mimic | 73f648f258b8863530f285747a09cdf4909198211ffc6c2df68bf0635160c983

Analysis

max time kernel
45s
max time network
46s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

worm.exe
Size

3.7MB
MD5

d3b46fbcaac57a146657238ba2b24008
SHA1

257acef818f0e80e68db8767b37633d0f12542a7
SHA256

73f648f258b8863530f285747a09cdf4909198211ffc6c2df68bf0635160c983
SHA512

a61834f7c00ff22eba698aa98c5cf0346e8c6cacce74be13fd4c1dbada5d4e1831261a79724c37f1e85a0c3981d4b2019ec89994af2f23080139f907a165769e
SSDEEP

98304:6gwRBDvguPPOPwrHIRwFHO92037ngXAjpDsbs9KMOz:6gMDvFHG92Y5jpYbvMG

Score

10^/10

mimic persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\011A427C-D9A5-B6EA-EAF5-8C674D0F8EDC\global_options.ini

Ransom Note

26=worm 27=sql;sqlite;sqlite3;sqlitedb;mdf;mdb;adb;db;db3;dbf;dbs;udb;dbv;dbx;edb;exb;1cd;fdb;idb;mpd;myd;odb;xls;xlsx;doc;docx;bac;bak;back;zip;rar;dt;4dd;4dl;abcddb;abs;abx;accdb;accdc;accde;accdr;accdt;accdw;accft;ade;adf;adn;adp;alf;arc;ask;bacpac;bdf;btr;cat;cdb;chck;ckp;cma;cpd;dacpac;dad;dadiagrams;daschema;db-shm;db-wal;db2;dbc;dbt;dcb;dct;dcx;ddl;dlis;dp1;dqy;dsk;dsn;dtsx;dxl;eco;ecx;epim;fcd;fic;fm5;fmp;fmp12;fmpsl;fol;fp3;fp4;fp5;fp7;fpt;frm;gdb;grdb;gwi;hdb;his;hjt;ib;icg;icr;ihx;itdb;itw;jet;jtx;kdb;kexi;kexic;kexis;lgc;lut;lwx;maf;maq;mar;mas;mav;maw;mdn;mdt;mrg;mud;mwb;ndf;nnt;nrmlib;ns2;ns3;ns4;nsf;nv;nv2;nwdb;nyf;oqy;ora;orx;owc;p96;p97;pan;pdb;pdm;pnz;qry;qvd;rbf;rctd;rod;rodx;rpd;rsd;s2db;sas7bdat;sbf;scx;sdb;sdc;sdf;sis;sl3;spq;sqlite2;te;temx;tmd;tps;trc;trm;udl;usr;v12;vis;vpd;vvv;wdb;wmdb;wrk;xdb;xld;xmlff; 28=386;cmd;deskthemepack;diagcab;diagcfg;diagpkg;dll;info;mui;sys;theme;tmp; 29=steamapps;Cache;Boot;Chrome;Firefox;Mozilla;Mozilla Firefox;MicrosoftEdge;Internet Explorer;Tor Browser;Opera;Opera Software;Common Files;Config.Msi;Intel;Microsoft;Microsoft Shared;Microsoft.NET;MSBuild;MSOCache;Packages;PerfLogs;ProgramData;System Volume Information;tmp;Temp;USOShared;Windows;Windows Defender;Windows Journal;Windows NT;Windows Photo Viewer;Windows Security;Windows.old;WindowsApps;WindowsPowerShell;WINNT;$RECYCLE.BIN;$WINDOWS.~BT;$Windows.~WS;:\Users\Public\;:\Users\Default\; 30=desktop.ini;iconcache.db;thumbs.db; 31=AcronisAgent;ARSM;backup;BackupExecAgentAccelerator;BackupExecAgentBrowser;BackupExecDiveciMediaService;BackupExecJobEngine;BackupExecManagementService;BackupExecRPCService;BackupExecVSSProvider;CAARCUpdateSvc;CASAD2DWebSvc;ccEvtMgr;ccSetMgr;Culserver;dbeng8;dbsrv12;DefWatch;FishbowlMySQL;GxBlr;GxCIMgr;GxCVD;GxFWD;GxVss;memtas;mepocs;msexchange;MSExchange$;msftesql-Exchange;msmdsrv;MSSQL;MSSQL$;MSSQL$KAV_CS_ADMIN_KIT;MSSQL$MICROSOFT##SSEE;MSSQL$MICROSOFT##WID;MSSQL$SBSMONITORING;MSSQL$SHAREPOINT;MSSQL$VEEAMSQL2012;MSSQLFDLauncher$SBSMONITORING;MSSQLFDLauncher$SHAREPOINT;MSSQLServerADHelper100;MVArmor;MVarmor64;svc$;sophos;RTVscan;MySQL57;PDVFSService;QBCFMonitorService;QBFCService;QBIDPService;QBVSS;SavRoam;SQL;SQLADHLP;sqlagent;SQLAgent$KAV_CS_ADMIN_KIT;SQLAgent$SBSMONITORING;SQLAgent$SHAREPOINT;SQLAgent$VEEAMSQL2012;sqlbrowser;Sqlservr;SQLWriter;stc_raw_agent;tomcat6;veeam;VeeamDeploymentService;VeeamNFSSvc;VeeamTransportSvc;vmware-converter;vmware-usbarbitator64;VSNAPVSS;vss;wrapper;WSBExchange;YooBackup;YooIT; 32=agntsvc;AutodeskDesktopApp;axlbridge;bedbh;benetns;bengien;beserver;CoreSync;Creative Cloud;dbeng50;dbsnmp;encsvc;EnterpriseClient;fbguard;fbserver;fdhost;fdlauncher;httpd;isqlplussvc;msaccess;MsDtSrvr;msftesql;mspub;mydesktopqos;mydesktopservice;mysqld;mysqld-nt;mysqld-opt;ocautoupds;ocomm;ocssd;oracle;pvlsvr;node;java;python;wpython;QBDBMgr;QBDBMgrN;QBIDPService;qbupdate;QBW32;QBW64;Raccine;Raccine_x86;RaccineElevatedCfg;RaccineSettings;VeeamDeploymentSvc;RAgui;raw_agent_svc;SimplyConnectionManager;sqbcoreservice;sql;sqlagent;sqlbrowser;sqlmangr;sqlservr;sqlwriter;Ssms;Sysmon;Sysmon64;tbirdconfig;tomcat6;vsnapvss;vxmon;wdswfsafe;wsa_service;wxServer;wxServerView;xfssvccon;1cv8s;1cv8;1cv8c; 33=add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AllowMultipleTSSessions" /t REG_DWORD /d 0x1 /f;reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fSingleSessionPerUser" /t REG_DWORD /d 0x0 /f; 34=1 35=2 36=0 37=0 38=0 39=1 40=1 41=1 42=1 43=1 44=1 45=1 46=1 47=0 48=1 49=1 50=1 51=0 53=1 54=0 55=1 56=1 57=1 58=1 59=1 60=1 61=1 62=1 63=Hello my dear friend (Do not scan the files with antivirus in any case. In case of data loss, the consequences are yours)\nYour data is encrypted\nYour decryption ID is ID_PLACEHOLDER\nUnfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\nIf you want to recover your files, write us to this e-mail: [email protected]\nIn case of no answer in 24 hours write us to this backup e-mail: [email protected]\nOur online operator is available in the messenger Telegram: @DataSupport911 or https://t.me/DataSupport911\nCheck your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.\nContact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly.\n\nAttention!\n\nDo not rename encrypted files. \nDo not try to decrypt your data using third party software - it may cause permanent data loss. \nWe are always ready to cooperate and find the best way to solve your problem. \nThe faster you write - the more favorable conditions will be for you. \nOur company values its reputation. We give all guarantees of your files decryption.\n\nWhat are your recommendations?\n- Never change the name of the files, if you want to manipulate the files, be sure to back them up. If there are any problems with the files, we are not responsible for them.\n- Never work with intermediary companies because they charge you more money. For example, if we ask you for 50,000$, they will tell you 55,000$. Don't be afraid of us, just email us. \n\nVery important! For those who have cyber insurance against ransomware attacks.\nInsurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations.\nThe insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount.\nFor example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars,\nwe will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars.\nHe will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for 10 million and other\nimportant details regarding insurance coverage, we would not demand more than 10 million in correspondence with the insurance agent. That way you would have avoided a leak and decrypted your information.\nBut since the sneaky insurance agent purposely negotiates so as not to pay for the insurance claim, only the insurance company wins in this situation. To avoid all this and get the money on the insurance,\nbe sure to inform us anonymously about the availability and terms of insurance coverage, it benefits both you and us, but it does not benefit the insurance company. Poor multimillionaire insurers will not\nstarve and will not become poorer from the payment of the maximum amount specified in the contract, because everyone knows that the contract is more expensive than money, so let them fulfill the conditions\nprescribed in your insurance contract, thanks to our interaction. 66=1

Emails

[email protected]\nIn

[email protected]\nOur

URLs

https://t.me/DataSupport911\nCheck

Signatures

Detects Mimic ransomware 2 IoCs

resource	yara_rule
behavioral1/files/0x0006000000016c5e-37.dat	family_mimic
behavioral1/files/0x0006000000016851-48.dat	family_mimic

Mimic
Ransomware family was first exploited in the wild in 2022.
ransomware mimic

Deletes itself 1 IoCs

pid	Process
2036	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
2692	7za.exe
2560	7za.exe
2436	worm.exe
1484	HORSE.exe
1572	gui40.exe
500	Everything.exe

Loads dropped DLL 8 IoCs

pid	Process
2696	worm.exe
2696	worm.exe
2696	worm.exe
2436	worm.exe
2436	worm.exe
1484	HORSE.exe
1484	HORSE.exe
1484	HORSE.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	HORSE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	worm.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command	HORSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command	worm.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell	worm.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open	worm.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	HORSE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	HORSE.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	worm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	worm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HORSE = "\"C:\\Users\\Admin\\AppData\\Local\\011A427C-D9A5-B6EA-EAF5-8C674D0F8EDC\\HORSE.exe\" "	worm.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	worm.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile	worm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	worm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	HORSE.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command	HORSE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	HORSE.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	worm.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open\command	worm.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell	worm.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\exefile\shell\open	worm.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	HORSE.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1484	HORSE.exe
1484	HORSE.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1572	gui40.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeRestorePrivilege	2692	7za.exe
Token: 35	2692	7za.exe
Token: SeRestorePrivilege	2560	7za.exe
Token: 35	2560	7za.exe
Token: SeSecurityPrivilege	2560	7za.exe
Token: SeSecurityPrivilege	2560	7za.exe
Token: SeIncreaseQuotaPrivilege	2436	worm.exe
Token: SeSecurityPrivilege	2436	worm.exe
Token: SeTakeOwnershipPrivilege	2436	worm.exe
Token: SeLoadDriverPrivilege	2436	worm.exe
Token: SeSystemProfilePrivilege	2436	worm.exe
Token: SeSystemtimePrivilege	2436	worm.exe
Token: SeProfSingleProcessPrivilege	2436	worm.exe
Token: SeIncBasePriorityPrivilege	2436	worm.exe
Token: SeCreatePagefilePrivilege	2436	worm.exe
Token: SeBackupPrivilege	2436	worm.exe
Token: SeRestorePrivilege	2436	worm.exe
Token: SeShutdownPrivilege	2436	worm.exe
Token: SeDebugPrivilege	2436	worm.exe
Token: SeSystemEnvironmentPrivilege	2436	worm.exe
Token: SeChangeNotifyPrivilege	2436	worm.exe
Token: SeRemoteShutdownPrivilege	2436	worm.exe
Token: SeUndockPrivilege	2436	worm.exe
Token: SeManageVolumePrivilege	2436	worm.exe
Token: SeImpersonatePrivilege	2436	worm.exe
Token: SeCreateGlobalPrivilege	2436	worm.exe
Token: 33	2436	worm.exe
Token: 34	2436	worm.exe
Token: 35	2436	worm.exe
Token: SeIncreaseQuotaPrivilege	1484	HORSE.exe
Token: SeSecurityPrivilege	1484	HORSE.exe
Token: SeTakeOwnershipPrivilege	1484	HORSE.exe
Token: SeLoadDriverPrivilege	1484	HORSE.exe
Token: SeSystemProfilePrivilege	1484	HORSE.exe
Token: SeSystemtimePrivilege	1484	HORSE.exe
Token: SeProfSingleProcessPrivilege	1484	HORSE.exe
Token: SeIncBasePriorityPrivilege	1484	HORSE.exe
Token: SeCreatePagefilePrivilege	1484	HORSE.exe
Token: SeBackupPrivilege	1484	HORSE.exe
Token: SeRestorePrivilege	1484	HORSE.exe
Token: SeShutdownPrivilege	1484	HORSE.exe
Token: SeDebugPrivilege	1484	HORSE.exe
Token: SeSystemEnvironmentPrivilege	1484	HORSE.exe
Token: SeChangeNotifyPrivilege	1484	HORSE.exe
Token: SeRemoteShutdownPrivilege	1484	HORSE.exe
Token: SeUndockPrivilege	1484	HORSE.exe
Token: SeManageVolumePrivilege	1484	HORSE.exe
Token: SeImpersonatePrivilege	1484	HORSE.exe
Token: SeCreateGlobalPrivilege	1484	HORSE.exe
Token: 33	1484	HORSE.exe
Token: 34	1484	HORSE.exe
Token: 35	1484	HORSE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1572	gui40.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
500	Everything.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2692	2696	worm.exe	28
PID 2696 wrote to memory of 2692	2696	worm.exe	28
PID 2696 wrote to memory of 2692	2696	worm.exe	28
PID 2696 wrote to memory of 2692	2696	worm.exe	28
PID 2696 wrote to memory of 2560	2696	worm.exe	30
PID 2696 wrote to memory of 2560	2696	worm.exe	30
PID 2696 wrote to memory of 2560	2696	worm.exe	30
PID 2696 wrote to memory of 2560	2696	worm.exe	30
PID 2696 wrote to memory of 2436	2696	worm.exe	32
PID 2696 wrote to memory of 2436	2696	worm.exe	32
PID 2696 wrote to memory of 2436	2696	worm.exe	32
PID 2696 wrote to memory of 2436	2696	worm.exe	32
PID 2436 wrote to memory of 1484	2436	worm.exe	34
PID 2436 wrote to memory of 1484	2436	worm.exe	34
PID 2436 wrote to memory of 1484	2436	worm.exe	34
PID 2436 wrote to memory of 1484	2436	worm.exe	34
PID 1484 wrote to memory of 1572	1484	HORSE.exe	36
PID 1484 wrote to memory of 1572	1484	HORSE.exe	36
PID 1484 wrote to memory of 1572	1484	HORSE.exe	36
PID 1484 wrote to memory of 1572	1484	HORSE.exe	36
PID 1484 wrote to memory of 500	1484	HORSE.exe	37
PID 1484 wrote to memory of 500	1484	HORSE.exe	37
PID 1484 wrote to memory of 500	1484	HORSE.exe	37
PID 1484 wrote to memory of 500	1484	HORSE.exe	37
PID 2696 wrote to memory of 2036	2696	worm.exe	38
PID 2696 wrote to memory of 2036	2696	worm.exe	38
PID 2696 wrote to memory of 2036	2696	worm.exe	38
PID 2696 wrote to memory of 2036	2696	worm.exe	38

C:\Users\Admin\AppData\Local\Temp\worm.exe
"C:\Users\Admin\AppData\Local\Temp\worm.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p1226110605697417788 Everything64.dll
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\worm.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\worm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Users\Admin\AppData\Local\011A427C-D9A5-B6EA-EAF5-8C674D0F8EDC\HORSE.exe
    "C:\Users\Admin\AppData\Local\011A427C-D9A5-B6EA-EAF5-8C674D0F8EDC\HORSE.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Users\Admin\AppData\Local\011A427C-D9A5-B6EA-EAF5-8C674D0F8EDC\gui40.exe
      C:\Users\Admin\AppData\Local\011A427C-D9A5-B6EA-EAF5-8C674D0F8EDC\gui40.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      PID:1572
  - - C:\Users\Admin\AppData\Local\011A427C-D9A5-B6EA-EAF5-8C674D0F8EDC\Everything.exe
      "C:\Users\Admin\AppData\Local\011A427C-D9A5-B6EA-EAF5-8C674D0F8EDC\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Deletes itself
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\011A427C-D9A5-B6EA-EAF5-8C674D0F8EDC\global_options.ini

Filesize
14KB

MD5
d43977474081cc3f8ad583428418f856

SHA1
a98e6f51ba7ff54dceaeafe01ed671594a74be43

SHA256
2f9667eca694082d78acfe7586b3ec7037cb7ca421a83a605689638a3512b20c

SHA512
186d081fa85316e5c27f6c2221649c5398b354465d89188fa760a604876af55707008c211c265f959b1837f40e3d87f2ff34258ea093a53ce9404c9404171822

Download Submit
C:\Users\Admin\AppData\Local\011A427C-D9A5-B6EA-EAF5-8C674D0F8EDC\global_options.ini

Filesize
14KB

MD5
8b1e7d908f21390cc40a359b84af950a

SHA1
5cf0465a5c3b7a554c89a70a1e2fc593600e45e3

SHA256
4a25903dcda983521f3795b184a307394d208a5bdb8b9ab8d01bc07321511d24

SHA512
df79cda2106e4e62a6c203e8bb6191b2afbd91ae1c687a92adc80df0a0ecc2e8860843f9acf42d117387184d3edb6cbee5b1cc385f9a58a3ae523fd0a9d43e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
180B

MD5
b5a4331feddc6e2c04c9f474fc495dc0

SHA1
7fc63d53cfc4fe0f37ff7fc86fb048fdeb435c28

SHA256
f2cd91cd439f81ac6d3fd996987cb804da8968aa73d4a48497ed920af566ebd3

SHA512
535922ffe9dde4ffd950f7141ece3bf0f301d8236269b2d0618ac00738b8116a3e046b02a3d7a63e47a22f3878a97b5cf566045e2f8f7de4dd2bebd9438fd96f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\[email protected]

Filesize
2.4MB

MD5
0bf7c0d8e3e02a6b879efab5deab013c

SHA1
4f93d2cda84e669eeddcfeb2e2fa2319901059a1

SHA256
b600e06f14e29b03f0b1456723a430b5024816518d704a831dde2dc9597ce9c9

SHA512
313f9a8ae5a0096488996f51ce0d2049f7040b5cba1f6efd6e7190517accffad9af4d72eb551755978e624f4089b9e5983eae792496b2e8e6da5a6cd7939ae5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe

Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini

Filesize
548B

MD5
742c2400f2de964d0cce4a8dabadd708

SHA1
c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

SHA256
2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

SHA512
63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini

Filesize
550B

MD5
51014c0c06acdd80f9ae4469e7d30a9e

SHA1
204e6a57c44242fad874377851b13099dfe60176

SHA256
89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

SHA512
79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll

Filesize
2.5MB

MD5
33d24c17bf1b9217ed2118e2a5311b1e

SHA1
fd3bfc858b35f987a32ad7b31927153145e72c9c

SHA256
e22cca265ff8b89d898e9c3986291599c37e89f8358833e7f268638bc982c272

SHA512
b92587931dcbb6a6e50b87fab8dbbf0d09c6744ed0a412b3d62fbebd7b5fe5eb56e48b001ef7ea917be43a98c53674cf72b9481c5707ed54887da6cfc7260e0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\global_options.ini

Filesize
10B

MD5
26f59bb93f02d5a65538981bbc2da9cc

SHA1
5e99a311784301637638c02401925a89694f463d

SHA256
14f93a82d99cd2bf3da0aba73b162a7bb183eded695cffff47a05c1290d2a2fa

SHA512
e48f20a62bb2d5de686a7328a682a84821c83c8c4d836287adffbe464a8b4a0ba8ca728a35438c58f142686047b153c9c3f722c0431db620e3ef3479215b9016

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\gui35.exe

Filesize
276KB

MD5
03a63c096b9757439264b57e4fdf49d1

SHA1
a5007873ce19a398274aec9f61e1f90e9b45cc81

SHA256
22ea129b0f57184f30b1771c62a3233ba92e581c1f111b4e8abfa318dc92cc46

SHA512
0d656d807572f6be4574024e2bbcf0cbd291fe13a1adeb86a333177ee38db16b06da9a18509e599db0d2cf8206b84f6856a9674dba29a2cbeb844a216cb45ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\gui40.exe

Filesize
276KB

MD5
57850a4490a6afd1ef682eb93ea45e65

SHA1
338d147711c56e8a1e75e64a075e5e2984aa0c05

SHA256
31feff32d23728b39ed813c1e7dc5fe6a87dcd4d10aa995446a8c5eb5da58615

SHA512
15cf499077e0c8f3421b95e09a18ae5468ae20a7b3a263f01cc8e6d445d54f09ca8a3189ecb40c87d0e6277c99b504424cdd0e35bbe493a1b0849900d21bccf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\worm.exe

Filesize
2.4MB

MD5
31cd2c757984f252002b8a24901a08f6

SHA1
be6f27c9ac51390ab9c91b59dc87f272267e44e3

SHA256
6665c2067ba4cfd451f15fc77d13d32a5d4132e2cf70d08398e93ebd6b83f07a

SHA512
40484d7c538b8caa135b0fb9ce5c713af60a0ea4c7fbc09165c1dcb334ea5edc02ae4b655e657d4308fc0e68875ca49b1f947fbec8ec843ade820e88aa2b4727

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\xdel.exe

Filesize
350KB

MD5
803df907d936e08fbbd06020c411be93

SHA1
4aa4b498ae037a2b0479659374a5c3af5f6b8d97

SHA256
e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

SHA512
5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe

Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll

Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
memory/1572-94-0x0000000000A40000-0x0000000000A8E000-memory.dmp

Filesize
312KB

Download
memory/1572-95-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1572-96-0x00000000004B0000-0x0000000000504000-memory.dmp

Filesize
336KB

Download
memory/1572-97-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download