Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18-03-2024 13:46
Static task
static1
Behavioral task
behavioral1
Sample
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe
Resource
win10v2004-20240226-en
General
-
Target
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe
-
Size
268KB
-
MD5
d3fdd9807a32f5c27c14879336762119
-
SHA1
73132972d130adb7106e6b9319b21856434eff65
-
SHA256
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527
-
SHA512
87468ab4136f449cab6e3689b4460de6dc59421ad20ce8208e251b3e4ef63f4ac281288ec51a35469e2473328de8b45b487cd72f40ba72d304a44b89a99a7a80
-
SSDEEP
6144:IXJ6Mv/PMB5lZOx4ccuiA8HYVVo7bBPxwdNaLvo:KJf/kBrZOxfwAsYVVoZZwdNaE
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\_R_E_A_D___T_H_I_S___8OUE3_.txt
cerber
http://xpcx6erilkjced3j.onion/A11A-8466-1633-005C-9E91
http://xpcx6erilkjced3j.1t2jhk.top/A11A-8466-1633-005C-9E91
http://xpcx6erilkjced3j.1e6ly3.top/A11A-8466-1633-005C-9E91
http://xpcx6erilkjced3j.1ewuh5.top/A11A-8466-1633-005C-9E91
http://xpcx6erilkjced3j.15ezkm.top/A11A-8466-1633-005C-9E91
http://xpcx6erilkjced3j.16umxg.top/A11A-8466-1633-005C-9E91
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1115) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 1656 netsh.exe 540 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Drops startup file 1 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process File opened (read-only) \??\k: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\l: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\p: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\u: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\x: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\i: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\j: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\n: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\y: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\a: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\b: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\o: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\q: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\z: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\s: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\t: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\v: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\e: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\g: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\h: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\m: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\r: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\w: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Drops file in System32 directory 38 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpB15E.bmp" fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Drops file in Program Files directory 20 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process File opened for modification \??\c:\program files (x86)\bitcoin fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\ fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files\ fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Drops file in Windows directory 64 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\ fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3244 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2476 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe Token: SeCreatePagefilePrivilege 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe Token: SeDebugPrivilege 3244 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.execmd.exedescription pid process target process PID 2536 wrote to memory of 1656 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2536 wrote to memory of 1656 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2536 wrote to memory of 1656 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2536 wrote to memory of 540 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2536 wrote to memory of 540 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2536 wrote to memory of 540 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2536 wrote to memory of 1344 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe mshta.exe PID 2536 wrote to memory of 1344 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe mshta.exe PID 2536 wrote to memory of 1344 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe mshta.exe PID 2536 wrote to memory of 2476 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe NOTEPAD.EXE PID 2536 wrote to memory of 2476 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe NOTEPAD.EXE PID 2536 wrote to memory of 2476 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe NOTEPAD.EXE PID 2536 wrote to memory of 3784 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe cmd.exe PID 2536 wrote to memory of 3784 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe cmd.exe PID 2536 wrote to memory of 3784 2536 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe cmd.exe PID 3784 wrote to memory of 3244 3784 cmd.exe taskkill.exe PID 3784 wrote to memory of 3244 3784 cmd.exe taskkill.exe PID 3784 wrote to memory of 3244 3784 cmd.exe taskkill.exe PID 3784 wrote to memory of 2452 3784 cmd.exe PING.EXE PID 3784 wrote to memory of 2452 3784 cmd.exe PING.EXE PID 3784 wrote to memory of 2452 3784 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe"C:\Users\Admin\AppData\Local\Temp\fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___V7X0_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___1WHD3H_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe" > NUL && exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\_R_E_A_D___T_H_I_S___8OUE3_.txtFilesize
1KB
MD58676eaa746330d39b797eceae8f1fe8a
SHA13c73fb53818f54e7fa26470974d10793b4b11f24
SHA256484b4bb16924f94074466a7198ec0a2f8579fcd3c8beadfe9fedc2116ed1f8ee
SHA512381b48f29ee6d5ce30389fcccdf0a5c94b339555b7ba82bf4ea0a05973bbf5c4aa24f2a5905c9ac2f7f303049e010d03174a5c8bbc46f4f1d7c53b51a026719c
-
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\_R_E_A_D___T_H_I_S___SMXR83_.htaFilesize
75KB
MD554a8a3201ff106c3d31e61a640b46580
SHA1d1943a13116cb6398d1643599523881b76e8b3f4
SHA25632cf978b08b45d623727cb9003da01aff5243e07e861798060a1c571e20d48d2
SHA51271e3b40eaa77e0e66e31505a0edb03e83ca74bedc9baa0ca13907f80a288a96a5daea803fbe578aa075b7429f65556197c630fac7c50b61ab70c0f142baf86ad
-
memory/2536-0-0x0000000000600000-0x000000000062E000-memory.dmpFilesize
184KB
-
memory/2536-1-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2536-2-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2536-6-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2536-17-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2536-382-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2536-374-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2536-398-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB