Analysis
- max time kernel
349s - max time network
351s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
15/03/2024, 01:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
sus_protected.exe
Resource
win7-20240221-en
windows7-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
sus_protected.exe
Resource
win10-20240221-en
windows10-1703-x64
13 signatures
300 seconds
Behavioral task
behavioral3
Sample
sus_protected.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral4
Sample
sus_protected.exe
Resource
win11-20240221-en
windows11-21h2-x64
19 signatures
300 seconds
General
- Target sus_protected.exe
- Size 105KB
- Sample240315-bveaeafc32
- SHA256 f730bbdf76ecc7e6a3cbc22516b2f66e6ce1bc0ff79f86fb651a9caa9020dba2
- MD5 2bdf24dce352606a0f2242f8270bd824
- SHA1 15a49cf15a7145452d4f5a5f4ac473e80fe13af8
- SHA512 2d4ebaa1259204d7ff8ace8d28173b7df2b81bce81fb9d10d2d911488042499c6549c9895f7ff37c51bbd19b465b719a768706b570d1127d1c1e76a04508c348
- SSDEEP 3072:A89pI4WuF+2BCyRf2aQw9X/z4bXCTrdft6ozGiXobQzB:AUWXafcw9/z4bi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xworm
C2
-
hai1723rat-60039.portmap.io:60039
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/2796-2295-0x0000000002350000-0x000000000235E000-memory.dmp disable_win_def - Detect Xworm Payload 7 IoCs
resource yara_rule behavioral1/memory/2796-6-0x0000000000400000-0x0000000000418000-memory.dmp family_xworm behavioral1/memory/2796-7-0x0000000000400000-0x0000000000418000-memory.dmp family_xworm behavioral1/memory/2796-10-0x0000000000400000-0x0000000000418000-memory.dmp family_xworm behavioral1/memory/2796-13-0x0000000000400000-0x0000000000418000-memory.dmp family_xworm behavioral1/memory/2796-15-0x0000000000400000-0x0000000000418000-memory.dmp family_xworm behavioral1/memory/1240-21-0x0000000002260000-0x00000000022A0000-memory.dmp family_xworm behavioral1/memory/1240-22-0x0000000002260000-0x00000000022A0000-memory.dmp family_xworm - StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
resource yara_rule behavioral1/memory/2796-46-0x0000000006D50000-0x0000000006E6E000-memory.dmp family_stormkitty - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\113 = "C:\\Users\\Admin\\Desktop\\lmao\\nice.exe" powershell.exe - Drops desktop.ini file(s) 14 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Searches\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Documents\desktop.ini sus_protected.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2461186416-2307104501-1787948496-1000\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Links\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Videos\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini sus_protected.exe File opened for modification C:\Users\Admin\Music\desktop.ini sus_protected.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp" sus_protected.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2748 set thread context of 2796 2748 sus_protected.exe 30 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A64D4561-E26B-11EE-9826-EEF45767FDFF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416628150" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000002000000030000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000140252eef1608cd125edd610302c42a9123b37991cde6736dba680592bf18cfe000000000e8000000002000020000000915874d4517de8c103156109621893f79ba911ab1f7254bbf5462d016ef0c628200000008f5b24166450373e2570d31b1cb139eca0f912ba43e2b5a8ff928d38fbaaf8b2400000008df3acc8c5161f7752b705a23331a9c741d14d3503ce5fbc6c48953403f86a44aeaf4b73023d9f898b8237d4de3298075a2fef88431d0ba38a31cb5fa474f545 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b0bf927876da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000f053a27bc40cd60193dcbcb572885c2fc6ebce2119b27baa8792732c29f56206000000000e8000000002000020000000abd0d7e379dbb5811797929f8e55360a7300c7a22a741c1ef88d8771878710d09000000062e4df5c9c3137cef7e46ab6139ac0cbe5a522e2cbd99713979864e4eeff85e9e61bdaf784aff765f631a266240f7851e7f17e9937d2216db8d2095ba43a7fdce2fd8188c15e303664c264a1c69ac6174a3596aad78b8345a44268a49572c4fcd80b2213228ae34b6fc01c5774b3287dead0e00c29e5abe939c4f7f61c2af702733d7275d9260f71958a83ce4dc8024b400000002b0543ca3b558c41db245c5a39d6f6ea847f8d6374c31212c49ebbffe44faef8f7f69d1caa6e162c632d6b3f7a3db3b5c22ff9715568f5baf6198348cf442975 iexplore.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ENC_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ENC_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.ENC\ = "ENC_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ENC_auto_file\shell\edit rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ENC_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ENC_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ENC_auto_file\shell\edit\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ENC_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ENC_auto_file\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\ENC_auto_file\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.ENC rundll32.exe - Opens file in notepad (likely ransom note) 2 IoCs
pid Process 2188 NOTEPAD.EXE 2428 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2748 sus_protected.exe 1240 powershell.exe 2504 powershell.exe 2020 powershell.exe 2796 sus_protected.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2180 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2748 sus_protected.exe Token: SeDebugPrivilege 1240 powershell.exe Token: SeDebugPrivilege 2796 sus_protected.exe Token: SeDebugPrivilege 2504 powershell.exe Token: SeDebugPrivilege 2020 powershell.exe Token: SeDebugPrivilege 2796 sus_protected.exe Token: SeDebugPrivilege 2180 taskmgr.exe Token: SeShutdownPrivilege 2796 sus_protected.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2692 iexplore.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2796 sus_protected.exe 2692 iexplore.exe 2692 iexplore.exe 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2748 wrote to memory of 1240 2748 sus_protected.exe 28 PID 2748 wrote to memory of 1240 2748 sus_protected.exe 28 PID 2748 wrote to memory of 1240 2748 sus_protected.exe 28 PID 2748 wrote to memory of 1240 2748 sus_protected.exe 28 PID 2748 wrote to memory of 2796 2748 sus_protected.exe 30 PID 2748 wrote to memory of 2796 2748 sus_protected.exe 30 PID 2748 wrote to memory of 2796 2748 sus_protected.exe 30 PID 2748 wrote to memory of 2796 2748 sus_protected.exe 30 PID 2748 wrote to memory of 2796 2748 sus_protected.exe 30 PID 2748 wrote to memory of 2796 2748 sus_protected.exe 30 PID 2748 wrote to memory of 2796 2748 sus_protected.exe 30 PID 2748 wrote to memory of 2796 2748 sus_protected.exe 30 PID 2748 wrote to memory of 2796 2748 sus_protected.exe 30 PID 2796 wrote to memory of 2504 2796 sus_protected.exe 32 PID 2796 wrote to memory of 2504 2796 sus_protected.exe 32 PID 2796 wrote to memory of 2504 2796 sus_protected.exe 32 PID 2796 wrote to memory of 2504 2796 sus_protected.exe 32 PID 2796 wrote to memory of 2020 2796 sus_protected.exe 34 PID 2796 wrote to memory of 2020 2796 sus_protected.exe 34 PID 2796 wrote to memory of 2020 2796 sus_protected.exe 34 PID 2796 wrote to memory of 2020 2796 sus_protected.exe 34 PID 2796 wrote to memory of 2692 2796 sus_protected.exe 40 PID 2796 wrote to memory of 2692 2796 sus_protected.exe 40 PID 2796 wrote to memory of 2692 2796 sus_protected.exe 40 PID 2796 wrote to memory of 2692 2796 sus_protected.exe 40 PID 2692 wrote to memory of 1756 2692 iexplore.exe 42 PID 2692 wrote to memory of 1756 2692 iexplore.exe 42 PID 2692 wrote to memory of 1756 2692 iexplore.exe 42 PID 2692 wrote to memory of 1756 2692 iexplore.exe 42 PID 2692 wrote to memory of 3036 2692 iexplore.exe 48 PID 2692 wrote to memory of 3036 2692 iexplore.exe 48 PID 2692 wrote to memory of 3036 2692 iexplore.exe 48 PID 2692 wrote to memory of 3036 2692 iexplore.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\sus_protected.exe"C:\Users\Admin\AppData\Local\Temp\sus_protected.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '113';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '113' -Value '"C:\Users\Admin\Desktop\lmao\nice.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
-
C:\Users\Admin\AppData\Local\Temp\sus_protected.exe#cmd2⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sus_protected.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sus_protected.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\How To Decrypt My Files.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1756
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:209930 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\desktop.ini1⤵
- Opens file in notepad (likely ransom note)
PID:2188
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2180
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\lmao\nice.exe.ENC1⤵
- Modifies registry class
PID:1148 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\lmao\nice.exe.ENC2⤵
- Opens file in notepad (likely ransom note)
PID:2428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 67KB
- SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
- MD5 753df6889fd7410a2e9fe333da83a429
- SHA1 3c425f16e8267186061dd48ac1c77c122962456e
- SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
- SSDEEP 1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 6619114cf703f2e05bdbe1970ed7c42b0e9c9f495fc8ee3ea33dd715032ee133
- MD5 d682f336b215d442431a17f2cc2ec7c8
- SHA1 cff18b61e9cc548bb8cff38e38dd17048c1845ba
- SHA512 bad0c51995c8e93bff1a4a04354e6349958640a01f191f788179879148e970b819afc89f48fdfa771a60feb217ff9282ea6a13c40f23efe91e1db08ae0cc5fda
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 2260eadd7436794dbf1178cc5435528fa21b0fce30c133d24c22af103ce72a58
- MD5 67cd3bbb6a8f7ad20025497d9912b82e
- SHA1 a911f021964b77f9b6ba43479ae4a0d51a92cc33
- SHA512 43913a1a373a4cd7efa769663b0a4f24c1068ca4a34d6fcb3097e1c84e9e480d5b7e697aef6e0f5a16cad0cbcaa020500d69f003e40b2882b03cf808e1f496bc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 02b86bed7bc979c0a352641c02a028dd8fbe05930fc33b7ad260ce9abf2e7e2b
- MD5 62ba40606d91f8908ab61ae1720217c5
- SHA1 f075ff897d76d0a28a2625fd4651f305ba745073
- SHA512 c197b9cf5765292a137b01a8da675abe8861490198f6ddfcdff6bf73358d1bfe76ebd623f56316b5213a0fcc7a294af697e996a1fce6e99bdc6ae610b2a8b9d5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 876e5e050350fb791ec405039fa1f729210c39861512c0750f18d811f73a1429
- MD5 f237af405472a127f94b015e027e0a2c
- SHA1 33ce9b4ab4c176316992535013553bd185e3ac96
- SHA512 3ddc1fbf6a881a000aa0df7a67d38994f0ac5a157d9ba8208efac2213dca645da3e3881bd8c8a0eb262e410f704e25faf633fcd2878656a32e1f88afc35f1bc3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 c8790262d6243375d914dc6e0628f6cb02835a8c31029f8b41e977fd610c7f2d
- MD5 e7a44a8c855787e14ed64b527ccb8162
- SHA1 2533ac4686b96de22566d957bf933264936f4ae4
- SHA512 19f96f4bee42d9c7216a382e81b6994ab3550acdcb45d4de5f7c34a7d82644449312f6354644f8d4b67052f9769c89081bf33173825a4a067e0d3b34749c2213
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 04862c70c5bd87e0a66f473d0011d2bb7b715f7898913c84c00d7c2a3601d55f
- MD5 45dfef345fcbcfcd0890704365c75828
- SHA1 78650f054524bb9c23b3677bf0d74c701e137d4f
- SHA512 91119bc06e2f203958fef4fe2d691ab4982157adc21580ee9d8a60a4f8dc10cfee19a1f9c80dd0f25da74351a95af2ba455ccaf75335a4e5b43daf9ec322b38a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 9cd624d3035513edc9387cc6e579bf7bd3e289ee826c06792f851a29960c5901
- MD5 45588cb58fdc4c82b3a0957729172386
- SHA1 0aacb43a7b9fa574d7f9533e250e262f5065cf39
- SHA512 3ba0d0c750d93975d24e41a020621dadc30e7f6af6b9cf4377e6eedbdc1b17eea2cd41bccc19f6a2259100b30395c8c5e6f77b072cfa2dfe374cf20b9182792d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 71867c2d362fcb1dda54f024e83e22e4963a2cddf24dcff63ee1b4500bcf4775
- MD5 30a34811b861a2f59ed145460b9ae456
- SHA1 db9ae129647e12242b5020d863b02d16cc5a518f
- SHA512 88b37faf58db40b95a982852ee7385927d2148a59401f43d2e617b2f2f98992ec8befea06e10e206d2b1ad65f2902d46d7b66f3a54727eaeb79c9ab91f0be276
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab7A13.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar7D35.tmp
- Size 175KB
- SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
- MD5 dd73cead4b93366cf3465c8cd32e2796
- SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
- SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
- SSDEEP 1536:DAuJ+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mr:D9J+qTR0XCy/dmASru2Aijbd0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\~DF4A92E3BA8773BA0B.TMP
- Size 16KB
- SHA256 d073471b14585f91a7769a134eb7d85212cd80f68f59bb97ba100213eba66f09
- MD5 d4b471b4569c708de7fd7031da17ce31
- SHA1 1dc575369f35195c3f292a05947ba420af1e4735
- SHA512 6296ecc204e9ad042ddc2d544de9a9302de2aac9f105ff8d5c5f26840abe07cead0cc07b7a651bed2236181b13bc4983a310a76acaf36da1ec6668ee09e1229a
- SSDEEP 96:zTcacacacacBtcBtcBtcAcAclclcacXct:zq00F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
- Size 7KB
- SHA256 36e419a558cf646a921d1288897defa5d69794ba12c88186cd81b996faa1cfaf
- MD5 2757870325300708fa188500f3874a32
- SHA1 e9e0b68c88593902d0c60640f99fc07d949a46a9
- SHA512 4b6ba76042b0829d8fcbc79eef78f186e258a25543e7426545ea5436e11049b9e2aabe0f2f5b0024bfa9a00f6e0799689ab8f92714870ea6c5edf37e3502a0e2
- SSDEEP 96:EJ2CJM8onqvsqvJCwotJ2CJM8onqvsEHyqvJCwor+3I62QHaZ7b3PXlUVE:U/8Uo7/8AHnory43Z7rPL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\How To Decrypt My Files.html
- Size 639B
- SHA256 5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be
- MD5 d2dbbc3383add4cbd9ba8e1e35872552
- SHA1 020abbc821b2fe22c4b2a89d413d382e48770b6f
- SHA512 bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\desktop.ini
- Size 282B
- SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
- MD5 9e36cc3537ee9ee1e3b10fa4e761045b
- SHA1 7726f55012e1e26cc762c9982e7c6c54ca7bb303
- SHA512 5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\lmao\nice.exe
- Size 105KB
- SHA256 f730bbdf76ecc7e6a3cbc22516b2f66e6ce1bc0ff79f86fb651a9caa9020dba2
- MD5 2bdf24dce352606a0f2242f8270bd824
- SHA1 15a49cf15a7145452d4f5a5f4ac473e80fe13af8
- SHA512 2d4ebaa1259204d7ff8ace8d28173b7df2b81bce81fb9d10d2d911488042499c6549c9895f7ff37c51bbd19b465b719a768706b570d1127d1c1e76a04508c348
- SSDEEP 3072:A89pI4WuF+2BCyRf2aQw9X/z4bXCTrdft6ozGiXobQzB:AUWXafcw9/z4bi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\lmao\nice.exe.ENC
- Size 105KB
- SHA256 925b2520f923b4538b1bfec90178b4196b71b613fe727ceefddf4d4828156cf2
- MD5 21615fec8876c2b77c11b00c203deef9
- SHA1 32e6f23f062ba57f14db7f07992cf0b4d5414783
- SHA512 4d16e19eb0f34eadad4850be8388bde249543cf955d89f0a394a937155773e6f37435f55a687eac15dcd3a014cc035c7930d48231469a92916b82007ea891c49
- SSDEEP 3072:P4nUs3urwJqKis0NxUivDpNnLYDxUYYyCC:P4r3Sc0N+ivrLYDxUYD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ENC
- Size 16B
- SHA256 5ac3b9df305ea99b6ee01eabce27cbae747a52e2d920f30a2915aa3fd52ce505
- MD5 a091304f481f7a3814cda7c7f20a0a30
- SHA1 ce30ee09d662c2bfdd7ec63ba052424a5d5ebd4e
- SHA512 9e3165e3a1abb274d97078766d3d90095d5e351045ccd9e2c18c83a587e91d01a89e0e5e4f02094410e50ed247a730d00986120e2325084ea5179e1bf91582d0
- MD5 SHA1 SHA512