Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-03-2024 14:01
Behavioral task
behavioral1
Sample
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe
Resource
win10v2004-20240226-en
General
-
Target
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe
-
Size
236KB
-
MD5
b81165ab0938e84fa87efefe0e2c0030
-
SHA1
9e33c952c6a0e14162c0de07eabc7d64e7f5b272
-
SHA256
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed
-
SHA512
93805f5191a75cae4360ad41ec705bc1b6120db6f94c755016f6a9fecff02562ecbf95ee4e466149cefc7133289be04cd531954e311f38694a32b12b84db9932
-
SSDEEP
6144:KZtaw1henWCopyU0wKxbVKNaquP4V1+v1jnef:gHyVU0wKlVK0q9V141Cf
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THIS_FILE_MWONP_.hta
cerber
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THIS_FILE_B5H3Y_.txt
http://p27dokhpz2n7nvgr.onion/2011-8482-E16A-0091-B540
http://p27dokhpz2n7nvgr.1hkjl3.top/2011-8482-E16A-0091-B540
http://p27dokhpz2n7nvgr.16nxpn.top/2011-8482-E16A-0091-B540
http://p27dokhpz2n7nvgr.133chr.top/2011-8482-E16A-0091-B540
http://p27dokhpz2n7nvgr.17gvad.top/2011-8482-E16A-0091-B540
http://p27dokhpz2n7nvgr.15yvce.top/2011-8482-E16A-0091-B540
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1117) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 4580 netsh.exe 4052 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe -
Drops startup file 1 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe -
Processes:
resource yara_rule behavioral2/memory/4228-0-0x0000000000400000-0x0000000000444000-memory.dmp upx -
Drops file in System32 directory 38 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe -
Drops file in Program Files directory 20 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exedescription ioc process File opened for modification \??\c:\program files\ 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\ 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\program files (x86)\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe -
Drops file in Windows directory 64 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\ 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4884 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 3404 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe Token: SeCreatePagefilePrivilege 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe Token: SeDebugPrivilege 4884 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.execmd.exedescription pid process target process PID 4228 wrote to memory of 4052 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 4228 wrote to memory of 4052 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 4228 wrote to memory of 4052 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 4228 wrote to memory of 4580 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 4228 wrote to memory of 4580 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 4228 wrote to memory of 4580 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe netsh.exe PID 4228 wrote to memory of 4508 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe mshta.exe PID 4228 wrote to memory of 4508 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe mshta.exe PID 4228 wrote to memory of 4508 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe mshta.exe PID 4228 wrote to memory of 3404 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe NOTEPAD.EXE PID 4228 wrote to memory of 3404 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe NOTEPAD.EXE PID 4228 wrote to memory of 3404 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe NOTEPAD.EXE PID 4228 wrote to memory of 556 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe cmd.exe PID 4228 wrote to memory of 556 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe cmd.exe PID 4228 wrote to memory of 556 4228 0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe cmd.exe PID 556 wrote to memory of 4884 556 cmd.exe taskkill.exe PID 556 wrote to memory of 4884 556 cmd.exe taskkill.exe PID 556 wrote to memory of 4884 556 cmd.exe taskkill.exe PID 556 wrote to memory of 3212 556 cmd.exe PING.EXE PID 556 wrote to memory of 3212 556 cmd.exe PING.EXE PID 556 wrote to memory of 3212 556 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe"C:\Users\Admin\AppData\Local\Temp\0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THIS_FILE_UOVH_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THIS_FILE_KGX1HH_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "0251ebd0df7c32e2a03ff9bb48754e9e13ef2ee2d0e99ce1c135a50b448338ed.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_READ_THIS_FILE_MWONP_.htaFilesize
75KB
MD57111a1c2eccf1b96719436393d13d16f
SHA192135429a8d265fce68d4a5202773238754d50bf
SHA2569a0f035fc80f236e3e127c0c3276dbdcbb0a7d647a02395f4c861228a87a0621
SHA5128d817fa13a28aa5054ceadb6e67bccc3a3c42053b8dce0c7ade90caa0d9d2946b13c79497babb5305bbcbaddadafc120828150c3b86dc6bb07793896c57a9cde
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THIS_FILE_B5H3Y_.txtFilesize
1KB
MD5a78a0754313e574a0c90edd0db6ecec9
SHA1eddd6fa410eeb25d71f1bef92c85050bf1104190
SHA25695e1f0a16920e316475c0d24030fc3a42d871bf2a1ace911e9802b09153aa81e
SHA5121c8365c55e551b385f791de569f97a495ebfdad6dd5ed9b8f2af50780f2b7c70e1a44b6877911cf1f8093b7a1cd93735b4282551520c05bc4da72966aa3f7bf9
-
memory/4228-0-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4228-2-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4228-3-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/4228-1-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4228-4-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/4228-5-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4228-8-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4228-9-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4228-384-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB