bde03e6f307da51f9579e6bb0f9f031c8cc3629ebb73e7e239eb49d37
-
Filesize
384KB
MD5adfedffccba08228a1f1addaeb0ad537
SHA18439a711ec759254f207eaac8162049062de2c0d
SHA2561093eb4a29db197dceb1a8c61dce72b2de5479f3cab1583ff955c06c63ef71e0
SHA5123d58224ba47c24ee7af5a3173b77a83082c978d44467d740e4b0b77e0ae727a34843d8a6fdf54c5ba7536d9b5c46c69f39175a7eacaccde905a4b00c47bbe351
