Analysis
-
max time kernel
120s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-03-2024 04:58
Static task
static1
Behavioral task
behavioral1
Sample
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe
Resource
win10v2004-20240226-en
General
-
Target
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe
-
Size
2.5MB
-
MD5
e49ba2b2c27a164cf3b652069fc984c2
-
SHA1
1a6c7d91286220e2c28a665f85633825ef578e95
-
SHA256
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c
-
SHA512
2c4336dc6e062483753d760c339fb4bd7e6e06dfc5b9b25d4b05885414a9b7a5b9c62931558c31f1f398862c111ad35c6389c1ee3af15af2d2cbc3db85ecc670
-
SSDEEP
49152:+L2K7HrOi1eIhFwRncwD0FnPYAEhd/KOw8QwsJM60lQYJnn3Ect76:wd7Hrhh2RcYonAJ6BM667nnRt
Malware Config
Extracted
C:\Users\Admin\Desktop\_READ_THIS_FILE_99PY4A_.txt
http://p27dokhpz2n7nvgr.onion/09FD-833B-CA5B-0091-B851
http://p27dokhpz2n7nvgr.1hkjl3.top/09FD-833B-CA5B-0091-B851
http://p27dokhpz2n7nvgr.16nxpn.top/09FD-833B-CA5B-0091-B851
http://p27dokhpz2n7nvgr.133chr.top/09FD-833B-CA5B-0091-B851
http://p27dokhpz2n7nvgr.17gvad.top/09FD-833B-CA5B-0091-B851
http://p27dokhpz2n7nvgr.15yvce.top/09FD-833B-CA5B-0091-B851
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exeflow pid process 2181 556 mshta.exe 2184 556 mshta.exe 2186 556 mshta.exe 2188 556 mshta.exe 2190 556 mshta.exe -
Contacts a large (1094) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2524 netsh.exe 2568 netsh.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1924 cmd.exe -
Drops file in System32 directory 38 IoCs
Processes:
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exepid process 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe -
Drops file in Program Files directory 20 IoCs
Processes:
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exedescription ioc process File opened for modification \??\c:\program files (x86)\thunderbird 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\microsoft\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\microsoft\office 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\office 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files\ 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\steam 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\the bat! 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\ 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\program files (x86)\bitcoin 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe -
Drops file in Windows directory 64 IoCs
Processes:
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\ 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2640 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Processes:
mshta.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 mshta.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 564 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe Token: SeDebugPrivilege 2640 taskkill.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exepid process 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.execmd.exedescription pid process target process PID 2144 wrote to memory of 2568 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe netsh.exe PID 2144 wrote to memory of 2568 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe netsh.exe PID 2144 wrote to memory of 2568 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe netsh.exe PID 2144 wrote to memory of 2568 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe netsh.exe PID 2144 wrote to memory of 2524 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe netsh.exe PID 2144 wrote to memory of 2524 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe netsh.exe PID 2144 wrote to memory of 2524 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe netsh.exe PID 2144 wrote to memory of 2524 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe netsh.exe PID 2144 wrote to memory of 556 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe mshta.exe PID 2144 wrote to memory of 556 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe mshta.exe PID 2144 wrote to memory of 556 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe mshta.exe PID 2144 wrote to memory of 556 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe mshta.exe PID 2144 wrote to memory of 564 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe NOTEPAD.EXE PID 2144 wrote to memory of 564 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe NOTEPAD.EXE PID 2144 wrote to memory of 564 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe NOTEPAD.EXE PID 2144 wrote to memory of 564 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe NOTEPAD.EXE PID 2144 wrote to memory of 1924 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe cmd.exe PID 2144 wrote to memory of 1924 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe cmd.exe PID 2144 wrote to memory of 1924 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe cmd.exe PID 2144 wrote to memory of 1924 2144 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe cmd.exe PID 1924 wrote to memory of 2640 1924 cmd.exe taskkill.exe PID 1924 wrote to memory of 2640 1924 cmd.exe taskkill.exe PID 1924 wrote to memory of 2640 1924 cmd.exe taskkill.exe PID 1924 wrote to memory of 2640 1924 cmd.exe taskkill.exe PID 1924 wrote to memory of 844 1924 cmd.exe PING.EXE PID 1924 wrote to memory of 844 1924 cmd.exe PING.EXE PID 1924 wrote to memory of 844 1924 cmd.exe PING.EXE PID 1924 wrote to memory of 844 1924 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe"C:\Users\Admin\AppData\Local\Temp\8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THIS_FILE_WT6FKC_.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Modifies system certificate store
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THIS_FILE_99PY4A_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\Local\Temp\TarAA2.tmpFilesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
C:\Users\Admin\Desktop\_READ_THIS_FILE_99PY4A_.txtFilesize
1KB
MD596bdd86ed8cacd6d9279b54d74ba2b99
SHA1835f5f43ecfa4fa9fe072dff6a841663be8a0b55
SHA25661aeb3884dd2074f69a958f85a09c822ea3a7a410554eff307c6e94222ff1c1c
SHA5121df37ca5588153a962cbfcdf29c50bfabf7a0f9c131a466ebcc8e02fee48a3afffe4f544dbe1c8b41daabf44bb486a190fb69d31b34e11245eecd33cffdfdff6
-
C:\Users\Admin\Desktop\_READ_THIS_FILE_WT6FKC_.htaFilesize
75KB
MD52dc99289b9c4a55bfe43adb998983a7c
SHA116ae9b906f7bc4e50c8e5059d3b09863e5a406be
SHA256e7ae2c8a30d2c4d9d4ab351e0f5f1ff85381a76fcdc9bd931207332697717055
SHA5126c6f3944d5ac8e4f70a5c49a9e2ad5addad3f6c9dc9b2d055edfebd4d9f2750047f215bfc50f95d4566e94b0b08eb06a97176394e6518b53482762ec80f5728e
-
memory/2144-4-0x0000000000400000-0x0000000000DEB000-memory.dmpFilesize
9.9MB
-
memory/2144-6-0x0000000000400000-0x0000000000DEB000-memory.dmpFilesize
9.9MB
-
memory/2144-7-0x0000000000400000-0x0000000000DEB000-memory.dmpFilesize
9.9MB
-
memory/2144-10-0x0000000000400000-0x0000000000DEB000-memory.dmpFilesize
9.9MB
-
memory/2144-11-0x0000000000400000-0x0000000000DEB000-memory.dmpFilesize
9.9MB
-
memory/2144-12-0x000000007EBD0000-0x000000007EFA1000-memory.dmpFilesize
3.8MB
-
memory/2144-53-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB
-
memory/2144-56-0x0000000005030000-0x0000000005040000-memory.dmpFilesize
64KB
-
memory/2144-1-0x0000000000400000-0x0000000000DEB000-memory.dmpFilesize
9.9MB
-
memory/2144-5-0x0000000002800000-0x0000000002801000-memory.dmpFilesize
4KB
-
memory/2144-76-0x0000000000400000-0x0000000000DEB000-memory.dmpFilesize
9.9MB
-
memory/2144-3-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB
-
memory/2144-2-0x000000007EBD0000-0x000000007EFA1000-memory.dmpFilesize
3.8MB