Resubmissions
03/05/2024, 16:10
240503-tmdb9adf49803/05/2024, 16:09
240503-tl83jaag6t103/05/2024, 16:09
240503-tlzh4adf391Analysis
- max time kernel
1430s - max time network
1218s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
03/05/2024, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
target.vbs
Resource
win7-20240221-en
windows7-x64
14 signatures
1800 seconds
General
- Target target.vbs
- Size 9B
- Sample240503-tmdb9adf49
- SHA256 4728a851465451f5fccc481fc5a242c5964a37b360db70b784a9ef47aefc0682
- MD5 3d1992f66329a732cf44da0047d8f98c
- SHA1 9fe37a96982d8ef105015d6f4642c48c79bf3d14
- SHA512 df8e12716d683754db2e835967c9d1021e36569f24f8051b145f29f61b7fb99008d16018cdd0a8d7eab3f825997d25936dc95df13700a6b4c4e1ee508ee89d67
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule behavioral1/files/0x0001000000010488-53.dat office_macro_on_action - Loads dropped DLL 1 IoCs
pid Process 2504 setup.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: BitLockerToGo.exe File opened (read-only) \??\F: BitLockerToGo.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 64 IoCs
description ioc Process Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe - Modifies data under HKEY_USERS 27 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings rundll32.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1804 NOTEPAD.EXE - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 2744 msiexec.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 1032 taskmgr.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeSecurityPrivilege 2744 msiexec.exe Token: SeShutdownPrivilege 2312 LogonUI.exe Token: SeShutdownPrivilege 2312 LogonUI.exe Token: SeShutdownPrivilege 2312 LogonUI.exe Token: SeSecurityPrivilege 1876 winlogon.exe Token: SeBackupPrivilege 1876 winlogon.exe Token: SeSecurityPrivilege 1876 winlogon.exe Token: SeTcbPrivilege 1876 winlogon.exe Token: SeShutdownPrivilege 1012 LogonUI.exe Token: SeShutdownPrivilege 1012 LogonUI.exe Token: SeShutdownPrivilege 1012 LogonUI.exe Token: SeSecurityPrivilege 1336 winlogon.exe Token: SeBackupPrivilege 1336 winlogon.exe Token: SeSecurityPrivilege 1336 winlogon.exe Token: SeTcbPrivilege 1336 winlogon.exe Token: SeShutdownPrivilege 1012 LogonUI.exe Token: SeShutdownPrivilege 1012 LogonUI.exe Token: SeShutdownPrivilege 1012 LogonUI.exe Token: SeShutdownPrivilege 1012 LogonUI.exe Token: SeShutdownPrivilege 1012 LogonUI.exe Token: SeShutdownPrivilege 1012 LogonUI.exe Token: SeSecurityPrivilege 1336 winlogon.exe Token: SeBackupPrivilege 1336 winlogon.exe Token: SeSecurityPrivilege 1336 winlogon.exe Token: SeShutdownPrivilege 1608 LogonUI.exe Token: SeShutdownPrivilege 1608 LogonUI.exe Token: SeShutdownPrivilege 1608 LogonUI.exe - Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe - Suspicious use of SendNotifyMessage 41 IoCs
pid Process 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2820 1860 rundll32.exe 93 PID 1860 wrote to memory of 2820 1860 rundll32.exe 93 PID 1860 wrote to memory of 2820 1860 rundll32.exe 93 PID 2444 wrote to memory of 2772 2444 cmd.exe 97 PID 2444 wrote to memory of 2772 2444 cmd.exe 97 PID 2444 wrote to memory of 2772 2444 cmd.exe 97 PID 2772 wrote to memory of 580 2772 net.exe 98 PID 2772 wrote to memory of 580 2772 net.exe 98 PID 2772 wrote to memory of 580 2772 net.exe 98 PID 2444 wrote to memory of 1444 2444 cmd.exe 99 PID 2444 wrote to memory of 1444 2444 cmd.exe 99 PID 2444 wrote to memory of 1444 2444 cmd.exe 99 PID 1444 wrote to memory of 2572 1444 net.exe 100 PID 1444 wrote to memory of 2572 1444 net.exe 100 PID 1444 wrote to memory of 2572 1444 net.exe 100 PID 2444 wrote to memory of 2288 2444 cmd.exe 101 PID 2444 wrote to memory of 2288 2444 cmd.exe 101 PID 2444 wrote to memory of 2288 2444 cmd.exe 101 PID 2288 wrote to memory of 1104 2288 net.exe 102 PID 2288 wrote to memory of 1104 2288 net.exe 102 PID 2288 wrote to memory of 1104 2288 net.exe 102 PID 2444 wrote to memory of 2716 2444 cmd.exe 103 PID 2444 wrote to memory of 2716 2444 cmd.exe 103 PID 2444 wrote to memory of 2716 2444 cmd.exe 103 PID 2716 wrote to memory of 1016 2716 net.exe 104 PID 2716 wrote to memory of 1016 2716 net.exe 104 PID 2716 wrote to memory of 1016 2716 net.exe 104 PID 2444 wrote to memory of 2756 2444 cmd.exe 105 PID 2444 wrote to memory of 2756 2444 cmd.exe 105 PID 2444 wrote to memory of 2756 2444 cmd.exe 105 PID 2756 wrote to memory of 2788 2756 net.exe 106 PID 2756 wrote to memory of 2788 2756 net.exe 106 PID 2756 wrote to memory of 2788 2756 net.exe 106 PID 2444 wrote to memory of 2624 2444 cmd.exe 107 PID 2444 wrote to memory of 2624 2444 cmd.exe 107 PID 2444 wrote to memory of 2624 2444 cmd.exe 107 PID 2624 wrote to memory of 1804 2624 net.exe 108 PID 2624 wrote to memory of 1804 2624 net.exe 108 PID 2624 wrote to memory of 1804 2624 net.exe 108 PID 2272 wrote to memory of 2312 2272 csrss.exe 114 PID 2272 wrote to memory of 2312 2272 csrss.exe 114 PID 1876 wrote to memory of 2312 1876 winlogon.exe 114 PID 1876 wrote to memory of 2312 1876 winlogon.exe 114 PID 1876 wrote to memory of 2312 1876 winlogon.exe 114 PID 2272 wrote to memory of 2312 2272 csrss.exe 114 PID 2272 wrote to memory of 2312 2272 csrss.exe 114 PID 2272 wrote to memory of 2312 2272 csrss.exe 114 PID 2272 wrote to memory of 2312 2272 csrss.exe 114 PID 2272 wrote to memory of 2312 2272 csrss.exe 114 PID 2272 wrote to memory of 2312 2272 csrss.exe 114 PID 2272 wrote to memory of 2312 2272 csrss.exe 114 PID 1308 wrote to memory of 1012 1308 csrss.exe 118 PID 1308 wrote to memory of 1012 1308 csrss.exe 118 PID 1336 wrote to memory of 1012 1336 winlogon.exe 118 PID 1336 wrote to memory of 1012 1336 winlogon.exe 118 PID 1336 wrote to memory of 1012 1336 winlogon.exe 118 PID 1308 wrote to memory of 1012 1308 csrss.exe 118 PID 1308 wrote to memory of 1012 1308 csrss.exe 118 PID 1308 wrote to memory of 1012 1308 csrss.exe 118 PID 1308 wrote to memory of 1012 1308 csrss.exe 118 PID 1308 wrote to memory of 1012 1308 csrss.exe 118 PID 1308 wrote to memory of 1012 1308 csrss.exe 118 PID 1308 wrote to memory of 1012 1308 csrss.exe 118 PID 1308 wrote to memory of 1012 1308 csrss.exe 118
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\target.vbs"1⤵PID:2776
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:940
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\pagefile.sys1⤵PID:2060
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2010_x86.log-MSI_vc_red.msi.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1804
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe"1⤵
- Loads dropped DLL
PID:2504
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1032
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2932
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"1⤵
- Enumerates connected drives
PID:3064
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:1372
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\System Volume Information\SPP\OnlineMetadataCache\{1c4f8e5b-c1ff-4272-a6e6-3d9490ee02fa}_OnDiskSnapshotProp1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\System Volume Information\SPP\OnlineMetadataCache\{1c4f8e5b-c1ff-4272-a6e6-3d9490ee02fa}_OnDiskSnapshotProp2⤵PID:2820
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵PID:580
-
-
-
C:\Windows\system32\net.exenet user add Administrator2⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user add Administrator3⤵PID:2572
-
-
-
C:\Windows\system32\net.exenet user list2⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user list3⤵PID:1104
-
-
-
C:\Windows\system32\net.exenet user /delete Guest2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /delete Guest3⤵PID:1016
-
-
-
C:\Windows\system32\net.exenet user /add Administrator2⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /add Administrator3⤵PID:2788
-
-
-
C:\Windows\system32\net.exenet user /add TrustedInstaller 1232⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /add TrustedInstaller 1233⤵PID:1804
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1512
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2272
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2312
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1308
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Enumerates system info in registry
PID:528
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
PID:2988 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab
- Size 22.8MB
- SHA256 37eeb777184d072cad952245be6d72ab5af9e47521eabbb174dea875894b929f
- MD5 e1e97f01f4292b89953204557a043c7d
- SHA1 d6af244959c5f4592c870807aaa7e2a0fb32a7a4
- SHA512 d224d3e656afb907e251bc67d7b88dc00581347829a2a1496f576e68059ff35bfb236f1d33f61af25d8bc1e24430222d4805a39f043e4ba66e9cb8b50ad91ce4
- SSDEEP 393216:GIrjONkLx7xluhiPMkkLfj1sE69Uwg6oYx7ErunhAVqR+IqHyTJk7jn+0k5UI+l:GIrnqahwj1T3wRoYJEr+hAVqRjqHqJCR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi
- Size 2.9MB
- SHA256 32564d84ef0a140f49ad54eb49de6a3389bdc903be694139b371d95abcc6f6bd
- MD5 43b44c38be513d9589ecac7129ddc7c3
- SHA1 f4e519f30fdcf71b56d91d52436f99188238e89d
- SHA512 cb357a6dc3393b4833115c110e8eee5795fd1aa90eb9c82c6a9798cb0f05d6052ac8611e289d83cf668135b8276973c1de221d6157fc742ef3645bf485dac4a2
- SSDEEP 49152:cngjV0PBcudHcE7S8lDVHLhlE/wHRpKZG:C0sOudHcErxhew
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml
- Size 4KB
- SHA256 fb2a981784885c8f43cf007f48baae89a80c5e53a36eb7f60ce6ccec3c4acdad
- MD5 899a7d743d01852ebd036b465d1ef181
- SHA1 04de7d2fbcff5c4eb92ce33b2ba46d9840bb9104
- SHA512 b2281971339ed97f13688ed1895392d534b35fee892849f0d934efa8ea44b87cbbc41a7f2a92b9bb0eb6b62c2624f61f567c3198d6f6b950a2a815c6563b82ce
- SSDEEP 48:cjTTxqOCmK45d7WA/9TNLh1DtsyflDjO0ZKRuy3yf5amJx56mcQhctlcPVzlAmsb:YTwOtK2ht8uoh86
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll
- Size 1.2MB
- SHA256 16903db9be6df1817358995cd8e39268bc404b558c6b04d841e82ee731fe7cd5
- MD5 7f120aad20ecae1ea421083f26611519
- SHA1 d67358da73456fdfb1f41776f6792ac9f4e1bfb0
- SHA512 267586f54e7e7d063586ccb33f99f3ca21ba02a2effab9df3681a78347de8c610e22d469def991c3d059174f092d371aed8cf86c0bccbc02b3a4dd99542f121e
- SSDEEP 24576:OmBEzaeLa1o3kYQXTDbnOeUyE7aZQrd4zpq/BMcJDW2Pz/xt5tyOjLgQGbq0t63R:OmNeLa1o3kYQHjOCAJ/Lsb63lqZGNmlK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi
- Size 23.7MB
- SHA256 94394a95064eb630cddb99a16607f3d3bab7cff8741ac9ced2ef57b819bf08e6
- MD5 f7dccd578605f72aeeed775c9eb40ab8
- SHA1 b8ffb0dd78c4d0d42f277532e9d5e776ea95f905
- SHA512 4f376be1f12fd3f426ba911e7d9774726f66bb1fb55cca22e76fd1fda4def06ceb05b5a52809fd40e475cb9421e82ef2e6aebf930103b4f0d522cac075b221c0
- SSDEEP 393216:fBnEqnLTcvqGHtE6z4mevQDhmd9YZX6sP2G/KWzUT8KN/zyGLeUh4d1SbeQYIPyW:fBEjd6WzUT8KN/zyg4dmyYq61
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml
- Size 16KB
- SHA256 60ad4b9a4b0763d55276c488f3911221e57916892e39e36f14a5c84d25b71307
- MD5 146ca2b8e1559f81e8df6a3aed949e2a
- SHA1 c11dbd6fce7a40b0e424065926320617d060e5bc
- SHA512 82833758c8f8ea9e677bad0aa6f7e251d222fd4f7b8b478fa5b7244316be3ef751f4dcf36c4a8322a39d7da210e7f2c85287a01de0b785df344c81dff5d35350
- SSDEEP 96:Y0MLQRifDOxcYVdMubsmHJ5FCiYohc+jBWoCvAbpRadlcdNxj746dFyGC5s8MUSW:zefOcYAu3HxWohc+FW5vAtRRNWfGNeT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml
- Size 30KB
- SHA256 ca90a9bbaf60af3994fc09d05d1c477e2919c07c1e17e86a8d2e7f595bbe5cb4
- MD5 2e1c177f27ef6fa690c1e96187844c76
- SHA1 b51ea694076c73a76a8857c9d1b6ff03bc9b2690
- SHA512 5b6e7b3ed4feab920663042b218faa6d5a1124afb49c2aecc551415b223ea3b9afe5fbf43675a540a8b9803a0228e9f37ac299b3d91a2d78715596b6a560070b
- SSDEEP 384:7xGeq+wGHoiWa1pvqanZTUcxaSScNIqoHsWxn74YUL5s9nZ0GankApeLq:78eq+wnavvBkWjoH1lUL56nZN6kApeLq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
- Size 145KB
- SHA256 70964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc
- MD5 9d10f99a6712e28f8acd5641e3a7ea6b
- SHA1 835e982347db919a681ba12f3891f62152e50f0d
- SHA512 2141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5
- SSDEEP 1536:vC4QOL26NOd32mM6X/pGzd4t/qcarbwNfQ8WfQJ+ItkbKR2zy2IoN7Zo86eAI0UV:K4QgNOd3z44Kw6JrokFyF5Zat/Vq09oi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll
- Size 5.5MB
- SHA256 e51a5292a06674cdbbcea240084b65186aa1dd2bc3316f61ff433d9d9f542a74
- MD5 fcc38158c5d62a39e1ba79a29d532240
- SHA1 eca2d1e91c634bc8a4381239eb05f30803636c24
- SHA512 0d224474a9358863e4bb8dacc48b219376d9cc89cea13f8d0c6f7b093dd420ceb185eb4d649e5bd5246758419d0531922b4f351df8ad580b3baa0fab88d89ec7
- SSDEEP 98304:8EpQGDTa+ABNoBLkIV30LbZRop7MD79/By:PQGDTTA+LZ0iS795
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms
- Size 699KB
- SHA256 edfb49cd35fe352a1d29db39baa949ac23b06795c31f417816185b0c04c82f07
- MD5 3dcff1dcdeb1b837ec8f13351c8a92ac
- SHA1 110132bd71af7ef15fd8fabcb5baa16085148d2e
- SHA512 795d7c2b7f11e80f290269d8b11e7803ad99fff6b09771efb5f04c016d7f7c15f0f9c3e8a8bbf135c6c21d08aeb6eefc6453da12c047dd26543eb7af473fc87e
- SSDEEP 3072:wqqhYLNaC3gxS4hriMkDxPTe8dlmPAJCissBaPwqWCRzFh6vyxgvdMGnl1eQeNSB:Zvq4AvfWQK+DU/Sa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
- Size 1.0MB
- SHA256 97e6f3fc1a9163f10b6502509d55bf75ee893967fb35f318954797e8ab4d4d9c
- MD5 4d92f518527353c0db88a70fddcfd390
- SHA1 c4baffc19e7d1f0e0ebf73bab86a491c1d152f98
- SHA512 05a8136ccc45ef73cd5c70ee0ef204d9d2b48b950e938494b6d1a61dfba37527c9600382321d1c031dc74e4cf3e16f001ae0f8cd64d76d765f5509ce8dc76452
- SSDEEP 12288:JeGuphfCWQIbDUhUOvF7CehnLQie+I7XHgZQKhJgeCmyDLFSLfmLU7k/:JeGefCnE7Oduehsi0LHgZpJEdDZSx7k/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi
- Size 635KB
- SHA256 6f335f0ef7d6b6311991b3ff378e125943229107bd5f7c2ab6201041014101dc
- MD5 209047ad940cb98c4b6c8d5658c7b075
- SHA1 0efc798ce7411c7ffdde7395536b02accd81e302
- SHA512 2c0f8361d7407d99ba78430221a7b197585e1d45d1da3f72d6b2bc8e75a1223a59d6e045061d1196a6a4580bc193ebf523ec2b3a72438f0cc16b32c677019a1c
- SSDEEP 12288:GGpswznMosyIa3FZjiazH1BpQc2Yf4U4oXMf6p2XH:GGOw7MAFZjiaZBuc2g4jocf6p2XH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml
- Size 819B
- SHA256 d46504821c27f089c0169466c217ce33a60991c3a425b29f252872e537f39110
- MD5 d9c76865ac14353eaf4c95c1fdb2eb4d
- SHA1 0b1c95848014359e848914b7d4d9bc8253f2ef65
- SHA512 8e3c54449ca39e77890f6342836c7aa92a30be58ebeba9492b2a89f1b03ee65990d7cfb5554a7c715a8f0526156fd51e70fee35f431357dce6b47514b29f6ec6
- MD5 SHA1 SHA512
- Path C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml
- Size 2KB
- SHA256 ce857d74eb023b39beabb1c5192937d937092f87fb3e21a1ba03273263ea9c70
- MD5 39dced46589f90350a26f7524f978e72
- SHA1 ee164197c4084e46eb81c471fa17c01cf65060ea
- SHA512 b358b89afcfd02483db481edd7d60fc6df958b596147f3bb8d9f03b4a425e09605a0779b146f0bcdfeec719718a225767aaaffac1ec09c09cfb7cee8514160f2
- MD5 SHA1 SHA512
- Path C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\boot.sdi
- Size 3.0MB
- SHA256 cd2c00ce027687ce4a8bdc967f26a8ab82f651c9becd703658ba282ec49702bd
- MD5 22d9945b4aae36dd59620a918f2e65f4
- SHA1 bb025cedca07887916c4b7e5fa7a641ed3e30c14
- SHA512 dd2d0ea7d5cf98064838ce0b74711f77534e1a2a14c7f74d44ed4b83acdb6f413d74671d2c6a8574aee88afb456b53a6b8452419a3bdddf2f7e9095c9d1d272e
- SSDEEP 3072:S/pcj53vs/InbrTIHvPnHmC5irUuMo/+ncoZZihnh:acRn7y/EouH/cpi
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Setup000009c8\OSETUPUI.DLL
- Size 187KB
- SHA256 12babd301ab2f5a0cd35226d4939e1e200d5fcf90694a25690df7ad0ea28b55a
- MD5 196a884e700b7eb09b2cd0a48eccbc3a
- SHA1 a400c341adaf960022fe4f97ab477e0ab1e02a96
- SHA512 b9f0229e3ed822b79ab2ffa41b67343215bde419a44c638422734f75191f2359bcfeb3553189e17a89b5edfa25016484ec78df48eb05049c72b1d393dd3f4041
- SSDEEP 3072:E/uPtI2nuI1XBW4dl4Y4/4Z4UZ4Y14z4m4sr4iC4w4+J4P4U414/jb364g4t4U4F:EshnuI1JjxQpscjb3XS
- MD5 SHA1 SHA512 SSDEEP