edf98c8d92926d258cf70c2348ab4c68d31b377cd273b0686f12e3545089030b

Analysis

max time kernel
140s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d07b89cd606bf2379ecc25fd4a4667e.exe
Size

96KB
MD5

9d07b89cd606bf2379ecc25fd4a4667e
SHA1

24683738ef9c5d7cff30c17ec6df6575a62859d7
SHA256

7260452e6bd05725074ba92b9dc8734aec12bbf4bbaacd43eea9c8bbe591be27
SHA512

6cd84cfa1b43cf32035ea31cef4e42222f9c72fa9a0a3806f08beaa166cbd1cf7fa883cabc136d4831c7e57588a753570e1112d55888ff7fd05d1d852b0b82cd
SSDEEP

1536:5B6sO7n0oShAiUIauVEe/DbplvRB2GuxaOLcb1AWRxmY:55oB0LAuVzDbpnCcBA8o

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\3D Objects\# How to Decrypt Files.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; line-height: 1.2; } h2 { color: #555; text-align: center; line-height: 1.2; } ol li { padding-bottom: 13pt; } .container { background-color: white; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { border: 1px solid #888; background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text { text-align: justify; } .lsb{ display: none; margin: 3%; text-align: center; } .ls { cursor: pointer; border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 0.2em 0.1em; line-height: 2em; display: inline-block; } .ls:hover { background-color: #D0D0D0; } .l { display: none; } .lu { display: none; } #change_language { float: right; display: none; } </style> <script language="javascript"> function aIndexOf(arr, v) { for (var i = 0; i < arr.length; i++) if (arr[i] == v) return i; return -1; } function tweakClass(cl, f) { var els; if (document.getElementByClassName != null) { els = document.getElementsByClassName(cl); } else { els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++) { var c = tmp[i].className; if ((c == cl) || ((c.indexOf(cl) != 1) && ((' ' + c + ' ').indexOf(' ' + cl + ' ') != -1))) els.push(tmp[i]); } } for (var i = 0; i < els.length; i++) f(els[i]); } function show(el) { el.style.display = 'block'; } function hide(el) { el.style.display = 'none'; } function onPageLoaded() { try { tweakClass('lsb', show); } catch (e) {} try { tweakClass('lu-orig', show); } catch (e) {} try { setLang('en'); } catch (e) {} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> </div> <div class='container'> <div class="text l l-en" style='display:block'> <div> <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAL8AAAEICAMAAAA5jNVNAAAAeFBMVEX///8AAAD8/PxQUFCJiYk0NDSenp5TU1M9PT329vb6+vrv7+/z8/Pl5eXKyspfX18oKCjCwsKPj4/o6Oivr699fX1xcXGioqLa2tq7u7uTk5PS0tI6OjogICCCgoJoaGh1dXUXFxeqqqpHR0cODg4cHBxaWlotLS1/4KDGAAAHlUlEQVR4nO2daVciPRCFaRpkRzYXXNCGUf7/P3zldUZn6O6bSmrDc3I/a/IASaVSqVQ6HQWt55v97rpcLIo/el4cXnr77eNYoztBjZZ3L78KpPJqO/WmbNZks8PoX6p226437ZnuV0ca+9fvsB95M39ptqri4D91vfUGP6m7GabAf+rBey5MVunw/+t17Ug/e2XSu36CyY0A/Uk7j6ncvRKiP2lvjj9fhKkiVN6b0k9vRelPujLEX1bi+EUxMJvHPQX6k+Ym9OtSCd9mDD2+qeEXxa26X7dVpP9QqexQ3OniF8Vhpon/oI1fFH3FD2CAr/kBTPD1PoCkwwM1nGjgb6zwP6yQghmd2+EXxYs4/qyy5C9Wwvjjgyl+UQjv7eX95ZBENwSGc/ePDoKxxvv47qvypne1Xc5n6/lye9W7KavYFnZi+N1Ij7nsbdfTMxPYna43u7hI0VKKP2rhetlMWq33eH03oLe0EFrGIkZPuQn6v7OHitraqwz/O7k/ms3obqixC5ENJXXH8hrhdm1om7gnARs0pX1Zgzh73aXFTR/4/LSO4pfLGckYsV3pGaWX9yRLsSO0fMvlp8RoU3/lJaHtRx4+xXamrzOE1q95/AS/jeNoEUYny4YS2ufNsEmw/QGn+fDo5xqI8DfE+AEmwQNd/gr5GOqCMQOCtl8i4BrcWyRPsGnoTPpdAL/TCR0CJq8BQc9HKMwR8lBS/eiQ48lcW74UmsOJwYhQszdC+MHA5DHtfDU0ewU32IERlLTCj59wo5IRmkBwL8mEBgzzQRC/07nGnaUcTQbWXqnJ+6nAXEtYZ0bY+DP9wpqwo3iIt9SB4SP79Qdd6Xg3Cw+fUhg/NAOit0gjbH3EYmNfwiYoegDh3/NZHD+0BsQOILwkahz04yhlbI/Y99E4YMNbsUh7J9oYUXgGx31leDZtVPjxRibOXcEpPjr5dlPYZ5y3C8P0OsMnMICiYrl4+GtlC+LklhgfDg9/rUQ17MTFTDq4dekr4Xe6cAmLmQAvqKGeFj/2uYb0CYDPLPTS3rEFpa8Aa6F2YoX7pcf6YOBnoZcjOH5GHdPDKHD6so9EgOAujJ5UA5vRTDKFPuiCuuyP+qgZzSxffKJEnXh49dW8bIBdIOo3B/deleYdOjyBqSMXmmGZmHmb4MJJXYGh86y3+ga7HhAtNzxQ0M1xhy5oRZt6OF1J99IcjprRktNHcBKp5ocHDBAt6OdnPj++O9g3beMEtxFvuleQuzArheYBwUUwIRIcJWhAaSmJ0AZoem8nQQNKCxxA71PX/Afiln3S4IV5RQIZXVB4C0YyHnAIat+0xJEPygKAly/5wP+/wgsAZfHBB1/S50Zx/JTecQvaV41HMDOUEsPy5R/DX/+O0IKn+9AJHJxQrB90HxbqFUyg805ZfaAF66tfEIWrD4Ufuj9aof9vsWNPe19+GAKqb76758L8vfo/yAp3/177835NcPf19lT/B1nB7ou3s7/uwL++fGV+X2V+X2V+X2V+X2V+X2V+X2V+X2V+XzXyHwflBWrQlNXQxP80Ut7jpqlxZ9/Erx9jSBOVn3XjU1GZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31fW/N35ditZBdOW//F3Gt2NWMKxJf/krys0K6GcFUP++T+Fm4YyFybt+GtJnCLTwIy/oSOJS0tW/I0ZMAK/gBF/y+VDvhmy4W+7AXJkv0xgwr9uLRl3zTWjFvyoTje3JrgFP7xBzcz9NuDHFeN+8W4+6/Pj+9PckxF9/kAVLmbhEXX+cD1Y1ghS5w8UjDuJc/1Hm5/0wgRjFdPmJz2GR7mB4MM/puBzyvYp81OqORec6hfK/MRXAtJNqDI/8S3IdC9ImZ/4wkr6BVBlflj04lvp9QuU+Qmr10npN4Au4/tPN6DK/EHn7VPpPqgyP/El3XQPSJmf+LRfev0LZX7SSxOcQJC2/1aR+NMvUGrzU97jKF6T8dX5Se8MMe5vq++/CB4E5/7qBex/WRt4/fhD8Adg1Y7T5w++ZcE6BjCIvwWei7n0+FVnhB8sufT4YSCGcvnxW7gL5pausTl/aa3+wi4cZ3T+1VK6mP8WnBF/c+X6J/7D3Fbnp9OGGlwC+Ibn77UaJkOJZ9EN8x/O1rGDSNUXQ/6zBAiZt2QN+c9jiSI5QHb8NRPEiPp/y46/dg4p8h63Y/4P8+TXmr9+Cv+T8n+aKrBJPAZtxt8QyYooHu/P39SRgAU142+KRAuU/TXz3xralLjUasXfnETzc/zn5hwmfuFKI/5x8+MT/NcWjfhbwrg/Zv/YVsGWbUFt+FvLt7ItqA1/a/lNtgW14W8vIMy1oDb87WkcXAtqwj+uWvm5PqgJPzgE41pQ7/gt14Ka8KMsCOYu3oIfvj/A3MVb8OMTMF4YzoIfJ/HxdvEW/DiJj3eDwYAfv/9TlKwrJAb8uPY404Uw4A9lELAevzHg3x+HSH3W6xP5/rKvMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vfjp/0wXRJv7jqneJWjVdLGji/0nK/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L76DxuakMqfwNR4AAAAAElFTkSuQmCC" alt="LockLogo" /> </div> <samp># All your files has been encrypted by “KRAKEN CRYPTOR”.</samp> <samp># Read the following instructions carefully to decrypt your files.</samp> <div class="info"> -----BEGIN KRAKEN ENCRYPTED UNIQUE KEY----- ddP2Fuzd7A2cmrG9JQ6tCEmggABfT1RllAzWzCpaBd6dRi5/GEUV18fqwT//zFh9 lapvfkcBG3BprnjFL1zztJUXWVtRtOMoEE/koqT3hOFA0Ty6de4Y0ujg7svEN/g/ 7iolJ0CsHfUEqM6NHmymQFjYn1CZYkokx2HwPYE98ufDiEnkh4JzWAH0a6ukSjt4 G0LpTmX4QHVgS6m9fWDjdizkd5annWivThjC/WJ96Cc3Zrv4M/mwxnpc83SAJEId /BkHwmxOg0HGE5QaGnSMnr+2mOWy0R3erKbPeEpGPw7Uz3zWICJvS5ui4FcCj2J9 DfVAlt59O5XMJ5BMmFElmJVjxOg66pgBiqtZLWsCF5psgyq49Ml+FaLL72US5kDZ NE0ZhsoqcoO2pI+zA4TeGkK4qOL+iKUdUbZOgk5Agugp69E0b1W20QplykDWS6nW hKQKL6m+3eMu92dzbhQd8E6n7xo7N/FRRE9PYJPwA5Ivq7XGccf0LajbsD7q1Let J9dG3qGvSZjXZ4rXp1O7k+RLZ5J2ss1GE1ouW2qNsb3Be0vY4DqNgBqyeIRe9uMm k0g/kd0FIFw/GiUBBnZCbqb2snjASady35ZpYK6snlhV6nq24UUURuZnnqsP9jL5 cgdUXzHBMm5MY2KKbwQxCkNWUgTV9rySvMfZ5E/Xb4a+jBhqxPH5hoCslLnuNKks wU/9mURDwjFz5ISGfpxcL360c4pO9Zno9USu1dWCbdPs -----END KRAKEN ENCRYPTED UNIQUE KEY----- </div> What happened to my computer? <hr> All of your files such as documents, images, videos and other files with the different names and extensions are encrypted by “KRAKEN CRYPTOR”! The speed, power and complexity of this encryption have been high and if you are now viewing this guide. It means that “KRAKEN CRYPTOR” immediately removed form your system! No way to recovery your files without “KRAKEN DECRYPTOR” software and your computer “UNIQUE KEY”! You need to buy it from us because only we can help you! What the mean is encryption? <hr> In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it. And those who are not authorized cannot. How can recovery my files? <hr> We guarantee that you can recover all your files soon safely. You can decrypt one of your encrypted smaller file for free in the first contact with us. For the decryption service, we also need your “KRAKEN ENCRYPTED UNIQUE KEY” you can see this in the top! Are you want to decrypt all of your encrypted files? If yes! You need to pay for decryption service to us! After your payment made, all of your encrypted files has been decrypted. How much is need to pay? <hr> You need to pay (0.125 BTC), payment only can made as Bitcoins. This links help you to understand whats is a Bitcoins and how it work. <a href="https://wikipedia.org/wiki/Bitcoin">https://en.wikipedia.org/wiki/Bitcoin</a> Note: This price is for the contact with us in first week otherwise it will increase. Where can buy Bitcoins? <hr> The easiest way to buy Bitcoins is LocalBitcoins website. You must register on this site and click “BUY Bitcoins” then choose your country to find sellers and their prices. <a href="https://localBitcoins.com/buy_Bitcoins">https://localBitcoins.com/buy_Bitcoins</a> Other places to buy Bitcoins in exchange for other currencies worldwide: <a href="https://www.bestbitcoinexchange.io/">https://www.bestbitcoinexchange.io</a> How to contact you? <hr> We use best and easy way to communications. It's email support, you can see our emails below. Please send your message with same subject to both address. E-Mail <div class="info"> [email protected] </div> Alternative <div class="info"> [email protected] </div> Attention <hr> <ul type="disc"> <li>DON'T MODIFY OR RENAME ENCRYPTED FILES!</li> <li>DON'T MODIFY “KRAKEN ENCRYPT UNIQUE KEY”!</li> <li>DON'T USE THIRD PARTY, PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY!</li> <li>DON'T ASK PEOPLE OR DATA RECOVERY CENTERS, THEY ARE MAY ADD EXTRA CHARGE!</li> </ul> Additional <hr> <ul type="square"> <li>Project “KRAKEN CRYPTOR” doesn't damage any of your files, this action is reversible if you follow the instructions above.</li> <li>Also, our policy is obvious: “NO PAYMENT, NO DECRYPT”.</li> </ul> </div> </div> </body> </html>

Emails

[email protected]

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9d07b89cd606bf2379ecc25fd4a4667e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	9d07b89cd606bf2379ecc25fd4a4667e.exe

Executes dropped EXE 3 IoCs

Processes:

sdelete.exesdelete.exesdelete.exe

pid process

4568 sdelete.exe
3748 sdelete.exe
4496 sdelete.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ipinfo.io
9 ipinfo.io

pid	process
4568	sdelete.exe
3748	sdelete.exe
4496	sdelete.exe

flow	ioc
8	ipinfo.io
9	ipinfo.io

Drops file in Program Files directory 2 IoCs

Processes:

9d07b89cd606bf2379ecc25fd4a4667e.exe

description	ioc	process
File created	C:\Program Files\Touch	9d07b89cd606bf2379ecc25fd4a4667e.exe
File created	C:\Program Files (x86)\Touch	9d07b89cd606bf2379ecc25fd4a4667e.exe

Drops file in Windows directory 1 IoCs

Processes:

9d07b89cd606bf2379ecc25fd4a4667e.exe

description ioc process

File created C:\Windows\Touch 9d07b89cd606bf2379ecc25fd4a4667e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

1436 tasklist.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1676 PING.EXE

description	ioc	process
File created	C:\Windows\Touch	9d07b89cd606bf2379ecc25fd4a4667e.exe

pid	process
1436	tasklist.exe

pid	process
1676	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

9d07b89cd606bf2379ecc25fd4a4667e.exetasklist.exe

pid	process
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
1436	tasklist.exe
1436	tasklist.exe
1128	9d07b89cd606bf2379ecc25fd4a4667e.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

9d07b89cd606bf2379ecc25fd4a4667e.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
Token: SeIncBasePriorityPrivilege	1128	9d07b89cd606bf2379ecc25fd4a4667e.exe
Token: SeDebugPrivilege	1436	tasklist.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

9d07b89cd606bf2379ecc25fd4a4667e.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1128 wrote to memory of 1436	1128	9d07b89cd606bf2379ecc25fd4a4667e.exe	tasklist.exe
PID 1128 wrote to memory of 1436	1128	9d07b89cd606bf2379ecc25fd4a4667e.exe	tasklist.exe
PID 1128 wrote to memory of 1436	1128	9d07b89cd606bf2379ecc25fd4a4667e.exe	tasklist.exe
PID 1128 wrote to memory of 1780	1128	9d07b89cd606bf2379ecc25fd4a4667e.exe	cmd.exe
PID 1128 wrote to memory of 1780	1128	9d07b89cd606bf2379ecc25fd4a4667e.exe	cmd.exe
PID 1128 wrote to memory of 1780	1128	9d07b89cd606bf2379ecc25fd4a4667e.exe	cmd.exe
PID 1128 wrote to memory of 1652	1128	9d07b89cd606bf2379ecc25fd4a4667e.exe	cmd.exe
PID 1128 wrote to memory of 1652	1128	9d07b89cd606bf2379ecc25fd4a4667e.exe	cmd.exe
PID 1128 wrote to memory of 1652	1128	9d07b89cd606bf2379ecc25fd4a4667e.exe	cmd.exe
PID 1652 wrote to memory of 1676	1652	cmd.exe	PING.EXE
PID 1652 wrote to memory of 1676	1652	cmd.exe	PING.EXE
PID 1652 wrote to memory of 1676	1652	cmd.exe	PING.EXE
PID 1780 wrote to memory of 2536	1780	cmd.exe	reg.exe
PID 1780 wrote to memory of 2536	1780	cmd.exe	reg.exe
PID 1780 wrote to memory of 2536	1780	cmd.exe	reg.exe
PID 1780 wrote to memory of 3284	1780	cmd.exe	reg.exe
PID 1780 wrote to memory of 3284	1780	cmd.exe	reg.exe
PID 1780 wrote to memory of 3284	1780	cmd.exe	reg.exe
PID 1780 wrote to memory of 1016	1780	cmd.exe	cmd.exe
PID 1780 wrote to memory of 1016	1780	cmd.exe	cmd.exe
PID 1780 wrote to memory of 1016	1780	cmd.exe	cmd.exe
PID 1016 wrote to memory of 4568	1016	cmd.exe	sdelete.exe
PID 1016 wrote to memory of 4568	1016	cmd.exe	sdelete.exe
PID 1780 wrote to memory of 2468	1780	cmd.exe	cmd.exe
PID 1780 wrote to memory of 2468	1780	cmd.exe	cmd.exe
PID 1780 wrote to memory of 2468	1780	cmd.exe	cmd.exe
PID 2468 wrote to memory of 3748	2468	cmd.exe	sdelete.exe
PID 2468 wrote to memory of 3748	2468	cmd.exe	sdelete.exe
PID 1780 wrote to memory of 116	1780	cmd.exe	cmd.exe
PID 1780 wrote to memory of 116	1780	cmd.exe	cmd.exe
PID 1780 wrote to memory of 116	1780	cmd.exe	cmd.exe
PID 116 wrote to memory of 4496	116	cmd.exe	sdelete.exe
PID 116 wrote to memory of 4496	116	cmd.exe	sdelete.exe

C:\Users\Admin\AppData\Local\Temp\9d07b89cd606bf2379ecc25fd4a4667e.exe
"C:\Users\Admin\AppData\Local\Temp\9d07b89cd606bf2379ecc25fd4a4667e.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\tasklist.exe
"tasklist" /V /FO CSV
2⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C cd C:\ProgramData\ && release.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"
3⤵
PID:2536

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v EulaAccepted /t REG_DWORD /d 1 /f
3⤵
PID:3284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\ProgramData\sdelete.exe -c -z C:
3⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\ProgramData\sdelete.exe
C:\ProgramData\sdelete.exe -c -z C:
4⤵
- Executes dropped EXE
PID:4568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\ProgramData\sdelete.exe -z D:
3⤵
- Suspicious use of WriteProcessMemory
PID:2468

C:\ProgramData\sdelete.exe
C:\ProgramData\sdelete.exe -z D:
4⤵
- Executes dropped EXE
PID:3748

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\ProgramData\sdelete.exe -z F:
3⤵
- Suspicious use of WriteProcessMemory
PID:116

C:\ProgramData\sdelete.exe
C:\ProgramData\sdelete.exe -z F:
4⤵
- Executes dropped EXE
PID:4496

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S "C:\Users\Admin\AppData\Local\Temp\9d07b89cd606bf2379ecc25fd4a4667e.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
3⤵
- Runs ping.exe
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\release.bat
Filesize
875B

MD5
c01df9dddd89e6a3be6be7d83f73eb3f

SHA1
18f610d8b1653bfcb35ce34508529f0224bdccea

SHA256
b237074769c6a797f39ba5c89c0364793a8111ac8e9bf5907e86765d1f0931f5

SHA512
d35e461d1c77ab2fd2c3a7d4e726ea38941d339a9685d222e5161960b8277c068f986e9c001e3f86d473bd14638578bf7d22eb3f45670f20704ddc46c3488c8b

Download Submit
C:\ProgramData\sdelete.exe
Filesize
218KB

MD5
6a4e049d8c497d350a7bd54dfff99808

SHA1
7f1d32424c961542ae172c5b8c1611291c30fc4f

SHA256
59e5ae1e99c6a4ccc01e8abdc2534210ec5faa945754a89524b06381da8c20a1

SHA512
41169089fa67e1a0ff1360dc5428b89dcee0d642204ddb7dac80d6cf859caae3c2b14fa89ce72072fb780c0a93f53eb0ff9414a8e88b1d783bfa75c9c4ea353d

Download Submit
C:\Users\Admin\3D Objects\# How to Decrypt Files.html
Filesize
10KB

MD5
3aa77c7c83214fbae9eba1579c5d2fc8

SHA1
d490718bcc7aeee9fc02e778c5b7d57c578682c6

SHA256
75e70ac86b179024b376751c03495bf2f18ba79664ef5b2b7c6049bbc53c6808

SHA512
9dc4f9d9eadacccd5d4ea1e61b0ce265fb567b406fc922292b004a24c2e395b1bdeed3572ee9b965d537fb47110fdad2b7fbcd677b4baedf848702e1c067cfe7

Download Submit
memory/1128-3-0x00000000748E0000-0x0000000074E91000-memory.dmp

Filesize
5.7MB

Download
memory/1128-4-0x00000000748E0000-0x0000000074E91000-memory.dmp

Filesize
5.7MB

Download
memory/1128-5-0x00000000748E0000-0x0000000074E91000-memory.dmp

Filesize
5.7MB

Download
memory/1128-6-0x00000000748E0000-0x0000000074E91000-memory.dmp

Filesize
5.7MB

Download
memory/1128-7-0x00000000748E0000-0x0000000074E91000-memory.dmp

Filesize
5.7MB

Download
memory/1128-8-0x00000000748E0000-0x0000000074E91000-memory.dmp

Filesize
5.7MB

Download
memory/1128-0-0x00000000748E2000-0x00000000748E3000-memory.dmp

Filesize
4KB

Download
memory/1128-346-0x00000000748E0000-0x0000000074E91000-memory.dmp

Filesize
5.7MB

Download
memory/1128-2-0x00000000748E0000-0x0000000074E91000-memory.dmp

Filesize
5.7MB

Download
memory/1128-1-0x00000000748E0000-0x0000000074E91000-memory.dmp

Filesize
5.7MB

Download