Overview
overview
10Static
static
3000.exe
windows7-x64
000.exe
windows10-2004-x64
Ana.exe
windows7-x64
8Ana.exe
windows10-2004-x64
Bad Rabit.exe
windows7-x64
10Bad Rabit.exe
windows10-2004-x64
10D34TH 2.0 .bat
windows7-x64
8D34TH 2.0 .bat
windows10-2004-x64
8DDOS.bat
windows7-x64
3DDOS.bat
windows10-2004-x64
7Desktop Puzzle.exe
windows7-x64
1Desktop Puzzle.exe
windows10-2004-x64
1Memz.exe
windows7-x64
6Memz.exe
windows10-2004-x64
7NoEscape.exe
windows7-x64
1NoEscape.exe
windows10-2004-x64
Phantom Crypter.bat
windows7-x64
8Phantom Crypter.bat
windows10-2004-x64
8WannaCrypt0r.exe
windows7-x64
10WannaCrypt0r.exe
windows10-2004-x64
10infinite locker.bat
windows7-x64
7infinite locker.bat
windows10-2004-x64
7Resubmissions
19-04-2024 11:45
240419-nw88dsag38 1019-04-2024 11:43
240419-nv23pabf2x 319-04-2024 10:25
240419-mf6a5agh7t 10Analysis
-
max time kernel
121s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 10:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
000.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
000.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
Ana.exe
Resource
win7-20240215-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral4
Sample
Ana.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral5
Sample
Bad Rabit.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
Bad Rabit.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
D34TH 2.0 .bat
Resource
win7-20240319-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral8
Sample
D34TH 2.0 .bat
Resource
win10v2004-20240412-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral9
Sample
DDOS.bat
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
DDOS.bat
Resource
win10v2004-20240412-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral11
Sample
Desktop Puzzle.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Desktop Puzzle.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
Memz.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
Memz.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral15
Sample
NoEscape.exe
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
NoEscape.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral17
Sample
Phantom Crypter.bat
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral18
Sample
Phantom Crypter.bat
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral19
Sample
WannaCrypt0r.exe
Resource
win7-20240221-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral20
Sample
WannaCrypt0r.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral21
Sample
infinite locker.bat
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
infinite locker.bat
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
D34TH 2.0 .bat
-
Size
1KB
-
MD5
8ee9033a02ee6fc3b932b694c1bc631c
-
SHA1
6d64ea5dadd6d5098342213a1cf354896b8a3963
-
SHA256
1609a6c649ea074815ce85da21935137e9c79c79a41088a6f7e99a56bd20340d
-
SHA512
f1735b2a7f4b384cf3a82f17e2834912f04d554350d6a03dd1ff6b55efb161e900ae14bd1c337f40d4692d390a726219c85d3a8df6164bac73e2f5c3d38d6a91
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\en-US\UAGP35.SYS.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\isapnp.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\mpio.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\atikmdag.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\wacompen.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\scfilter.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\hidbth.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\tsusbhub.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\i8042prt.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\tsusbhub.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\vwifibus.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\rdyboost.sys cmd.exe File opened for modification C:\Windows\System32\drivers\dfsc.sys cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\modem.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\disk.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ksecpkg.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\rndismpx.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\amdide.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\BrSerIb.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\intelppm.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\nwifi.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\de-DE\WpdMtpDr.dll.mui cmd.exe File opened for modification C:\Windows\System32\drivers\Diskdump.sys cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\rdbss.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\cdrom.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\mouclass.sys cmd.exe File opened for modification C:\Windows\System32\drivers\msrpc.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\mouhid.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\portcls.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ksthunk.sys cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\atikmdag.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\i8042prt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mrxdav.sys cmd.exe File opened for modification C:\Windows\System32\drivers\portcls.sys cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\rndismpx.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\vhdmp.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\amdppm.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\es-ES\WpdMtpDr.dll.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\BTHUSB.SYS.mui cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\pci.sys.mui cmd.exe File opened for modification C:\Windows\sysWOW64\drivers\es-ES\tcpip.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\BrParwdm.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\portcls.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\ataport.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\IPMIDrv.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\kbdclass.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\AGP440.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\Dot4usb.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\usbport.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\wanarp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\volsnap.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\tpm.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\mouclass.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\it-IT\WUDFUsbccidDriver.dll.mui cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\tunnel.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\pci.sys cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\NV_AGP.SYS.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\hidbth.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\mouhid.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\ndisuio.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\hidparse.sys cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\mpio.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\Wdf01000.sys cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\srv.sys.mui cmd.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\sysWOW64\wintrust.dll cmd.exe File opened for modification C:\Windows\System32\wintrust.dll cmd.exe -
Modifies Windows Firewall 2 TTPs 7 IoCs
pid Process 2380 netsh.exe 524 netsh.exe 1768 netsh.exe 916 netsh.exe 1956 netsh.exe 2448 netsh.exe 2892 netsh.exe -
Modifies file permissions 1 TTPs 5 IoCs
pid Process 848 takeown.exe 1724 takeown.exe 2076 takeown.exe 1888 takeown.exe 2336 takeown.exe -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\ja-JP\irftp.exe.mui cmd.exe File opened for modification C:\Windows\sysWOW64\WINDOW~1\v1.0\de-DE\about_Windows_PowerShell_2.0.help.txt cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\ja-JP\prnep003.inf_loc cmd.exe File opened for modification C:\Windows\System32\es-ES\AltTab.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\de-DE\eventvwr.msc cmd.exe File opened for modification C:\Windows\sysWOW64\en-US\dinput.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\es-ES\PortableDeviceApi.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\fr-FR\Robocopy.exe.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\perfproc.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\WerFault.exe.mui cmd.exe File opened for modification C:\Windows\System32\themecpl.dll cmd.exe File opened for modification C:\Windows\sysWOW64\WINDOW~1\v1.0\Modules\BITSTR~1\ja-JP\about_BITS_Cmdlets.help.txt cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRCFAD~1.INF\Amd64\CNBJ2970.TBL cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\fr-FR\hidserv.inf_loc cmd.exe File opened for modification C:\Windows\sysWOW64\fr-FR\cttunesvr.exe.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\MSTAPE~1.INF\mstape.sys cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\CXRAPT~3.INF\cxraptor_merlinc.rom cmd.exe File opened for modification C:\Windows\System32\ja-JP\AdapterTroubleshooter.exe.mui cmd.exe File opened for modification C:\Windows\System32\WINDOW~1\v1.0\en-US\about_type_operators.help.txt cmd.exe File opened for modification C:\Windows\sysWOW64\fr-FR\notepad.exe.mui cmd.exe File opened for modification C:\Windows\sysWOW64\fr-FR\tcpipcfg.dll.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\ADPAHC~1.INF\adpahci.sys cmd.exe File opened for modification C:\Windows\System32\ja-JP\Netplwiz.exe.mui cmd.exe File opened for modification C:\Windows\System32\ActionCenter.dll cmd.exe File opened for modification C:\Windows\System32\fr-FR\Storprop.dll.mui cmd.exe File opened for modification C:\Windows\System32\ja-JP\tsmf.dll.mui cmd.exe File opened for modification C:\Windows\System32\zh-CN\FntCache.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\en-US\tvratings.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\fr-FR\FirewallAPI.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\wbem\fr-FR\WinMgmt.exe.mui cmd.exe File opened for modification C:\Windows\System32\en-US\appidsvc.dll.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\ja-JP\prnky002.inf_loc cmd.exe File opened for modification C:\Windows\sysWOW64\fr-FR\recover.exe.mui cmd.exe File opened for modification C:\Windows\sysWOW64\ja-JP\ndadmin.exe.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRA1B1~1.INF\Amd64\RIA13506.GPD cmd.exe File opened for modification C:\Windows\System32\NlsData0414.dll cmd.exe File opened for modification C:\Windows\sysWOW64\wbem\en-US\iscsiprf.mfl cmd.exe File opened for modification C:\Windows\System32\es-ES\sdshext.dll.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\winhttp.dll.mui cmd.exe File opened for modification C:\Windows\System32\spp\tokens\ppdlic\ACLUIFileFolderTool-ppdlic.xrm-ms cmd.exe File opened for modification C:\Windows\System32\fr-FR\batmeter.dll.mui cmd.exe File opened for modification C:\Windows\System32\Dism\en-US\MsiProvider.dll.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\fr-FR\avc.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\DisplaySwitch.exe.mui cmd.exe File opened for modification C:\Windows\System32\wbem\PrintFilterPipelineSvc.mof cmd.exe File opened for modification C:\Windows\System32\de-DE\RWia450.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\compstui.dll cmd.exe File opened for modification C:\Windows\System32\es-ES\rasdiag.dll.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRNHP0~2.INF\Amd64\hpf2100t.exp cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\fr-FR\prnca00e.inf_loc cmd.exe File opened for modification C:\Windows\System32\bthserv.dll cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRNKY0~2.INF\prnky003.PNF cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRNKY3~2.INF\Amd64\KYLJ3060.GPD cmd.exe File opened for modification C:\Windows\System32\ja-JP\dxdiag.exe.mui cmd.exe File opened for modification C:\Windows\System32\Boot\fr-FR\winresume.efi.mui cmd.exe File opened for modification C:\Windows\sysWOW64\es-ES\faultrep.dll.mui cmd.exe File opened for modification C:\Windows\sysWOW64\es-ES\Licenses\eval\StarterE\license.rtf cmd.exe File opened for modification C:\Windows\sysWOW64\WINDOW~1\v1.0\it-IT\about_Session_Configurations.help.txt cmd.exe File opened for modification C:\Windows\System32\spp\tokens\skus\SECURI~2\Security-SPP-Component-SKU-Ultimate-TIMEBASEDSUB-ul-oob.xrm-ms cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\NETE1E~1.INF\nete1e3e.PNF cmd.exe File opened for modification C:\Windows\sysWOW64\ja-JP\FunDisc.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\recdisc.exe.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\es-ES\bthpan.inf_loc cmd.exe File opened for modification C:\Windows\sysWOW64\it-IT\netmsg.dll.mui cmd.exe -
Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll cmd.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Boot\EFI\da-DK\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\Boot\PCAT\sv-SE\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\Fonts\app852.fon cmd.exe File opened for modification C:\Windows\Fonts\KhmerUIb.ttf cmd.exe File opened for modification C:\Windows\Fonts\vrindab.ttf cmd.exe File opened for modification C:\Windows\Boot\EFI\nb-NO\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\Boot\PCAT\nb-NO\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\Fonts\s8514sys.fon cmd.exe File opened for modification C:\Windows\Fonts\vga865.fon cmd.exe File opened for modification C:\Windows\Fonts\vgasysr.fon cmd.exe File opened for modification C:\Windows\Fonts\vgasyst.fon cmd.exe File opened for modification C:\Windows\Boot\EFI\de-DE\memtest.efi.mui cmd.exe File opened for modification C:\Windows\Fonts\batang.ttc cmd.exe File opened for modification C:\Windows\Fonts\gautamib.ttf cmd.exe File opened for modification C:\Windows\Boot\EFI\de-DE\bootmgfw.efi.mui cmd.exe File opened for modification C:\Windows\Fonts\meiryo.ttc cmd.exe File opened for modification C:\Windows\Fonts\vga861.fon cmd.exe File opened for modification C:\Windows\Fonts\euphemia.ttf cmd.exe File opened for modification C:\Windows\Fonts\smae1255.fon cmd.exe File opened for modification C:\Windows\Boot\DVD\PCAT\boot.sdi cmd.exe File opened for modification C:\Windows\Boot\Fonts\kor_boot.ttf cmd.exe File opened for modification C:\Windows\Boot\PCAT\ja-JP\memtest.exe.mui cmd.exe File opened for modification C:\Windows\Boot\PCAT\ru-RU\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\Fonts\coue1255.fon cmd.exe File opened for modification C:\Windows\Fonts\couret.fon cmd.exe File opened for modification C:\Windows\Fonts\smallee.fon cmd.exe File opened for modification C:\Windows\Fonts\vga950.fon cmd.exe File opened for modification C:\Windows\Boot\EFI\es-ES\bootmgfw.efi.mui cmd.exe File opened for modification C:\Windows\Boot\EFI\fi-FI\bootmgfw.efi.mui cmd.exe File opened for modification C:\Windows\Fonts\iskpota.ttf cmd.exe File opened for modification C:\Windows\Fonts\svgasys.fon cmd.exe File opened for modification C:\Windows\Fonts\timesi.ttf cmd.exe File opened for modification C:\Windows\Fonts\timesbd.ttf cmd.exe File opened for modification C:\Windows\Boot\PCAT\memtest.exe cmd.exe File opened for modification C:\Windows\Fonts\dosapp.fon cmd.exe File opened for modification C:\Windows\Fonts\FMS_ME~1.XML cmd.exe File opened for modification C:\Windows\Fonts\LaoUIb.ttf cmd.exe File opened for modification C:\Windows\Fonts\msmincho.ttc cmd.exe File opened for modification C:\Windows\Fonts\ssef1256.fon cmd.exe File opened for modification C:\Windows\Boot\PCAT\pl-PL\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\Fonts\dos737.fon cmd.exe File opened for modification C:\Windows\Fonts\ega80857.fon cmd.exe File opened for modification C:\Windows\Fonts\mangal.ttf cmd.exe File opened for modification C:\Windows\Fonts\raavib.ttf cmd.exe File opened for modification C:\Windows\Fonts\svgafix.fon cmd.exe File opened for modification C:\Windows\Boot\EFI\ja-JP\memtest.efi.mui cmd.exe File opened for modification C:\Windows\Boot\PCAT\pt-PT\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\Fonts\85s874.fon cmd.exe File opened for modification C:\Windows\Fonts\ega40737.fon cmd.exe File opened for modification C:\Windows\Fonts\ega80869.fon cmd.exe File opened for modification C:\Windows\Fonts\jvgasys.fon cmd.exe File opened for modification C:\Windows\Fonts\sseriff.fon cmd.exe File opened for modification C:\Windows\Fonts\vga850.fon cmd.exe File opened for modification C:\Windows\Boot\EFI\memtest.efi cmd.exe File opened for modification C:\Windows\Boot\PCAT\nl-NL\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\Fonts\cga40850.fon cmd.exe File opened for modification C:\Windows\Fonts\coue1257.fon cmd.exe File opened for modification C:\Windows\Fonts\dos869.fon cmd.exe File opened for modification C:\Windows\Fonts\hvgasys.fon cmd.exe File opened for modification C:\Windows\Fonts\vgafixg.fon cmd.exe File opened for modification C:\Windows\Fonts\vgasyse.fon cmd.exe File opened for modification C:\Windows\Boot\EFI\it-IT\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\Boot\EFI\zh-CN\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\Fonts\jsmallf.fon cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3064 ipconfig.exe 2492 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2432 systeminfo.exe -
Kills process with taskkill 3 IoCs
pid Process 1800 taskkill.exe 396 taskkill.exe 1560 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2252 NOTEPAD.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2676 WMIC.exe Token: SeSecurityPrivilege 2676 WMIC.exe Token: SeTakeOwnershipPrivilege 2676 WMIC.exe Token: SeLoadDriverPrivilege 2676 WMIC.exe Token: SeSystemProfilePrivilege 2676 WMIC.exe Token: SeSystemtimePrivilege 2676 WMIC.exe Token: SeProfSingleProcessPrivilege 2676 WMIC.exe Token: SeIncBasePriorityPrivilege 2676 WMIC.exe Token: SeCreatePagefilePrivilege 2676 WMIC.exe Token: SeBackupPrivilege 2676 WMIC.exe Token: SeRestorePrivilege 2676 WMIC.exe Token: SeShutdownPrivilege 2676 WMIC.exe Token: SeDebugPrivilege 2676 WMIC.exe Token: SeSystemEnvironmentPrivilege 2676 WMIC.exe Token: SeRemoteShutdownPrivilege 2676 WMIC.exe Token: SeUndockPrivilege 2676 WMIC.exe Token: SeManageVolumePrivilege 2676 WMIC.exe Token: 33 2676 WMIC.exe Token: 34 2676 WMIC.exe Token: 35 2676 WMIC.exe Token: SeIncreaseQuotaPrivilege 2676 WMIC.exe Token: SeSecurityPrivilege 2676 WMIC.exe Token: SeTakeOwnershipPrivilege 2676 WMIC.exe Token: SeLoadDriverPrivilege 2676 WMIC.exe Token: SeSystemProfilePrivilege 2676 WMIC.exe Token: SeSystemtimePrivilege 2676 WMIC.exe Token: SeProfSingleProcessPrivilege 2676 WMIC.exe Token: SeIncBasePriorityPrivilege 2676 WMIC.exe Token: SeCreatePagefilePrivilege 2676 WMIC.exe Token: SeBackupPrivilege 2676 WMIC.exe Token: SeRestorePrivilege 2676 WMIC.exe Token: SeShutdownPrivilege 2676 WMIC.exe Token: SeDebugPrivilege 2676 WMIC.exe Token: SeSystemEnvironmentPrivilege 2676 WMIC.exe Token: SeRemoteShutdownPrivilege 2676 WMIC.exe Token: SeUndockPrivilege 2676 WMIC.exe Token: SeManageVolumePrivilege 2676 WMIC.exe Token: 33 2676 WMIC.exe Token: 34 2676 WMIC.exe Token: 35 2676 WMIC.exe Token: SeIncreaseQuotaPrivilege 2744 WMIC.exe Token: SeSecurityPrivilege 2744 WMIC.exe Token: SeTakeOwnershipPrivilege 2744 WMIC.exe Token: SeLoadDriverPrivilege 2744 WMIC.exe Token: SeSystemProfilePrivilege 2744 WMIC.exe Token: SeSystemtimePrivilege 2744 WMIC.exe Token: SeProfSingleProcessPrivilege 2744 WMIC.exe Token: SeIncBasePriorityPrivilege 2744 WMIC.exe Token: SeCreatePagefilePrivilege 2744 WMIC.exe Token: SeBackupPrivilege 2744 WMIC.exe Token: SeRestorePrivilege 2744 WMIC.exe Token: SeShutdownPrivilege 2744 WMIC.exe Token: SeDebugPrivilege 2744 WMIC.exe Token: SeSystemEnvironmentPrivilege 2744 WMIC.exe Token: SeRemoteShutdownPrivilege 2744 WMIC.exe Token: SeUndockPrivilege 2744 WMIC.exe Token: SeManageVolumePrivilege 2744 WMIC.exe Token: 33 2744 WMIC.exe Token: 34 2744 WMIC.exe Token: 35 2744 WMIC.exe Token: SeIncreaseQuotaPrivilege 2744 WMIC.exe Token: SeSecurityPrivilege 2744 WMIC.exe Token: SeTakeOwnershipPrivilege 2744 WMIC.exe Token: SeLoadDriverPrivilege 2744 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1376 wrote to memory of 1908 1376 cmd.exe 29 PID 1376 wrote to memory of 1908 1376 cmd.exe 29 PID 1376 wrote to memory of 1908 1376 cmd.exe 29 PID 1376 wrote to memory of 2484 1376 cmd.exe 30 PID 1376 wrote to memory of 2484 1376 cmd.exe 30 PID 1376 wrote to memory of 2484 1376 cmd.exe 30 PID 1376 wrote to memory of 2492 1376 cmd.exe 31 PID 1376 wrote to memory of 2492 1376 cmd.exe 31 PID 1376 wrote to memory of 2492 1376 cmd.exe 31 PID 1376 wrote to memory of 3064 1376 cmd.exe 32 PID 1376 wrote to memory of 3064 1376 cmd.exe 32 PID 1376 wrote to memory of 3064 1376 cmd.exe 32 PID 1376 wrote to memory of 2540 1376 cmd.exe 33 PID 1376 wrote to memory of 2540 1376 cmd.exe 33 PID 1376 wrote to memory of 2540 1376 cmd.exe 33 PID 1376 wrote to memory of 2676 1376 cmd.exe 34 PID 1376 wrote to memory of 2676 1376 cmd.exe 34 PID 1376 wrote to memory of 2676 1376 cmd.exe 34 PID 1376 wrote to memory of 2744 1376 cmd.exe 36 PID 1376 wrote to memory of 2744 1376 cmd.exe 36 PID 1376 wrote to memory of 2744 1376 cmd.exe 36 PID 1376 wrote to memory of 2432 1376 cmd.exe 37 PID 1376 wrote to memory of 2432 1376 cmd.exe 37 PID 1376 wrote to memory of 2432 1376 cmd.exe 37 PID 1376 wrote to memory of 2448 1376 cmd.exe 39 PID 1376 wrote to memory of 2448 1376 cmd.exe 39 PID 1376 wrote to memory of 2448 1376 cmd.exe 39 PID 1376 wrote to memory of 2892 1376 cmd.exe 40 PID 1376 wrote to memory of 2892 1376 cmd.exe 40 PID 1376 wrote to memory of 2892 1376 cmd.exe 40 PID 1376 wrote to memory of 2380 1376 cmd.exe 41 PID 1376 wrote to memory of 2380 1376 cmd.exe 41 PID 1376 wrote to memory of 2380 1376 cmd.exe 41 PID 1376 wrote to memory of 524 1376 cmd.exe 42 PID 1376 wrote to memory of 524 1376 cmd.exe 42 PID 1376 wrote to memory of 524 1376 cmd.exe 42 PID 1376 wrote to memory of 1768 1376 cmd.exe 43 PID 1376 wrote to memory of 1768 1376 cmd.exe 43 PID 1376 wrote to memory of 1768 1376 cmd.exe 43 PID 1376 wrote to memory of 916 1376 cmd.exe 44 PID 1376 wrote to memory of 916 1376 cmd.exe 44 PID 1376 wrote to memory of 916 1376 cmd.exe 44 PID 1376 wrote to memory of 1956 1376 cmd.exe 45 PID 1376 wrote to memory of 1956 1376 cmd.exe 45 PID 1376 wrote to memory of 1956 1376 cmd.exe 45 PID 1376 wrote to memory of 2252 1376 cmd.exe 46 PID 1376 wrote to memory of 2252 1376 cmd.exe 46 PID 1376 wrote to memory of 2252 1376 cmd.exe 46 PID 1376 wrote to memory of 2336 1376 cmd.exe 47 PID 1376 wrote to memory of 2336 1376 cmd.exe 47 PID 1376 wrote to memory of 2336 1376 cmd.exe 47 PID 1376 wrote to memory of 848 1376 cmd.exe 50 PID 1376 wrote to memory of 848 1376 cmd.exe 50 PID 1376 wrote to memory of 848 1376 cmd.exe 50 PID 1376 wrote to memory of 1724 1376 cmd.exe 51 PID 1376 wrote to memory of 1724 1376 cmd.exe 51 PID 1376 wrote to memory of 1724 1376 cmd.exe 51 PID 1376 wrote to memory of 2076 1376 cmd.exe 52 PID 1376 wrote to memory of 2076 1376 cmd.exe 52 PID 1376 wrote to memory of 2076 1376 cmd.exe 52 PID 1376 wrote to memory of 1888 1376 cmd.exe 53 PID 1376 wrote to memory of 1888 1376 cmd.exe 53 PID 1376 wrote to memory of 1888 1376 cmd.exe 53 PID 1376 wrote to memory of 1172 1376 cmd.exe 54
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\D34TH 2.0 .bat"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com2⤵PID:1908
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles2⤵PID:2484
-
-
C:\Windows\system32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:2492
-
-
C:\Windows\system32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:3064
-
-
C:\Windows\system32\find.exefind /i "IPv4"2⤵PID:2540
-
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get size2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
PID:2432
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode disable2⤵
- Modifies Windows Firewall
PID:2448
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=DISABLE2⤵
- Modifies Windows Firewall
PID:2892
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off2⤵
- Modifies Windows Firewall
PID:2380
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set domainprofile state off2⤵
- Modifies Windows Firewall
PID:524
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set privateprofile state off2⤵
- Modifies Windows Firewall
PID:1768
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set publicprofile state off2⤵
- Modifies Windows Firewall
PID:916
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
PID:1956
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\F.log2⤵
- Opens file in notepad (likely ransom note)
PID:2252
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System322⤵
- Modifies file permissions
PID:2336
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System2⤵
- Modifies file permissions
PID:848
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\Boot2⤵
- Modifies file permissions
PID:1724
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\Fonts2⤵
- Modifies file permissions
PID:2076
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\sysWOW642⤵
- Modifies file permissions
PID:1888
-
-
C:\Windows\system32\net.exenet stop "Windows Defender Service"2⤵PID:1172
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Windows Defender Service"3⤵PID:1704
-
-
-
C:\Windows\system32\net.exenet stop "Windows Firewall"2⤵PID:1488
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Windows Firewall"3⤵PID:988
-
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "chrome.exe" /T2⤵
- Kills process with taskkill
PID:1800
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "firefox.exe" /T2⤵
- Kills process with taskkill
PID:396
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "explorer.exe" /T2⤵
- Kills process with taskkill
PID:1560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51d7ad950400db14f088660b15097eed6
SHA13724d9a64c7f48ebb724de0641f4a5cc5e4008d1
SHA256912e306343d70ed6b16e1daa41aed608ff5f89d777e1d1258492188b80a9ae5e
SHA5126a9c4b7385aa3180279bd162006bb5c5b45cd5e016128c8f988d24fd97685d45ef455d79b7165f79d164223170c82dc265669495909e2ee7c9921d816c50edbd