Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-03-2024 21:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b.exe
Resource
win7-20240220-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
b.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
b.exe
-
Size
281KB
-
MD5
2809e15a3a54484e042fe65fffd17409
-
SHA1
4a8f0331abaf8f629b3c8220f0d55339cfa30223
-
SHA256
518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
-
SHA512
698e16fd67861377e2ccaace4d0e1a619a8b7c68e8aefc4090e9d1cbbcdfb8d8aede76f9e63f81479f5a035e8008699a4d7175da6248e6e49eb7c81b3dba30c3
-
SSDEEP
3072:D5IwIMZKkczttW5ivhjqKO1I9Goh6F4mAqeormMkpCWlunhNGA5yjszVIEe9:NIMsztZZ+KQqGo5QfmLpCoun6W
Score
10/10
Malware Config
Extracted
Path
C:\info.hta
Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>
<html>
<head>
<meta charset='windows-1251'>
<title>cartilage</title>
<HTA:APPLICATION
ICON='msiexec.exe'
SINGLEINSTANCE='yes'
SysMenu="no">
<script language='JScript'>
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type='text/css'>
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #C6B5C4;
}
img {
display:inline-block;
}
.bold {
font-weight: bold;
}
.mark {
background: #B5CC8E;
padding: 2px 5px;
}
.header {
text-align: center;
font-size: 30px;
line-height: 50px;
font-weight: bold;
margin-bottom:20px;
}
.info {
background: #e6ecf2;
border-left: 10px solid #B58CB2;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FFA07A;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
.footer {
position:fixed;
bottom:0;
right:0;
text-align: right;
}
</style>
</head>
<body>
<div class='header'>
<img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='>
<div>All your files have been encrypted!</div>
</div>
<div class='bold'>All your files have been encrypted due to a security problem with your PC.</div>
<div class='bold'>If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div>
<div class='bold'>Or write us to the Tox: <span class='mark'>78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074</span></div>
<div class='bold'>Write this ID in the title of your message <span class='mark'>9F2999FF-3483</span></div>
<div>
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
</div>
<div class='note info'>
<div class='title'>Free decryption as guarantee</div>
<ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul>
</div>
<div class='note info'>
<div class='title'>How to obtain Bitcoins</div>
<ul>
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
<br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>
<br> Also you can find other places to buy Bitcoins and beginners guide here:
<br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a>
</ul>
</div>
<div class='note alert'>
<div class='title'>Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>
Emails
class='mark'>[email protected]</span></div>
URLs
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 2532 bcdedit.exe 2368 bcdedit.exe 272 bcdedit.exe 1196 bcdedit.exe -
Renames multiple (310) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1692 wbadmin.exe 1832 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2452 netsh.exe 1304 netsh.exe -
Drops startup file 3 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\b.exe b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[9F2999FF-3483].[[email protected]].8base b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b = "C:\\Users\\Admin\\AppData\\Local\\b.exe" b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\b = "C:\\Users\\Admin\\AppData\\Local\\b.exe" b.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini b.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini b.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini b.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VY10BSW\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini b.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\M221U1AY\desktop.ini b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini b.exe File opened for modification C:\Users\Public\Documents\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NNULH633\desktop.ini b.exe File opened for modification C:\Users\Public\Libraries\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini b.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CM2WAJS5\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini b.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini b.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini b.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\KEQD8ZAD\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini b.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini b.exe File opened for modification C:\Users\Admin\Documents\desktop.ini b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini b.exe File opened for modification C:\Program Files\desktop.ini b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI b.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini b.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini b.exe File opened for modification C:\Users\Public\desktop.ini b.exe File opened for modification C:\Users\Public\Videos\desktop.ini b.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HL1JTUOY\desktop.ini b.exe File opened for modification C:\Users\Admin\Music\desktop.ini b.exe File opened for modification C:\Users\Public\Downloads\desktop.ini b.exe File opened for modification C:\Users\Public\Pictures\desktop.ini b.exe File opened for modification C:\Users\Public\Music\desktop.ini b.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini b.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini b.exe File opened for modification C:\Program Files (x86)\desktop.ini b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\settings.css b.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\TAB_OFF.GIF.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Country.gif.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0185604.WMF b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GIFT98.POC.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay b.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll b.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac b.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105282.WMF.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll b.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak b.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PEOPLEDATAHANDLER.DLL.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui b.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00468_.WMF.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01268_.GIF.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14752_.GIF.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html b.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml b.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239079.WMF.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00809_.WMF.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONTAB32.DLL b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui b.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR8B.GIF b.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana.css b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REPORTS.ICO b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Projects.accdt b.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\adodb.dll.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar b.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_04.MID b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll b.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02093_.WMF.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21399_.GIF b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\NOTE.CFG.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.PH.XML.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png b.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar b.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Verve.thmx.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_F_COL.HXK.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.NZ.XML b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PULQOT98.POC.id[9F2999FF-3483].[[email protected]].8base b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\AXIS.ELM b.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE01191_.WMF.id[9F2999FF-3483].[[email protected]].8base b.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Couture.xml.id[9F2999FF-3483].[[email protected]].8base b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2064 vssadmin.exe 1940 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe 1732 b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1732 b.exe Token: SeBackupPrivilege 2488 vssvc.exe Token: SeRestorePrivilege 2488 vssvc.exe Token: SeAuditPrivilege 2488 vssvc.exe Token: SeIncreaseQuotaPrivilege 1760 WMIC.exe Token: SeSecurityPrivilege 1760 WMIC.exe Token: SeTakeOwnershipPrivilege 1760 WMIC.exe Token: SeLoadDriverPrivilege 1760 WMIC.exe Token: SeSystemProfilePrivilege 1760 WMIC.exe Token: SeSystemtimePrivilege 1760 WMIC.exe Token: SeProfSingleProcessPrivilege 1760 WMIC.exe Token: SeIncBasePriorityPrivilege 1760 WMIC.exe Token: SeCreatePagefilePrivilege 1760 WMIC.exe Token: SeBackupPrivilege 1760 WMIC.exe Token: SeRestorePrivilege 1760 WMIC.exe Token: SeShutdownPrivilege 1760 WMIC.exe Token: SeDebugPrivilege 1760 WMIC.exe Token: SeSystemEnvironmentPrivilege 1760 WMIC.exe Token: SeRemoteShutdownPrivilege 1760 WMIC.exe Token: SeUndockPrivilege 1760 WMIC.exe Token: SeManageVolumePrivilege 1760 WMIC.exe Token: 33 1760 WMIC.exe Token: 34 1760 WMIC.exe Token: 35 1760 WMIC.exe Token: SeIncreaseQuotaPrivilege 1760 WMIC.exe Token: SeSecurityPrivilege 1760 WMIC.exe Token: SeTakeOwnershipPrivilege 1760 WMIC.exe Token: SeLoadDriverPrivilege 1760 WMIC.exe Token: SeSystemProfilePrivilege 1760 WMIC.exe Token: SeSystemtimePrivilege 1760 WMIC.exe Token: SeProfSingleProcessPrivilege 1760 WMIC.exe Token: SeIncBasePriorityPrivilege 1760 WMIC.exe Token: SeCreatePagefilePrivilege 1760 WMIC.exe Token: SeBackupPrivilege 1760 WMIC.exe Token: SeRestorePrivilege 1760 WMIC.exe Token: SeShutdownPrivilege 1760 WMIC.exe Token: SeDebugPrivilege 1760 WMIC.exe Token: SeSystemEnvironmentPrivilege 1760 WMIC.exe Token: SeRemoteShutdownPrivilege 1760 WMIC.exe Token: SeUndockPrivilege 1760 WMIC.exe Token: SeManageVolumePrivilege 1760 WMIC.exe Token: 33 1760 WMIC.exe Token: 34 1760 WMIC.exe Token: 35 1760 WMIC.exe Token: SeBackupPrivilege 292 wbengine.exe Token: SeRestorePrivilege 292 wbengine.exe Token: SeSecurityPrivilege 292 wbengine.exe Token: SeIncreaseQuotaPrivilege 2644 WMIC.exe Token: SeSecurityPrivilege 2644 WMIC.exe Token: SeTakeOwnershipPrivilege 2644 WMIC.exe Token: SeLoadDriverPrivilege 2644 WMIC.exe Token: SeSystemProfilePrivilege 2644 WMIC.exe Token: SeSystemtimePrivilege 2644 WMIC.exe Token: SeProfSingleProcessPrivilege 2644 WMIC.exe Token: SeIncBasePriorityPrivilege 2644 WMIC.exe Token: SeCreatePagefilePrivilege 2644 WMIC.exe Token: SeBackupPrivilege 2644 WMIC.exe Token: SeRestorePrivilege 2644 WMIC.exe Token: SeShutdownPrivilege 2644 WMIC.exe Token: SeDebugPrivilege 2644 WMIC.exe Token: SeSystemEnvironmentPrivilege 2644 WMIC.exe Token: SeRemoteShutdownPrivilege 2644 WMIC.exe Token: SeUndockPrivilege 2644 WMIC.exe Token: SeManageVolumePrivilege 2644 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2112 1732 b.exe 30 PID 1732 wrote to memory of 2112 1732 b.exe 30 PID 1732 wrote to memory of 2112 1732 b.exe 30 PID 1732 wrote to memory of 2112 1732 b.exe 30 PID 1732 wrote to memory of 2540 1732 b.exe 29 PID 1732 wrote to memory of 2540 1732 b.exe 29 PID 1732 wrote to memory of 2540 1732 b.exe 29 PID 1732 wrote to memory of 2540 1732 b.exe 29 PID 2112 wrote to memory of 2452 2112 cmd.exe 33 PID 2112 wrote to memory of 2452 2112 cmd.exe 33 PID 2112 wrote to memory of 2452 2112 cmd.exe 33 PID 2540 wrote to memory of 2064 2540 cmd.exe 34 PID 2540 wrote to memory of 2064 2540 cmd.exe 34 PID 2540 wrote to memory of 2064 2540 cmd.exe 34 PID 2112 wrote to memory of 1304 2112 cmd.exe 36 PID 2112 wrote to memory of 1304 2112 cmd.exe 36 PID 2112 wrote to memory of 1304 2112 cmd.exe 36 PID 2540 wrote to memory of 1760 2540 cmd.exe 38 PID 2540 wrote to memory of 1760 2540 cmd.exe 38 PID 2540 wrote to memory of 1760 2540 cmd.exe 38 PID 2540 wrote to memory of 2532 2540 cmd.exe 40 PID 2540 wrote to memory of 2532 2540 cmd.exe 40 PID 2540 wrote to memory of 2532 2540 cmd.exe 40 PID 2540 wrote to memory of 2368 2540 cmd.exe 41 PID 2540 wrote to memory of 2368 2540 cmd.exe 41 PID 2540 wrote to memory of 2368 2540 cmd.exe 41 PID 2540 wrote to memory of 1692 2540 cmd.exe 42 PID 2540 wrote to memory of 1692 2540 cmd.exe 42 PID 2540 wrote to memory of 1692 2540 cmd.exe 42 PID 1732 wrote to memory of 2924 1732 b.exe 47 PID 1732 wrote to memory of 2924 1732 b.exe 47 PID 1732 wrote to memory of 2924 1732 b.exe 47 PID 1732 wrote to memory of 2924 1732 b.exe 47 PID 1732 wrote to memory of 2308 1732 b.exe 49 PID 1732 wrote to memory of 2308 1732 b.exe 49 PID 1732 wrote to memory of 2308 1732 b.exe 49 PID 1732 wrote to memory of 2308 1732 b.exe 49 PID 1732 wrote to memory of 1052 1732 b.exe 50 PID 1732 wrote to memory of 1052 1732 b.exe 50 PID 1732 wrote to memory of 1052 1732 b.exe 50 PID 1732 wrote to memory of 1052 1732 b.exe 50 PID 1732 wrote to memory of 1668 1732 b.exe 51 PID 1732 wrote to memory of 1668 1732 b.exe 51 PID 1732 wrote to memory of 1668 1732 b.exe 51 PID 1732 wrote to memory of 1668 1732 b.exe 51 PID 1732 wrote to memory of 1728 1732 b.exe 52 PID 1732 wrote to memory of 1728 1732 b.exe 52 PID 1732 wrote to memory of 1728 1732 b.exe 52 PID 1732 wrote to memory of 1728 1732 b.exe 52 PID 1728 wrote to memory of 1940 1728 cmd.exe 54 PID 1728 wrote to memory of 1940 1728 cmd.exe 54 PID 1728 wrote to memory of 1940 1728 cmd.exe 54 PID 1728 wrote to memory of 2644 1728 cmd.exe 55 PID 1728 wrote to memory of 2644 1728 cmd.exe 55 PID 1728 wrote to memory of 2644 1728 cmd.exe 55 PID 1728 wrote to memory of 272 1728 cmd.exe 56 PID 1728 wrote to memory of 272 1728 cmd.exe 56 PID 1728 wrote to memory of 272 1728 cmd.exe 56 PID 1728 wrote to memory of 1196 1728 cmd.exe 57 PID 1728 wrote to memory of 1196 1728 cmd.exe 57 PID 1728 wrote to memory of 1196 1728 cmd.exe 57 PID 1728 wrote to memory of 1832 1728 cmd.exe 58 PID 1728 wrote to memory of 1832 1728 cmd.exe 58 PID 1728 wrote to memory of 1832 1728 cmd.exe 58 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b.exe"C:\Users\Admin\AppData\Local\Temp\b.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\b.exe"C:\Users\Admin\AppData\Local\Temp\b.exe"2⤵PID:1052
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2064
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2532
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2368
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1692
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
PID:2452
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:1304
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2924
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2308
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:1052
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:1668
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1940
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:272
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1196
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1832
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:292
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2584
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2404
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.id[9F2999FF-3483].[[email protected]].8base
Filesize11.0MB
MD5ab24058bfe476cd7df273e2f3c7045f4
SHA17d54a3b389d8c7d66c8935c05fa4d564c29904f8
SHA2560ad96d7174de8f0fde77e11ed2a570144f5575e69e980a2cd67305b739afaf98
SHA512a40da5d975332a2a1bfc4cfca1bd8a7de2ba36f65b1ef5b9997b11114ceca842e5787bbc077c4db2af64fef6079cedec8302dd2705fab26df708ad144a31a6a8
-
Filesize
5KB
MD5155cc4c6f62cc5f521badf6895af08a7
SHA1a8c510202ad40922dc1b59b009316dff5756e252
SHA25691bf4e7d5192a4b098896f021d3bb8b692e83339bea65b7119d6436dd093ecbd
SHA512c829bb332d69b37d103716932d55ebb437b276f1c51c5196c18c95c7e5bd9ec82d7b1735a815110f38b04093f815c52acc6179dccbadaab39239d3f2c705e1a2