Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 00:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe
-
Size
26KB
-
MD5
4fff1f071abc93be66455b2adcd22c63
-
SHA1
4ef8b2fe43845189e41dda7e1a07d668ea69cbd9
-
SHA256
f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d
-
SHA512
fecdeebd7881deafd643e4a8637cd5cf0a97bc9ca0f65c56c9c6b34b6436beba25c4ec687a64c78e4e681368bbb1003043795d3b574c42753bd16f1268a77aea
-
SSDEEP
768:qq3G3q83wdv7GLGS1R9TNoINEx9jnhwrt:Jkq83wdv7GtD
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Krnl32.exe -
Executes dropped EXE 1 IoCs
pid Process 4252 Krnl32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinKernel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe" f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinKernel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Krnl32.exe" Krnl32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\EhStorAuthn.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\appidtel.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\CredentialUIBroker.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\eudcedit.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE Krnl32.exe File opened for modification C:\Windows\SysWOW64\finger.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cacls.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\control.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\expand.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\regedit.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\backgroundTaskHost.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\at.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\calc.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\CameraSettingsUIHost.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\edpnotify.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\extrac32.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\autochk.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\ByteCodeGenerator.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\efsui.exe Krnl32.exe File created C:\Windows\SysWOW64\certreq.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe Krnl32.exe File created C:\Windows\SysWOW64\dialer.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cttune.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\Dism.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\autofmt.exe Krnl32.exe File created C:\Windows\SysWOW64\certutil.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\compact.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dialer.exe Krnl32.exe File created C:\Windows\SysWOW64\dvdplay.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\findstr.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\BackgroundTransferHost.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\Com\comrepl.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cscript.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\find.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\fontdrvhost.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\getmac.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\choice.exe Krnl32.exe File created C:\Windows\SysWOW64\cscript.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\ftp.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe Krnl32.exe File created C:\Windows\SysWOW64\control.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE Krnl32.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\attrib.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\autoconv.exe Krnl32.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\mirc\script.ini Krnl32.exe File opened for modification C:\Program Files\mirc\ \.dcc send $nick Krnl32.exe File opened for modification C:\Program Files\pirch98\pirch98.ini Krnl32.exe File opened for modification C:\Program Files\pirch98\events.ini Krnl32.exe -
Drops file in Windows directory 44 IoCs
description ioc Process File opened for modification C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe Krnl32.exe File opened for modification C:\Windows\explorer.exe Krnl32.exe File opened for modification C:\Windows\notepad.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Krnl32.exe File opened for modification C:\Windows\splwow64.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\UndockedDevKit.exe Krnl32.exe File opened for modification C:\Windows\hh.exe Krnl32.exe File created C:\Windows\hh.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe Krnl32.exe File opened for modification C:\Windows\sysmon.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe Krnl32.exe File opened for modification C:\Windows\Speech\Common\sapisvr.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe Krnl32.exe File opened for modification C:\Windows\Boot\PCAT\memtest.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe Krnl32.exe File opened for modification C:\Windows\servicing\TrustedInstaller.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe Krnl32.exe File opened for modification C:\Windows\bfsvc.exe Krnl32.exe File opened for modification C:\Windows\HelpPane.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe Krnl32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1171227786" Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417142226" Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{70D66651-E19C-11EE-87B8-D28C415B03FA} = "0" Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1163889293" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094185" Iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1163889293" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094185" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094185" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094185" Iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive Iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1171227786" Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion Iexplore.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-399997616-3400990511-967324271-1000\{B116EAB5-F8A1-4D70-B5F1-0933C58505EB} IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2616 NOTEPAD.EXE -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 3432 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3432 IEXPLORE.EXE Token: SeShutdownPrivilege 3432 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3432 IEXPLORE.EXE Token: SeShutdownPrivilege 3432 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3432 IEXPLORE.EXE Token: SeShutdownPrivilege 3432 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3432 IEXPLORE.EXE Token: SeShutdownPrivilege 3432 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3432 IEXPLORE.EXE Token: SeShutdownPrivilege 3432 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3432 IEXPLORE.EXE Token: SeShutdownPrivilege 3432 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3432 IEXPLORE.EXE Token: SeShutdownPrivilege 3432 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3432 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3732 Iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3732 Iexplore.exe 3732 Iexplore.exe 3432 IEXPLORE.EXE 3432 IEXPLORE.EXE 3432 IEXPLORE.EXE 3432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2660 wrote to memory of 4252 2660 f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe 91 PID 2660 wrote to memory of 4252 2660 f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe 91 PID 2660 wrote to memory of 4252 2660 f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe 91 PID 2660 wrote to memory of 2616 2660 f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe 92 PID 2660 wrote to memory of 2616 2660 f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe 92 PID 2660 wrote to memory of 2616 2660 f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe 92 PID 4252 wrote to memory of 3732 4252 Krnl32.exe 106 PID 4252 wrote to memory of 3732 4252 Krnl32.exe 106 PID 3732 wrote to memory of 3432 3732 Iexplore.exe 107 PID 3732 wrote to memory of 3432 3732 Iexplore.exe 107 PID 3732 wrote to memory of 3432 3732 Iexplore.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe"C:\Users\Admin\AppData\Local\Temp\f6f0084d9162b1ef652da022b157379b7be7e102b50c6b3d537a239633c8d76d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\Krnl32.exe"C:\Users\Admin\AppData\Local\Temp\Krnl32.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Program Files\Internet Explorer\Iexplore.exe"C:\Program Files\Internet Explorer\Iexplore.exe" http://wwp.icq.com/scripts/WWPMsg.dll?from=M4TrIx&fromemail=_&subject=MATRIX&body=THE%20MATRIX%20HAS%20COME...&to=90001321%20HTTP/1.03⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3732 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3432
-
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\HELPME.TXT2⤵
- Opens file in notepad (likely ransom note)
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
67B
MD5057798d389930107a381a2690141ac1d
SHA1e44f1c2475c0f2323507e141dcae53ffef51c624
SHA2565ba8c75f08589b808a6e16225ea565734aeeb23edc40894174d2d135f5e8d3d2
SHA51298b40b6a11027974b482cb645718d34c8ee707ad01d6eba05acbf15a3b8d7c762afc08fef6513623fefe6e297d77a838fbb980d944a4a8e864356dfabac473e2
-
Filesize
26KB
MD5378b3a5a640591ce7d0670b9402106a4
SHA18aabe671034bd82407ea81ff525b23588358d4dc
SHA2569c03289ab63d02f84e2114416b68aec1dbbda2bc4485655784599777de8b14ea
SHA5125779bc5ced071e8829658f4b62b13fc4cfd9a31a904de700b2ba9afd1fecb283157d659bfcc6b3c11e357be8089305daf5b98c68db72ec948ad182f2675655cc