Overview
overview
10Static
static
3000.exe
windows10-1703-x64
000.exe
windows10-2004-x64
Ana.exe
windows10-1703-x64
7Ana.exe
windows10-2004-x64
Bad Rabit.exe
windows10-1703-x64
10Bad Rabit.exe
windows10-2004-x64
10D34TH 2.0 .bat
windows10-1703-x64
8D34TH 2.0 .bat
windows10-2004-x64
8DDOS.bat
windows10-1703-x64
3DDOS.bat
windows10-2004-x64
7Desktop Puzzle.exe
windows10-1703-x64
1Desktop Puzzle.exe
windows10-2004-x64
1Memz.exe
windows10-1703-x64
7Memz.exe
windows10-2004-x64
7NoEscape.exe
windows10-1703-x64
NoEscape.exe
windows10-2004-x64
Phantom Crypter.bat
windows10-1703-x64
8Phantom Crypter.bat
windows10-2004-x64
8WannaCrypt0r.exe
windows10-1703-x64
10WannaCrypt0r.exe
windows10-2004-x64
10infinite locker.bat
windows10-1703-x64
7infinite locker.bat
windows10-2004-x64
7Analysis
-
max time kernel
132s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19-04-2024 10:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
000.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
000.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
Ana.exe
Resource
win10-20240404-en
windows10-1703-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
Ana.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral5
Sample
Bad Rabit.exe
Resource
win10-20240404-en
windows10-1703-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
Bad Rabit.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
D34TH 2.0 .bat
Resource
win10-20240404-en
windows10-1703-x64
17 signatures
150 seconds
Behavioral task
behavioral8
Sample
D34TH 2.0 .bat
Resource
win10v2004-20240412-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral9
Sample
DDOS.bat
Resource
win10-20240404-en
windows10-1703-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
DDOS.bat
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral11
Sample
Desktop Puzzle.exe
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Desktop Puzzle.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
Memz.exe
Resource
win10-20240404-en
windows10-1703-x64
11 signatures
150 seconds
Behavioral task
behavioral14
Sample
Memz.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
NoEscape.exe
Resource
win10-20240404-en
windows10-1703-x64
12 signatures
150 seconds
Behavioral task
behavioral16
Sample
NoEscape.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral17
Sample
Phantom Crypter.bat
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
150 seconds
Behavioral task
behavioral18
Sample
Phantom Crypter.bat
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral19
Sample
WannaCrypt0r.exe
Resource
win10-20240404-en
windows10-1703-x64
18 signatures
150 seconds
Behavioral task
behavioral20
Sample
WannaCrypt0r.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral21
Sample
infinite locker.bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
infinite locker.bat
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
D34TH 2.0 .bat
-
Size
1KB
-
MD5
8ee9033a02ee6fc3b932b694c1bc631c
-
SHA1
6d64ea5dadd6d5098342213a1cf354896b8a3963
-
SHA256
1609a6c649ea074815ce85da21935137e9c79c79a41088a6f7e99a56bd20340d
-
SHA512
f1735b2a7f4b384cf3a82f17e2834912f04d554350d6a03dd1ff6b55efb161e900ae14bd1c337f40d4692d390a726219c85d3a8df6164bac73e2f5c3d38d6a91
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\mausbip.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ndiscap.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\tunnel.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ufxsynopsys.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vmstorfl.sys cmd.exe File opened for modification C:\Windows\System32\drivers\asyncmac.sys cmd.exe File opened for modification C:\Windows\System32\drivers\hidbth.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mslldp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\bthport.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\dumpfve.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usbuhci.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\BTHUSB.SYS.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\netvsc.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\USBHUB3.SYS.mui cmd.exe File opened for modification C:\Windows\System32\drivers\mpsdrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\registry.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\NdisVirtualBus.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\hidinterrupt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\intelpep.sys cmd.exe File opened for modification C:\Windows\System32\drivers\monitor.sys cmd.exe File opened for modification C:\Windows\System32\drivers\raspptp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rootmdm.sys cmd.exe File opened for modification C:\Windows\System32\drivers\wanarp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mountmgr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ndiswan.sys cmd.exe File opened for modification C:\Windows\System32\drivers\urssynopsys.sys cmd.exe File opened for modification C:\Windows\System32\drivers\BthhfHid.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\isapnp.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\appid.sys cmd.exe File opened for modification C:\Windows\System32\drivers\fastfat.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UcmUcsi.sys cmd.exe File opened for modification C:\Windows\System32\drivers\condrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\mshidumdf.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\HdAudio.sys cmd.exe File opened for modification C:\Windows\System32\drivers\amdppm.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\cmimcext.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\scmbus.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\http.sys cmd.exe File opened for modification C:\Windows\System32\drivers\kbdhid.sys cmd.exe File opened for modification C:\Windows\System32\drivers\SDFRd.sys cmd.exe File opened for modification C:\Windows\System32\drivers\tcpip.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\http.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ipnat.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UfxChipidea.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\IndirectKmd.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\mshidkmdf.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\kdnic.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\Microsoft.Bluetooth.Profiles.HidOverGatt.dll cmd.exe File opened for modification C:\Windows\System32\drivers\winhv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\AppvVemgr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\IPMIDRV.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\storqosflt.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\pciide.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vmbkmclr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\1394ohci.sys cmd.exe File opened for modification C:\Windows\System32\drivers\EhStorClass.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\kbdclass.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\refsv1.sys cmd.exe File opened for modification C:\Windows\System32\drivers\tbs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\pdc.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fltMgr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\intelide.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\NfcCx.dll.mui cmd.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\sysWOW64\wintrust.dll cmd.exe File opened for modification C:\Windows\System32\wintrust.dll cmd.exe -
Modifies Windows Firewall 2 TTPs 7 IoCs
pid Process 632 netsh.exe 1672 netsh.exe 4888 netsh.exe 432 netsh.exe 4200 netsh.exe 1324 netsh.exe 3544 netsh.exe -
Modifies file permissions 1 TTPs 5 IoCs
pid Process 1824 takeown.exe 3396 takeown.exe 4952 takeown.exe 4860 takeown.exe 8 takeown.exe -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\wbem\vpnclientpsprovider_Uninstall.mof cmd.exe File opened for modification C:\Windows\sysWOW64\ja-JP\cob-au.rs.mui cmd.exe File opened for modification C:\Windows\System32\en-US\iphlpsvc.dll.mui cmd.exe File opened for modification C:\Windows\System32\ja-jp\lpremove.exe.mui cmd.exe File opened for modification C:\Windows\sysWOW64\Windows.Devices.SmartCards.dll cmd.exe File opened for modification C:\Windows\sysWOW64\WINDOW~1\v1.0\Modules\NETSEC~1\NetFirewallSecurityFilter.cmdletDefinition.cdxml cmd.exe File opened for modification C:\Windows\System32\scavengeui.dll cmd.exe File opened for modification C:\Windows\System32\wkssvc.dll cmd.exe File opened for modification C:\Windows\sysWOW64\en-US\userinit.exe.mui cmd.exe File opened for modification C:\Windows\System32\migwiz\DLMANI~1\ADSI-LDAP-Provider-DL.man cmd.exe File opened for modification C:\Windows\sysWOW64\ja-JP\edputil.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\ja-JP\iasacct.dll.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRNKYC~1.INF\kyw8prop.dpb cmd.exe File opened for modification C:\Windows\System32\gamemode.dll cmd.exe File opened for modification C:\Windows\System32\ja-jp\xpsfilt.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\clusapi.dll cmd.exe File opened for modification C:\Windows\sysWOW64\es-ES\dot3msm.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\pscript.sep cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRNDLC~1.INF\amd64\dedrvsc.dll cmd.exe File opened for modification C:\Windows\System32\fhcpl.dll cmd.exe File opened for modification C:\Windows\System32\it-IT\glu32.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\es-ES\appmgmts.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\secproc.dll cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\MD5BD5~1.INF\mdmnttte.inf cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\fr-FR\NETAX88772.inf_loc cmd.exe File opened for modification C:\Windows\sysWOW64\ja-JP\wecutil.exe.mui cmd.exe File opened for modification C:\Windows\System32\Windows.Networking.Vpn.dll cmd.exe File opened for modification C:\Windows\sysWOW64\ja-JP\ktmutil.exe.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\radarrs.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\wdi.dll.mui cmd.exe File opened for modification C:\Windows\System32\it-IT\newdev.dll.mui cmd.exe File opened for modification C:\Windows\System32\provisioningcsp.dll cmd.exe File opened for modification C:\Windows\System32\vdsldr.exe cmd.exe File opened for modification C:\Windows\sysWOW64\fr-FR\Licenses\_Default\PROFES~1\license.rtf cmd.exe File opened for modification C:\Windows\System32\es-ES\wpnpinst.exe.mui cmd.exe File opened for modification C:\Windows\sysWOW64\WINDOW~1\v1.0\Modules\PSDESI~1\DSCRES~1\MSFT_R~1\es-ES\MSFT_RegistryResource.strings.psd1 cmd.exe File opened for modification C:\Windows\sysWOW64\it-IT\shutdownext.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\WINDOW~1\v1.0\Modules\PSDESI~1\DSCRES~1\MSFT_P~1\en-US\MSFT_PackageResource.schema.mfl cmd.exe File opened for modification C:\Windows\System32\de-DE\WsmSvc.dll.mui cmd.exe File opened for modification C:\Windows\System32\uk-UA\TtlsExt.dll.mui cmd.exe File opened for modification C:\Windows\System32\WINDOW~1\v1.0\Modules\PSDESI~1\DSCRES~1\SERVIC~1\ServiceSet.Schema.psm1 cmd.exe File opened for modification C:\Windows\sysWOW64\fr-FR\iphlpapi.dll.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\wsp_health.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\cmpbk32.dll cmd.exe File opened for modification C:\Windows\sysWOW64\it-IT\oleaccrc.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\rasctrs.dll cmd.exe File opened for modification C:\Windows\System32\DOWNLE~1\api-ms-win-service-management-l1-1-0.dll cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\de-DE\c_fsopenfilebackup.inf_loc cmd.exe File opened for modification C:\Windows\System32\mswsock.dll cmd.exe File opened for modification C:\Windows\sysWOW64\fr-FR\cipher.exe.mui cmd.exe File opened for modification C:\Windows\sysWOW64\it-IT\advpack.dll.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\de-DE\netirda.inf_loc cmd.exe File opened for modification C:\Windows\System32\wbem\en-US\system.mfl cmd.exe File opened for modification C:\Windows\sysWOW64\WINDOW~1\v1.0\Schemas\PSMaml\inlineUi.xsd cmd.exe File opened for modification C:\Windows\System32\en-US\Dism.exe.mui cmd.exe File opened for modification C:\Windows\System32\ja-jp\WalletService.dll.mui cmd.exe File opened for modification C:\Windows\System32\WofUtil.dll cmd.exe File opened for modification C:\Windows\System32\migwiz\REPLAC~1\RasRqs-Repl.man cmd.exe File opened for modification C:\Windows\sysWOW64\es-ES\adtschema.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\es-ES\SystemPropertiesDataExecutionPrevention.exe.mui cmd.exe File opened for modification C:\Windows\sysWOW64\fr-FR\rasmontr.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\ja-JP\dwmcore.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\WofUtil.dll cmd.exe File opened for modification C:\Windows\System32\it-IT\klist.exe.mui cmd.exe -
Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll cmd.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Boot\PCAT\ko-KR\memtest.exe.mui cmd.exe File opened for modification C:\Windows\Fonts\cga40857.fon cmd.exe File opened for modification C:\Windows\Fonts\holomdl2.ttf cmd.exe File opened for modification C:\Windows\Fonts\svgasys.fon cmd.exe File opened for modification C:\Windows\Fonts\taileb.ttf cmd.exe File opened for modification C:\Windows\Fonts\wingding.ttf cmd.exe File opened for modification C:\Windows\Boot\PCAT\ro-RO\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\Fonts\vga737.fon cmd.exe File opened for modification C:\Windows\Fonts\calibrii.ttf cmd.exe File opened for modification C:\Windows\Fonts\pala.ttf cmd.exe File opened for modification C:\Windows\Boot\PCAT\bootmgr cmd.exe File opened for modification C:\Windows\Fonts\8514oemg.fon cmd.exe File opened for modification C:\Windows\Fonts\85s1257.fon cmd.exe File opened for modification C:\Windows\Fonts\vga775.fon cmd.exe File opened for modification C:\Windows\Fonts\vga863.fon cmd.exe File opened for modification C:\Windows\System\Speech\xml.xsd cmd.exe File opened for modification C:\Windows\Boot\PCAT\SR-LAT~1\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\Fonts\Candaraz.ttf cmd.exe File opened for modification C:\Windows\Fonts\couree.fon cmd.exe File opened for modification C:\Windows\Fonts\ega80737.fon cmd.exe File opened for modification C:\Windows\Fonts\smallfr.fon cmd.exe File opened for modification C:\Windows\Fonts\trebucit.ttf cmd.exe File opened for modification C:\Windows\Fonts\vga949.fon cmd.exe File opened for modification C:\Windows\Boot\EFI\nb-NO\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\Boot\EFI\pl-PL\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\Fonts\couri.ttf cmd.exe File opened for modification C:\Windows\Boot\Fonts\msyhn_boot.ttf cmd.exe File opened for modification C:\Windows\Fonts\8514sysg.fon cmd.exe File opened for modification C:\Windows\Fonts\calibriz.ttf cmd.exe File opened for modification C:\Windows\Fonts\cga40869.fon cmd.exe File opened for modification C:\Windows\Fonts\sserife.fon cmd.exe File opened for modification C:\Windows\Boot\EFI\et-EE\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\Boot\EFI\updaterevokesipolicy.p7b cmd.exe File opened for modification C:\Windows\Boot\Fonts\cht_boot.ttf cmd.exe File opened for modification C:\Windows\Fonts\8514fixr.fon cmd.exe File opened for modification C:\Windows\Fonts\serifft.fon cmd.exe File opened for modification C:\Windows\Fonts\ega40857.fon cmd.exe File opened for modification C:\Windows\Fonts\msjh.ttc cmd.exe File opened for modification C:\Windows\Fonts\serifer.fon cmd.exe File opened for modification C:\Windows\Boot\EFI\fr-FR\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\Boot\EFI\it-IT\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\Boot\Fonts\meiryon_boot.ttf cmd.exe File opened for modification C:\Windows\Boot\Fonts\segoe_slboot.ttf cmd.exe File opened for modification C:\Windows\Fonts\ssee1256.fon cmd.exe File opened for modification C:\Windows\Boot\Fonts\segoen_slboot.ttf cmd.exe File opened for modification C:\Windows\Fonts\vga855.fon cmd.exe File opened for modification C:\Windows\Boot\EFI\SR-LAT~1\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\Boot\EFI\sv-SE\memtest.efi.mui cmd.exe File opened for modification C:\Windows\Boot\PCAT\pt-BR\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\Fonts\georgiaz.ttf cmd.exe File opened for modification C:\Windows\Fonts\seriffr.fon cmd.exe File opened for modification C:\Windows\Fonts\smalleg.fon cmd.exe File opened for modification C:\Windows\Boot\EFI\ko-KR\bootmgfw.efi.mui cmd.exe File opened for modification C:\Windows\Fonts\comic.ttf cmd.exe File opened for modification C:\Windows\Fonts\segoeuisl.ttf cmd.exe File opened for modification C:\Windows\Fonts\segoeuiz.ttf cmd.exe File opened for modification C:\Windows\Fonts\seguisb.ttf cmd.exe File opened for modification C:\Windows\Fonts\georgiai.ttf cmd.exe File opened for modification C:\Windows\Boot\EFI\en-US\bootmgfw.efi.mui cmd.exe File opened for modification C:\Windows\Boot\EFI\fi-FI\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\Boot\PCAT\tr-TR\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\Boot\PCAT\uk-UA\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\Fonts\arialbi.ttf cmd.exe File opened for modification C:\Windows\Fonts\consolaz.ttf cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4464 ipconfig.exe 3572 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4884 systeminfo.exe -
Kills process with taskkill 3 IoCs
pid Process 4148 taskkill.exe 1904 taskkill.exe 4616 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings cmd.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4100 NOTEPAD.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1828 WMIC.exe Token: SeSecurityPrivilege 1828 WMIC.exe Token: SeTakeOwnershipPrivilege 1828 WMIC.exe Token: SeLoadDriverPrivilege 1828 WMIC.exe Token: SeSystemProfilePrivilege 1828 WMIC.exe Token: SeSystemtimePrivilege 1828 WMIC.exe Token: SeProfSingleProcessPrivilege 1828 WMIC.exe Token: SeIncBasePriorityPrivilege 1828 WMIC.exe Token: SeCreatePagefilePrivilege 1828 WMIC.exe Token: SeBackupPrivilege 1828 WMIC.exe Token: SeRestorePrivilege 1828 WMIC.exe Token: SeShutdownPrivilege 1828 WMIC.exe Token: SeDebugPrivilege 1828 WMIC.exe Token: SeSystemEnvironmentPrivilege 1828 WMIC.exe Token: SeRemoteShutdownPrivilege 1828 WMIC.exe Token: SeUndockPrivilege 1828 WMIC.exe Token: SeManageVolumePrivilege 1828 WMIC.exe Token: 33 1828 WMIC.exe Token: 34 1828 WMIC.exe Token: 35 1828 WMIC.exe Token: 36 1828 WMIC.exe Token: SeIncreaseQuotaPrivilege 1828 WMIC.exe Token: SeSecurityPrivilege 1828 WMIC.exe Token: SeTakeOwnershipPrivilege 1828 WMIC.exe Token: SeLoadDriverPrivilege 1828 WMIC.exe Token: SeSystemProfilePrivilege 1828 WMIC.exe Token: SeSystemtimePrivilege 1828 WMIC.exe Token: SeProfSingleProcessPrivilege 1828 WMIC.exe Token: SeIncBasePriorityPrivilege 1828 WMIC.exe Token: SeCreatePagefilePrivilege 1828 WMIC.exe Token: SeBackupPrivilege 1828 WMIC.exe Token: SeRestorePrivilege 1828 WMIC.exe Token: SeShutdownPrivilege 1828 WMIC.exe Token: SeDebugPrivilege 1828 WMIC.exe Token: SeSystemEnvironmentPrivilege 1828 WMIC.exe Token: SeRemoteShutdownPrivilege 1828 WMIC.exe Token: SeUndockPrivilege 1828 WMIC.exe Token: SeManageVolumePrivilege 1828 WMIC.exe Token: 33 1828 WMIC.exe Token: 34 1828 WMIC.exe Token: 35 1828 WMIC.exe Token: 36 1828 WMIC.exe Token: SeIncreaseQuotaPrivilege 4972 WMIC.exe Token: SeSecurityPrivilege 4972 WMIC.exe Token: SeTakeOwnershipPrivilege 4972 WMIC.exe Token: SeLoadDriverPrivilege 4972 WMIC.exe Token: SeSystemProfilePrivilege 4972 WMIC.exe Token: SeSystemtimePrivilege 4972 WMIC.exe Token: SeProfSingleProcessPrivilege 4972 WMIC.exe Token: SeIncBasePriorityPrivilege 4972 WMIC.exe Token: SeCreatePagefilePrivilege 4972 WMIC.exe Token: SeBackupPrivilege 4972 WMIC.exe Token: SeRestorePrivilege 4972 WMIC.exe Token: SeShutdownPrivilege 4972 WMIC.exe Token: SeDebugPrivilege 4972 WMIC.exe Token: SeSystemEnvironmentPrivilege 4972 WMIC.exe Token: SeRemoteShutdownPrivilege 4972 WMIC.exe Token: SeUndockPrivilege 4972 WMIC.exe Token: SeManageVolumePrivilege 4972 WMIC.exe Token: 33 4972 WMIC.exe Token: 34 4972 WMIC.exe Token: 35 4972 WMIC.exe Token: 36 4972 WMIC.exe Token: SeIncreaseQuotaPrivilege 4972 WMIC.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 4400 wrote to memory of 3968 4400 cmd.exe 76 PID 4400 wrote to memory of 3968 4400 cmd.exe 76 PID 4400 wrote to memory of 1080 4400 cmd.exe 77 PID 4400 wrote to memory of 1080 4400 cmd.exe 77 PID 4400 wrote to memory of 4464 4400 cmd.exe 78 PID 4400 wrote to memory of 4464 4400 cmd.exe 78 PID 4400 wrote to memory of 3572 4400 cmd.exe 79 PID 4400 wrote to memory of 3572 4400 cmd.exe 79 PID 4400 wrote to memory of 788 4400 cmd.exe 80 PID 4400 wrote to memory of 788 4400 cmd.exe 80 PID 4400 wrote to memory of 1828 4400 cmd.exe 81 PID 4400 wrote to memory of 1828 4400 cmd.exe 81 PID 4400 wrote to memory of 4972 4400 cmd.exe 83 PID 4400 wrote to memory of 4972 4400 cmd.exe 83 PID 4400 wrote to memory of 4884 4400 cmd.exe 84 PID 4400 wrote to memory of 4884 4400 cmd.exe 84 PID 4400 wrote to memory of 632 4400 cmd.exe 86 PID 4400 wrote to memory of 632 4400 cmd.exe 86 PID 4400 wrote to memory of 1672 4400 cmd.exe 87 PID 4400 wrote to memory of 1672 4400 cmd.exe 87 PID 4400 wrote to memory of 4888 4400 cmd.exe 88 PID 4400 wrote to memory of 4888 4400 cmd.exe 88 PID 4400 wrote to memory of 432 4400 cmd.exe 89 PID 4400 wrote to memory of 432 4400 cmd.exe 89 PID 4400 wrote to memory of 4200 4400 cmd.exe 90 PID 4400 wrote to memory of 4200 4400 cmd.exe 90 PID 4400 wrote to memory of 1324 4400 cmd.exe 91 PID 4400 wrote to memory of 1324 4400 cmd.exe 91 PID 4400 wrote to memory of 3544 4400 cmd.exe 92 PID 4400 wrote to memory of 3544 4400 cmd.exe 92 PID 4400 wrote to memory of 4100 4400 cmd.exe 93 PID 4400 wrote to memory of 4100 4400 cmd.exe 93 PID 4400 wrote to memory of 1824 4400 cmd.exe 94 PID 4400 wrote to memory of 1824 4400 cmd.exe 94 PID 4400 wrote to memory of 3396 4400 cmd.exe 95 PID 4400 wrote to memory of 3396 4400 cmd.exe 95 PID 4400 wrote to memory of 4952 4400 cmd.exe 96 PID 4400 wrote to memory of 4952 4400 cmd.exe 96 PID 4400 wrote to memory of 4860 4400 cmd.exe 97 PID 4400 wrote to memory of 4860 4400 cmd.exe 97 PID 4400 wrote to memory of 8 4400 cmd.exe 98 PID 4400 wrote to memory of 8 4400 cmd.exe 98 PID 4400 wrote to memory of 2108 4400 cmd.exe 99 PID 4400 wrote to memory of 2108 4400 cmd.exe 99 PID 2108 wrote to memory of 1144 2108 net.exe 100 PID 2108 wrote to memory of 1144 2108 net.exe 100 PID 4400 wrote to memory of 2880 4400 cmd.exe 101 PID 4400 wrote to memory of 2880 4400 cmd.exe 101 PID 2880 wrote to memory of 1252 2880 net.exe 102 PID 2880 wrote to memory of 1252 2880 net.exe 102 PID 4400 wrote to memory of 4148 4400 cmd.exe 103 PID 4400 wrote to memory of 4148 4400 cmd.exe 103 PID 4400 wrote to memory of 1904 4400 cmd.exe 104 PID 4400 wrote to memory of 1904 4400 cmd.exe 104 PID 4400 wrote to memory of 4616 4400 cmd.exe 105 PID 4400 wrote to memory of 4616 4400 cmd.exe 105
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\D34TH 2.0 .bat"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com2⤵PID:3968
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles2⤵PID:1080
-
-
C:\Windows\system32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:4464
-
-
C:\Windows\system32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:3572
-
-
C:\Windows\system32\find.exefind /i "IPv4"2⤵PID:788
-
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get size2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
PID:4884
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode disable2⤵
- Modifies Windows Firewall
PID:632
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=DISABLE2⤵
- Modifies Windows Firewall
PID:1672
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off2⤵
- Modifies Windows Firewall
PID:4888
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set domainprofile state off2⤵
- Modifies Windows Firewall
PID:432
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set privateprofile state off2⤵
- Modifies Windows Firewall
PID:4200
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set publicprofile state off2⤵
- Modifies Windows Firewall
PID:1324
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
PID:3544
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\F.log2⤵
- Opens file in notepad (likely ransom note)
PID:4100
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System322⤵
- Modifies file permissions
PID:1824
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System2⤵
- Modifies file permissions
PID:3396
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\Boot2⤵
- Modifies file permissions
PID:4952
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\Fonts2⤵
- Modifies file permissions
PID:4860
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\sysWOW642⤵
- Modifies file permissions
PID:8
-
-
C:\Windows\system32\net.exenet stop "Windows Defender Service"2⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Windows Defender Service"3⤵PID:1144
-
-
-
C:\Windows\system32\net.exenet stop "Windows Firewall"2⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Windows Firewall"3⤵PID:1252
-
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "chrome.exe" /T2⤵
- Kills process with taskkill
PID:4148
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "firefox.exe" /T2⤵
- Kills process with taskkill
PID:1904
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "explorer.exe" /T2⤵
- Kills process with taskkill
PID:4616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b0ba0bc30fcf57cc1ae0578d6891aa18
SHA16ae9543b8087508ec7022878fda882c4b23106c1
SHA25601ddbbcb1fd96f219a5275f8cffb7e773c4de8100558d729be96d40d9d264623
SHA512a25e2afd230d75cb4dd3079489ca530ec274641c6156aa1ccf36c9cd67b29b34b1eabd8138293ac8f38b0a332ea496694f4f445d4a10436908ee95020376b0d4