Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-04-2024 01:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe
Resource
win7-20240221-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
28 signatures
150 seconds
General
-
Target
c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe
-
Size
2.4MB
-
MD5
2a613d677cc3e2991dcd954e9413c40c
-
SHA1
26f49090585d31dca8dde83106c0a851f00f2f18
-
SHA256
c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b
-
SHA512
b3edc9f56aa9c1f3685bb7e14d7dad27f23346bb1f21618acb3091c2031c1c5f48f77f375d97763b2da1b4658efd12a1147114bd65190b9f8c772d302d0f7a44
-
SSDEEP
49152:I/oSNzCxuPz3v/EekOEQ5ZlC2WQcyDJFD6BaKAjB8eJMv+8KwXkZx+jau:I/oCCQv/EeJESlC2WbyDukrBDJMGXjG
Score
10/10
Malware Config
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral1/files/0x0008000000014186-5.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" encrypt.exe -
Clears Windows event logs 1 TTPs 3 IoCs
pid Process 996 wevtutil.exe 1140 wevtutil.exe 832 wevtutil.exe -
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
resource yara_rule behavioral1/files/0x0008000000014186-5.dat INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM -
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule behavioral1/files/0x0008000000014186-5.dat INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
resource yara_rule behavioral1/files/0x0008000000014186-5.dat INDICATOR_SUSPICIOUS_USNDeleteJournal -
Detects executables containing commands for clearing Windows Event Logs 1 IoCs
resource yara_rule behavioral1/files/0x0008000000014186-5.dat INDICATOR_SUSPICIOUS_ClearWinLogs -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1920 bcdedit.exe 536 bcdedit.exe -
pid Process 772 wbadmin.exe -
pid Process 572 wbadmin.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe -
Executes dropped EXE 5 IoCs
pid Process 1452 encrypt.exe 2592 encrypt.exe 2744 encrypt.exe 2804 encrypt.exe 2760 encrypt.exe -
Loads dropped DLL 9 IoCs
pid Process 2528 c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe 2528 c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe 2528 c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe 1452 encrypt.exe 1452 encrypt.exe 2592 encrypt.exe 2760 encrypt.exe 2744 encrypt.exe 2804 encrypt.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell encrypt.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command encrypt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command encrypt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\encrypt = "\"C:\\Users\\Admin\\AppData\\Local\\encrypt\\encrypt.exe\" " encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\encrypt.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\HACKLENDINIZ.txt\"" encrypt.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: encrypt.exe File opened (read-only) \??\T: encrypt.exe File opened (read-only) \??\U: encrypt.exe File opened (read-only) \??\E: encrypt.exe File opened (read-only) \??\G: encrypt.exe File opened (read-only) \??\L: encrypt.exe File opened (read-only) \??\N: encrypt.exe File opened (read-only) \??\P: encrypt.exe File opened (read-only) \??\Q: encrypt.exe File opened (read-only) \??\V: encrypt.exe File opened (read-only) \??\A: encrypt.exe File opened (read-only) \??\J: encrypt.exe File opened (read-only) \??\K: encrypt.exe File opened (read-only) \??\W: encrypt.exe File opened (read-only) \??\H: encrypt.exe File opened (read-only) \??\I: encrypt.exe File opened (read-only) \??\R: encrypt.exe File opened (read-only) \??\X: encrypt.exe File opened (read-only) \??\Y: encrypt.exe File opened (read-only) \??\Z: encrypt.exe File opened (read-only) \??\B: encrypt.exe File opened (read-only) \??\M: encrypt.exe File opened (read-only) \??\O: encrypt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile encrypt.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell encrypt.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command encrypt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command encrypt.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open encrypt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1620 notepad.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2760 encrypt.exe 2804 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe 2592 encrypt.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1452 encrypt.exe Token: SeSecurityPrivilege 1452 encrypt.exe Token: SeTakeOwnershipPrivilege 1452 encrypt.exe Token: SeLoadDriverPrivilege 1452 encrypt.exe Token: SeSystemProfilePrivilege 1452 encrypt.exe Token: SeSystemtimePrivilege 1452 encrypt.exe Token: SeProfSingleProcessPrivilege 1452 encrypt.exe Token: SeIncBasePriorityPrivilege 1452 encrypt.exe Token: SeCreatePagefilePrivilege 1452 encrypt.exe Token: SeBackupPrivilege 1452 encrypt.exe Token: SeRestorePrivilege 1452 encrypt.exe Token: SeShutdownPrivilege 1452 encrypt.exe Token: SeDebugPrivilege 1452 encrypt.exe Token: SeSystemEnvironmentPrivilege 1452 encrypt.exe Token: SeChangeNotifyPrivilege 1452 encrypt.exe Token: SeRemoteShutdownPrivilege 1452 encrypt.exe Token: SeUndockPrivilege 1452 encrypt.exe Token: SeManageVolumePrivilege 1452 encrypt.exe Token: SeImpersonatePrivilege 1452 encrypt.exe Token: SeCreateGlobalPrivilege 1452 encrypt.exe Token: 33 1452 encrypt.exe Token: 34 1452 encrypt.exe Token: 35 1452 encrypt.exe Token: SeIncreaseQuotaPrivilege 2592 encrypt.exe Token: SeSecurityPrivilege 2592 encrypt.exe Token: SeTakeOwnershipPrivilege 2592 encrypt.exe Token: SeLoadDriverPrivilege 2592 encrypt.exe Token: SeSystemProfilePrivilege 2592 encrypt.exe Token: SeSystemtimePrivilege 2592 encrypt.exe Token: SeProfSingleProcessPrivilege 2592 encrypt.exe Token: SeIncBasePriorityPrivilege 2592 encrypt.exe Token: SeCreatePagefilePrivilege 2592 encrypt.exe Token: SeBackupPrivilege 2592 encrypt.exe Token: SeRestorePrivilege 2592 encrypt.exe Token: SeShutdownPrivilege 2592 encrypt.exe Token: SeDebugPrivilege 2592 encrypt.exe Token: SeSystemEnvironmentPrivilege 2592 encrypt.exe Token: SeChangeNotifyPrivilege 2592 encrypt.exe Token: SeRemoteShutdownPrivilege 2592 encrypt.exe Token: SeUndockPrivilege 2592 encrypt.exe Token: SeManageVolumePrivilege 2592 encrypt.exe Token: SeImpersonatePrivilege 2592 encrypt.exe Token: SeCreateGlobalPrivilege 2592 encrypt.exe Token: 33 2592 encrypt.exe Token: 34 2592 encrypt.exe Token: 35 2592 encrypt.exe Token: SeIncreaseQuotaPrivilege 2760 encrypt.exe Token: SeSecurityPrivilege 2760 encrypt.exe Token: SeTakeOwnershipPrivilege 2760 encrypt.exe Token: SeLoadDriverPrivilege 2760 encrypt.exe Token: SeSystemProfilePrivilege 2760 encrypt.exe Token: SeSystemtimePrivilege 2760 encrypt.exe Token: SeProfSingleProcessPrivilege 2760 encrypt.exe Token: SeIncBasePriorityPrivilege 2760 encrypt.exe Token: SeCreatePagefilePrivilege 2760 encrypt.exe Token: SeBackupPrivilege 2760 encrypt.exe Token: SeRestorePrivilege 2760 encrypt.exe Token: SeShutdownPrivilege 2760 encrypt.exe Token: SeDebugPrivilege 2760 encrypt.exe Token: SeSystemEnvironmentPrivilege 2760 encrypt.exe Token: SeChangeNotifyPrivilege 2760 encrypt.exe Token: SeRemoteShutdownPrivilege 2760 encrypt.exe Token: SeUndockPrivilege 2760 encrypt.exe Token: SeManageVolumePrivilege 2760 encrypt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1452 2528 c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe 28 PID 2528 wrote to memory of 1452 2528 c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe 28 PID 2528 wrote to memory of 1452 2528 c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe 28 PID 2528 wrote to memory of 1452 2528 c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe 28 PID 1452 wrote to memory of 2592 1452 encrypt.exe 29 PID 1452 wrote to memory of 2592 1452 encrypt.exe 29 PID 1452 wrote to memory of 2592 1452 encrypt.exe 29 PID 1452 wrote to memory of 2592 1452 encrypt.exe 29 PID 2592 wrote to memory of 2744 2592 encrypt.exe 30 PID 2592 wrote to memory of 2744 2592 encrypt.exe 30 PID 2592 wrote to memory of 2744 2592 encrypt.exe 30 PID 2592 wrote to memory of 2744 2592 encrypt.exe 30 PID 2592 wrote to memory of 2804 2592 encrypt.exe 31 PID 2592 wrote to memory of 2804 2592 encrypt.exe 31 PID 2592 wrote to memory of 2804 2592 encrypt.exe 31 PID 2592 wrote to memory of 2804 2592 encrypt.exe 31 PID 2592 wrote to memory of 2760 2592 encrypt.exe 32 PID 2592 wrote to memory of 2760 2592 encrypt.exe 32 PID 2592 wrote to memory of 2760 2592 encrypt.exe 32 PID 2592 wrote to memory of 2760 2592 encrypt.exe 32 PID 2592 wrote to memory of 2296 2592 encrypt.exe 33 PID 2592 wrote to memory of 2296 2592 encrypt.exe 33 PID 2592 wrote to memory of 2296 2592 encrypt.exe 33 PID 2592 wrote to memory of 2296 2592 encrypt.exe 33 PID 2592 wrote to memory of 2900 2592 encrypt.exe 34 PID 2592 wrote to memory of 2900 2592 encrypt.exe 34 PID 2592 wrote to memory of 2900 2592 encrypt.exe 34 PID 2592 wrote to memory of 2900 2592 encrypt.exe 34 PID 2592 wrote to memory of 328 2592 encrypt.exe 35 PID 2592 wrote to memory of 328 2592 encrypt.exe 35 PID 2592 wrote to memory of 328 2592 encrypt.exe 35 PID 2592 wrote to memory of 328 2592 encrypt.exe 35 PID 2592 wrote to memory of 1904 2592 encrypt.exe 36 PID 2592 wrote to memory of 1904 2592 encrypt.exe 36 PID 2592 wrote to memory of 1904 2592 encrypt.exe 36 PID 2592 wrote to memory of 1904 2592 encrypt.exe 36 PID 2592 wrote to memory of 2000 2592 encrypt.exe 37 PID 2592 wrote to memory of 2000 2592 encrypt.exe 37 PID 2592 wrote to memory of 2000 2592 encrypt.exe 37 PID 2592 wrote to memory of 2000 2592 encrypt.exe 37 PID 2592 wrote to memory of 2688 2592 encrypt.exe 39 PID 2592 wrote to memory of 2688 2592 encrypt.exe 39 PID 2592 wrote to memory of 2688 2592 encrypt.exe 39 PID 2592 wrote to memory of 2688 2592 encrypt.exe 39 PID 2592 wrote to memory of 2696 2592 encrypt.exe 40 PID 2592 wrote to memory of 2696 2592 encrypt.exe 40 PID 2592 wrote to memory of 2696 2592 encrypt.exe 40 PID 2592 wrote to memory of 2696 2592 encrypt.exe 40 PID 2592 wrote to memory of 2660 2592 encrypt.exe 41 PID 2592 wrote to memory of 2660 2592 encrypt.exe 41 PID 2592 wrote to memory of 2660 2592 encrypt.exe 41 PID 2592 wrote to memory of 2660 2592 encrypt.exe 41 PID 2592 wrote to memory of 2684 2592 encrypt.exe 43 PID 2592 wrote to memory of 2684 2592 encrypt.exe 43 PID 2592 wrote to memory of 2684 2592 encrypt.exe 43 PID 2592 wrote to memory of 2684 2592 encrypt.exe 43 PID 2592 wrote to memory of 2700 2592 encrypt.exe 44 PID 2592 wrote to memory of 2700 2592 encrypt.exe 44 PID 2592 wrote to memory of 2700 2592 encrypt.exe 44 PID 2592 wrote to memory of 2700 2592 encrypt.exe 44 PID 2592 wrote to memory of 2676 2592 encrypt.exe 45 PID 2592 wrote to memory of 2676 2592 encrypt.exe 45 PID 2592 wrote to memory of 2676 2592 encrypt.exe 45 PID 2592 wrote to memory of 2676 2592 encrypt.exe 45 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" encrypt.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer encrypt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System encrypt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection encrypt.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe"C:\Users\Admin\AppData\Local\Temp\c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\tempcrc\encrypt.exe"C:\tempcrc\encrypt.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"3⤵
- Modifies security service
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2592 -
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe" -e watch -pid 2592 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744
-
-
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2804
-
-
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -H off4⤵PID:2296
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2900
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:328
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:1904
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2000
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2688
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2696
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2660
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2684
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2700
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2676
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2680
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2784
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵PID:2864
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵PID:2904
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1920
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:536
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
PID:772
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:572
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe "C:\Users\Admin\AppData\Local\HACKLENDINIZ.txt"4⤵
- Opens file in notepad (likely ransom note)
PID:1620
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl security4⤵
- Clears Windows event logs
PID:996
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl system4⤵
- Clears Windows event logs
PID:832
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl application4⤵
- Clears Windows event logs
PID:1140
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1520
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:1012
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1200
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1252
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fa9f6c87b086bf0a18b957d30ffdccbb
SHA1e7ad196244d10d9bfb43b968a721c171db4332cf
SHA256817c1b357bc74e9ef13316d9ecaf162c77ad83dd45de599e95037e99c71ca1de
SHA512a02565c0d2fb6acae678734986674f7dd86f9ea12ba69ebca038ed49d4cbabfa3b7319b49f2685924100682159887d399668ad4e7768f12790f9f3eef04c4a05
-
Filesize
32B
MD548e45671f2bc65d6587c37834460514d
SHA1361b334807fafeee665490a72d3cd7f68ca4782d
SHA256977bcea6ad0e0c7ada28b6725d13f3a7abf77b8bb322d42733ebb894617be2af
SHA512b7d59b6698c8f942b66c2c60fc2310a98848cdcc4e7f8d6865c06b915e20e52b2771cce62b6751a5c7b70063b8873f6589908b24099f96505e2684d26f0a030c
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
3.0MB
MD5a48ee000e248741247c24dc70fa2f936
SHA14c814fe7c94e6fb4d1d89cdae7e6e83905c459d7
SHA256bb28adc32ff1b9dcfaac6b7017b4896d2807b48080f9e6720afde3f89d69676c
SHA5128bdd60732bf105b9ade5d4dbc5c722a866119e0a284692afc1bd5b530a4afc3954536a14946a87f72213c92020def2ac7b5c1cbcc51b6e0ad5671b7c58543f34