Analysis
-
max time kernel
120s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-03-2024 14:01
Behavioral task
behavioral1
Sample
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe
Resource
win10v2004-20240226-en
General
-
Target
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe
-
Size
236KB
-
MD5
b81165ab0938e84fa87efefe0e2c0030
-
SHA1
9e33c952c6a0e14162c0de07eabc7d64e7f5b272
-
SHA256
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed
-
SHA512
93805f5191a75cae4360ad41ec705bc1b6120db6f94c755016f6a9fecff02562ecbf95ee4e466149cefc7133289be04cd531954e311f38694a32b12b84db9932
-
SSDEEP
6144:KZtaw1henWCopyU0wKxbVKNaquP4V1+v1jnef:gHyVU0wKlVK0q9V141Cf
Malware Config
Extracted
C:\Users\Admin\Desktop\_READ_THIS_FILE_IQ13G_.txt
http://p27dokhpz2n7nvgr.onion/7435-9474-BA2D-0091-BE31
http://p27dokhpz2n7nvgr.1hkjl3.top/7435-9474-BA2D-0091-BE31
http://p27dokhpz2n7nvgr.16nxpn.top/7435-9474-BA2D-0091-BE31
http://p27dokhpz2n7nvgr.133chr.top/7435-9474-BA2D-0091-BE31
http://p27dokhpz2n7nvgr.17gvad.top/7435-9474-BA2D-0091-BE31
http://p27dokhpz2n7nvgr.15yvce.top/7435-9474-BA2D-0091-BE31
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exeflow pid process 2181 1544 mshta.exe 2184 1544 mshta.exe 2186 1544 mshta.exe 2188 1544 mshta.exe 2190 1544 mshta.exe -
Contacts a large (1094) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2684 netsh.exe 2568 netsh.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1924 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/2940-0-0x0000000000400000-0x0000000000444000-memory.dmp upx -
Drops file in System32 directory 38 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe -
Drops file in Program Files directory 20 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exedescription ioc process File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\ 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files\ 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe -
Drops file in Windows directory 64 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\ 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2380 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 1500 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe Token: SeDebugPrivilege 2380 taskkill.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.execmd.exedescription pid process target process PID 2940 wrote to memory of 2684 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 2940 wrote to memory of 2684 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 2940 wrote to memory of 2684 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 2940 wrote to memory of 2684 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 2940 wrote to memory of 2568 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 2940 wrote to memory of 2568 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 2940 wrote to memory of 2568 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 2940 wrote to memory of 2568 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 2940 wrote to memory of 1544 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe mshta.exe PID 2940 wrote to memory of 1544 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe mshta.exe PID 2940 wrote to memory of 1544 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe mshta.exe PID 2940 wrote to memory of 1544 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe mshta.exe PID 2940 wrote to memory of 1500 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe NOTEPAD.EXE PID 2940 wrote to memory of 1500 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe NOTEPAD.EXE PID 2940 wrote to memory of 1500 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe NOTEPAD.EXE PID 2940 wrote to memory of 1500 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe NOTEPAD.EXE PID 2940 wrote to memory of 1924 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe cmd.exe PID 2940 wrote to memory of 1924 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe cmd.exe PID 2940 wrote to memory of 1924 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe cmd.exe PID 2940 wrote to memory of 1924 2940 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe cmd.exe PID 1924 wrote to memory of 2380 1924 cmd.exe taskkill.exe PID 1924 wrote to memory of 2380 1924 cmd.exe taskkill.exe PID 1924 wrote to memory of 2380 1924 cmd.exe taskkill.exe PID 1924 wrote to memory of 2380 1924 cmd.exe taskkill.exe PID 1924 wrote to memory of 1432 1924 cmd.exe PING.EXE PID 1924 wrote to memory of 1432 1924 cmd.exe PING.EXE PID 1924 wrote to memory of 1432 1924 cmd.exe PING.EXE PID 1924 wrote to memory of 1432 1924 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe"C:\Users\Admin\AppData\Local\Temp\0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THIS_FILE_KQXUJR_.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Modifies system certificate store
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THIS_FILE_IQ13G_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\Local\Temp\TarC09.tmpFilesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
C:\Users\Admin\Desktop\_READ_THIS_FILE_IQ13G_.txtFilesize
1KB
MD54a47282a2e89f58cee63b8e36292c2b3
SHA1052cb49079ddaebfad9fb6a498df7f1aba0ffca6
SHA2566591773477ccadb47fee553b3cb7979267d5d6a79765b56fdb3f2f2950fba6a3
SHA51292fa3d9c160d6dbc9e40a5f16c9df42b820edeac3e459e60e48c9ca037b857aef873e78bd14a67da5e25d363dfbb2cfc81aaeb45036fb1781df6c54a67013247
-
C:\Users\Admin\Desktop\_READ_THIS_FILE_KQXUJR_.htaFilesize
75KB
MD5bc4d6c845db349fa49a0131d1364ccd2
SHA1743cd75194e7b52f12f44a7cac11b13e1c19d33e
SHA2563e81e850c560087f50f94801fbc183cff2b757d6ee84ec827c3a86786fc75ab8
SHA51262ef721310856785e6b41d3d4e653a8a6aedf6ccd381fd799f25b791fe2cdd908b0e7943a9d6a4480565d91b6574459ca782aa8dbb26190ea60cfe0d4f4e7269
-
memory/2940-4-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2940-6-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2940-105-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2940-108-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/2940-109-0x0000000003AA0000-0x0000000003AB0000-memory.dmpFilesize
64KB
-
memory/2940-2-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/2940-0-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2940-5-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2940-3-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB