edf98c8d92926d258cf70c2348ab4c68d31b377cd273b0686f12e3545089030b

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60121ea2ab380455f7e143cd9438443e.exe
Size

98KB
MD5

60121ea2ab380455f7e143cd9438443e
SHA1

091fd74c5caebd9f53c34781ad6b0241883fe698
SHA256

b8f7c90cd170ba8c79c472997c17509e2d241a54a9cef7efea4dac23b043afe8
SHA512

3f42a0756999d6441721f8d4663c8af677c895c4e11ddff25d7a1216b3b4a015b7d3763c0e06f616f73eb5e9df3b42e07baf8d5ec910632f3e275c8d2fd388e6
SSDEEP

1536:AnTUL9I230W6mN+ZGCHMNzKR1iFAGGR10p67LsJmFMbchiRO1mbF8VrdCKcl:skC2++p6/PMbcskdhY

Score

10^/10

evasion ransomware

Malware Config

Extracted

Path

C:\PerfLogs\# How to Decrypt Files-V5G6N.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; line-height: 1.2; } h2 { color: #555; text-align: center; line-height: 1.2; } ol li { padding-bottom: 13pt; } .container { background-color: white; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { border: 1px solid #888; background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text { text-align: justify; } .lsb{ display: none; margin: 3%; text-align: center; } .ls { cursor: pointer; border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 0.2em 0.1em; line-height: 2em; display: inline-block; } .ls:hover { background-color: #D0D0D0; } .l { display: none; } .lu { display: none; } #change_language { float: right; display: none; } </style> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> </div> <div class='container'> <div class="text l l-en" style='display:block'> <div> <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAL8AAAEICAMAAAA5jNVNAAAAeFBMVEX///8AAAD8/PxQUFCJiYk0NDSenp5TU1M9PT329vb6+vrv7+/z8/Pl5eXKyspfX18oKCjCwsKPj4/o6Oivr699fX1xcXGioqLa2tq7u7uTk5PS0tI6OjogICCCgoJoaGh1dXUXFxeqqqpHR0cODg4cHBxaWlotLS1/4KDGAAAHlUlEQVR4nO2daVciPRCFaRpkRzYXXNCGUf7/P3zldUZn6O6bSmrDc3I/a/IASaVSqVQ6HQWt55v97rpcLIo/el4cXnr77eNYoztBjZZ3L78KpPJqO/WmbNZks8PoX6p226437ZnuV0ca+9fvsB95M39ptqri4D91vfUGP6m7GabAf+rBey5MVunw/+t17Ug/e2XSu36CyY0A/Uk7j6ncvRKiP2lvjj9fhKkiVN6b0k9vRelPujLEX1bi+EUxMJvHPQX6k+Ym9OtSCd9mDD2+qeEXxa26X7dVpP9QqexQ3OniF8Vhpon/oI1fFH3FD2CAr/kBTPD1PoCkwwM1nGjgb6zwP6yQghmd2+EXxYs4/qyy5C9Wwvjjgyl+UQjv7eX95ZBENwSGc/ePDoKxxvv47qvypne1Xc5n6/lye9W7KavYFnZi+N1Ij7nsbdfTMxPYna43u7hI0VKKP2rhetlMWq33eH03oLe0EFrGIkZPuQn6v7OHitraqwz/O7k/ms3obqixC5ENJXXH8hrhdm1om7gnARs0pX1Zgzh73aXFTR/4/LSO4pfLGckYsV3pGaWX9yRLsSO0fMvlp8RoU3/lJaHtRx4+xXamrzOE1q95/AS/jeNoEUYny4YS2ufNsEmw/QGn+fDo5xqI8DfE+AEmwQNd/gr5GOqCMQOCtl8i4BrcWyRPsGnoTPpdAL/TCR0CJq8BQc9HKMwR8lBS/eiQ48lcW74UmsOJwYhQszdC+MHA5DHtfDU0ewU32IERlLTCj59wo5IRmkBwL8mEBgzzQRC/07nGnaUcTQbWXqnJ+6nAXEtYZ0bY+DP9wpqwo3iIt9SB4SP79Qdd6Xg3Cw+fUhg/NAOit0gjbH3EYmNfwiYoegDh3/NZHD+0BsQOILwkahz04yhlbI/Y99E4YMNbsUh7J9oYUXgGx31leDZtVPjxRibOXcEpPjr5dlPYZ5y3C8P0OsMnMICiYrl4+GtlC+LklhgfDg9/rUQ17MTFTDq4dekr4Xe6cAmLmQAvqKGeFj/2uYb0CYDPLPTS3rEFpa8Aa6F2YoX7pcf6YOBnoZcjOH5GHdPDKHD6so9EgOAujJ5UA5vRTDKFPuiCuuyP+qgZzSxffKJEnXh49dW8bIBdIOo3B/deleYdOjyBqSMXmmGZmHmb4MJJXYGh86y3+ga7HhAtNzxQ0M1xhy5oRZt6OF1J99IcjprRktNHcBKp5ocHDBAt6OdnPj++O9g3beMEtxFvuleQuzArheYBwUUwIRIcJWhAaSmJ0AZoem8nQQNKCxxA71PX/Afiln3S4IV5RQIZXVB4C0YyHnAIat+0xJEPygKAly/5wP+/wgsAZfHBB1/S50Zx/JTecQvaV41HMDOUEsPy5R/DX/+O0IKn+9AJHJxQrB90HxbqFUyg805ZfaAF66tfEIWrD4Ufuj9aof9vsWNPe19+GAKqb76758L8vfo/yAp3/177835NcPf19lT/B1nB7ou3s7/uwL++fGV+X2V+X2V+X2V+X2V+X2V+X2V+X2V+XzXyHwflBWrQlNXQxP80Ut7jpqlxZ9/Erx9jSBOVn3XjU1GZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31fW/N35ditZBdOW//F3Gt2NWMKxJf/krys0K6GcFUP++T+Fm4YyFybt+GtJnCLTwIy/oSOJS0tW/I0ZMAK/gBF/y+VDvhmy4W+7AXJkv0xgwr9uLRl3zTWjFvyoTje3JrgFP7xBzcz9NuDHFeN+8W4+6/Pj+9PckxF9/kAVLmbhEXX+cD1Y1ghS5w8UjDuJc/1Hm5/0wgRjFdPmJz2GR7mB4MM/puBzyvYp81OqORec6hfK/MRXAtJNqDI/8S3IdC9ImZ/4wkr6BVBlflj04lvp9QuU+Qmr10npN4Au4/tPN6DK/EHn7VPpPqgyP/El3XQPSJmf+LRfev0LZX7SSxOcQJC2/1aR+NMvUGrzU97jKF6T8dX5Se8MMe5vq++/CB4E5/7qBex/WRt4/fhD8Adg1Y7T5w++ZcE6BjCIvwWei7n0+FVnhB8sufT4YSCGcvnxW7gL5pausTl/aa3+wi4cZ3T+1VK6mP8WnBF/c+X6J/7D3Fbnp9OGGlwC+Ibn77UaJkOJZ9EN8x/O1rGDSNUXQ/6zBAiZt2QN+c9jiSI5QHb8NRPEiPp/y46/dg4p8h63Y/4P8+TXmr9+Cv+T8n+aKrBJPAZtxt8QyYooHu/P39SRgAU142+KRAuU/TXz3xralLjUasXfnETzc/zn5hwmfuFKI/5x8+MT/NcWjfhbwrg/Zv/YVsGWbUFt+FvLt7ItqA1/a/lNtgW14W8vIMy1oDb87WkcXAtqwj+uWvm5PqgJPzgE41pQ7/gt14Ka8KMsCOYu3oIfvj/A3MVb8OMTMF4YzoIfJ/HxdvEW/DiJj3eDwYAfv/9TlKwrJAb8uPY404Uw4A9lELAevzHg3x+HSH3W6xP5/rKvMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vfjp/0wXRJv7jqneJWjVdLGji/0nK/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L76DxuakMqfwNR4AAAAAElFTkSuQmCC" alt="LockLogo" /> </div> <samp># All your files has been encrypted by "KRAKEN CRYPTOR".</samp> <samp># Read the following instructions carefully to decrypt your files.</samp> <div class="info"> -----BEGIN KRAKEN ENCRYPTED UNIQUE KEY----- I6V/a54tjfbZc9feJDxCGVvleArdYkT1tlhAY6GoAgt2+hTD/R1DB693lEewuxUI seo0Op/w1oO1qNfD6vSpUSrN/gXRDc/OXUPLITOc65T5ZrDU4WBdVsIQP6ARAZX5 u2H0THi5EfoG3r1vQzdddS5l+iABuq2zidyS/ifTFv8BbbZyqtnyjrkzBA5UozN0 IJbYvmD9QWEE4uDyNmzVC/vJTSoUGTd8tRo+dIRl5gMFZ0ZSj5ug7/YtRuEq4JPV wp5I9d2gM9RR+LM0ffLvvdW3+G5sPKueB728mI+mc0up+UpvvNKgj3yYHslZchPA YYG7d1a+lP22VOjcuMM6XWaC4KLdtWnODS8E5dazB3QN7DwK0zBjvomqN/zODlv8 ACDGxlfVKOjkvG3Bg+fdpwkpj50Vw64jOAuSfvrH/MSzmIEakx+oGO9uMRh5BWBf 9JPa+xIJK9+y1MtiB5F2jGcNeZQQFxCWLxygbExyW/pF4qHPEK+iisqBw6HsOKxn DU80+AvfTtX/LLfXCtcop6drmBWN5FomiZNdfGo/cQsQZ1DTL8Q+/Sk1A4CCU+D5 9t2pmHssMn8NGUi1CZHqHAff9XkXqeBI03Rl558gDHf4FpKH3hwnSmBW3Dp33bQb BFe3lCIqx07n46IfyoGRdLwGuH48Ow2cL56cSds1lJSL44so0jB3yXEvf/uEE0VQ 0DA3MIdhpkr187pcILAcGqTfTbo= -----END KRAKEN ENCRYPTED UNIQUE KEY----- </div> Extension <div class="info"> .V5G6N </div> What happened to my computer? <hr> All of your files such as documents, images, videos and other files with the different names and extensions are encrypted by "KRAKEN CRYPTOR"! Don't delete .V5G6N files! there are not virus and are your files, but encrypted! The speed, power and complexity of this encryption have been high and if you are now viewing this guide. It means that "KRAKEN CRYPTOR" immediately removed form your system! No way to recovery your files without "KRAKEN DECRYPTOR" software and your computer "UNIQUE KEY"! You need to buy it from us because only we can help you! How can recovery my files? <hr> We guarantee that you can recover all your files soon safely. You can decrypt one of your encrypted smaller file for free in the first contact with us. For the decryption service, we also need your "KRAKEN ENCRYPTED UNIQUE KEY" you can see this in the top! Are you want to decrypt all of your encrypted files? If yes! You need to pay for decryption service to us! After your payment made, all of your encrypted files has been decrypted. How much is need to pay? <hr> You need to pay (0.125 BTC), payment only can made as Bitcoins. This links help you to understand whats is a Bitcoins and how it work. <a href="https://wikipedia.org/wiki/Bitcoin">https://en.wikipedia.org/wiki/Bitcoin</a> This price is for the contact with us in first week otherwise it will increase. Where can buy Bitcoins? <hr> The easiest way to buy Bitcoins is LocalBitcoins website. You must register on this site and click "BUY Bitcoins" then choose your country to find sellers and their prices. <a href="https://localBitcoins.com">https://localBitcoins.com</a> Other places to buy Bitcoins in exchange for other currencies worldwide: <a href="https://www.bestbitcoinexchange.io/">https://www.bestbitcoinexchange.io</a> How to contact you? <hr> We use best and easy way to communications. It's email support, you can see our emails below. Please send your message with same subject to both address. E-Mail <div class="info"> [email protected] </div> Alternative <div class="info"> [email protected] </div> Attention <hr> <ul type="disc"> <li>DON'T MODIFY OR RENAME ENCRYPTED FILES.</li> <li>DON'T MODIFY "KRAKEN ENCRYPT UNIQUE KEY".</li> <li>DON'T USE THIRD PARTY, PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY.</li> <li>DON'T ASK PEOPLE OR DATA RECOVERY CENTERS, THEY ARE MAY ADD EXTRA CHARGE.</li> </ul> Additional <hr> <ul type="square"> <li>Project "KRAKEN CRYPTOR" doesn't damage any of your files, this action is reversible if you follow the instructions above.</li> <li>Also, our policy is obvious: "NO PAYMENT, NO DECRYPT".</li> </ul> </div> </div> </body> </html>

Emails

[email protected]

Signatures

Clears Windows event logs 1 TTPs 3 IoCs
evasion ransomware

Indicator Removal
T1070

Processes:

wevtutil.exewevtutil.exewevtutil.exe

pid process

3028 wevtutil.exe
2604 wevtutil.exe
2164 wevtutil.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1824 cmd.exe
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ipinfo.io
8 ipinfo.io
9 ipinfo.io
10 ipinfo.io
4 ipinfo.io
5 ipinfo.io
6 ipinfo.io

pid	process
3028	wevtutil.exe
2604	wevtutil.exe
2164	wevtutil.exe

pid	process
1824	cmd.exe

flow	ioc
7	ipinfo.io
8	ipinfo.io
9	ipinfo.io
10	ipinfo.io
4	ipinfo.io
5	ipinfo.io
6	ipinfo.io

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

60121ea2ab380455f7e143cd9438443e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2CEA.tmp.bmp"	60121ea2ab380455f7e143cd9438443e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	60121ea2ab380455f7e143cd9438443e.exe

Drops file in Program Files directory 2 IoCs

Processes:

60121ea2ab380455f7e143cd9438443e.exe

description	ioc	process
File created	C:\Program Files\Touch	60121ea2ab380455f7e143cd9438443e.exe
File created	C:\Program Files (x86)\Touch	60121ea2ab380455f7e143cd9438443e.exe

Drops file in Windows directory 1 IoCs

Processes:

60121ea2ab380455f7e143cd9438443e.exe

description ioc process

File created C:\Windows\Touch 60121ea2ab380455f7e143cd9438443e.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2692 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2592 tasklist.exe

description	ioc	process
File created	C:\Windows\Touch	60121ea2ab380455f7e143cd9438443e.exe

pid	process
2692	sc.exe

pid	process
2592	tasklist.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

60121ea2ab380455f7e143cd9438443e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\TileWallpaper = "0"	60121ea2ab380455f7e143cd9438443e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallpaperStyle = "2"	60121ea2ab380455f7e143cd9438443e.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1340 PING.EXE

pid	process
1340	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

60121ea2ab380455f7e143cd9438443e.exetasklist.exe

pid	process
1652	60121ea2ab380455f7e143cd9438443e.exe
1652	60121ea2ab380455f7e143cd9438443e.exe
1652	60121ea2ab380455f7e143cd9438443e.exe
1652	60121ea2ab380455f7e143cd9438443e.exe
1652	60121ea2ab380455f7e143cd9438443e.exe
1652	60121ea2ab380455f7e143cd9438443e.exe
1652	60121ea2ab380455f7e143cd9438443e.exe
1652	60121ea2ab380455f7e143cd9438443e.exe
1652	60121ea2ab380455f7e143cd9438443e.exe
1652	60121ea2ab380455f7e143cd9438443e.exe
1652	60121ea2ab380455f7e143cd9438443e.exe
2592	tasklist.exe
2592	tasklist.exe
1652	60121ea2ab380455f7e143cd9438443e.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

60121ea2ab380455f7e143cd9438443e.exewevtutil.exewevtutil.exewevtutil.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	1652	60121ea2ab380455f7e143cd9438443e.exe
Token: SeSecurityPrivilege	2164	wevtutil.exe
Token: SeBackupPrivilege	2164	wevtutil.exe
Token: SeSecurityPrivilege	3028	wevtutil.exe
Token: SeBackupPrivilege	3028	wevtutil.exe
Token: SeSecurityPrivilege	2604	wevtutil.exe
Token: SeBackupPrivilege	2604	wevtutil.exe
Token: SeDebugPrivilege	2592	tasklist.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

60121ea2ab380455f7e143cd9438443e.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1652 wrote to memory of 940	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 940	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 940	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 940	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 940 wrote to memory of 2164	940	cmd.exe	wevtutil.exe
PID 940 wrote to memory of 2164	940	cmd.exe	wevtutil.exe
PID 940 wrote to memory of 2164	940	cmd.exe	wevtutil.exe
PID 940 wrote to memory of 2164	940	cmd.exe	wevtutil.exe
PID 1652 wrote to memory of 2168	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2168	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2168	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2168	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2168 wrote to memory of 3028	2168	cmd.exe	wevtutil.exe
PID 2168 wrote to memory of 3028	2168	cmd.exe	wevtutil.exe
PID 2168 wrote to memory of 3028	2168	cmd.exe	wevtutil.exe
PID 2168 wrote to memory of 3028	2168	cmd.exe	wevtutil.exe
PID 1652 wrote to memory of 884	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 884	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 884	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 884	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 884 wrote to memory of 2604	884	cmd.exe	wevtutil.exe
PID 884 wrote to memory of 2604	884	cmd.exe	wevtutil.exe
PID 884 wrote to memory of 2604	884	cmd.exe	wevtutil.exe
PID 884 wrote to memory of 2604	884	cmd.exe	wevtutil.exe
PID 1652 wrote to memory of 2664	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2664	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2664	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2664	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2664 wrote to memory of 2692	2664	cmd.exe	sc.exe
PID 2664 wrote to memory of 2692	2664	cmd.exe	sc.exe
PID 2664 wrote to memory of 2692	2664	cmd.exe	sc.exe
PID 2664 wrote to memory of 2692	2664	cmd.exe	sc.exe
PID 1652 wrote to memory of 2696	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2696	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2696	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2696	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2564	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2564	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2564	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 2564	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2564 wrote to memory of 2724	2564	cmd.exe	reg.exe
PID 2564 wrote to memory of 2724	2564	cmd.exe	reg.exe
PID 2564 wrote to memory of 2724	2564	cmd.exe	reg.exe
PID 2564 wrote to memory of 2724	2564	cmd.exe	reg.exe
PID 1652 wrote to memory of 2592	1652	60121ea2ab380455f7e143cd9438443e.exe	tasklist.exe
PID 1652 wrote to memory of 2592	1652	60121ea2ab380455f7e143cd9438443e.exe	tasklist.exe
PID 1652 wrote to memory of 2592	1652	60121ea2ab380455f7e143cd9438443e.exe	tasklist.exe
PID 1652 wrote to memory of 2592	1652	60121ea2ab380455f7e143cd9438443e.exe	tasklist.exe
PID 1652 wrote to memory of 1824	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 1824	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 1824	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1652 wrote to memory of 1824	1652	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1824 wrote to memory of 1340	1824	cmd.exe	PING.EXE
PID 1824 wrote to memory of 1340	1824	cmd.exe	PING.EXE
PID 1824 wrote to memory of 1340	1824	cmd.exe	PING.EXE
PID 1824 wrote to memory of 1340	1824	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\60121ea2ab380455f7e143cd9438443e.exe
"C:\Users\Admin\AppData\Local\Temp\60121ea2ab380455f7e143cd9438443e.exe"
1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C wevtutil.exe clear-log Application
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe clear-log Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C wevtutil.exe clear-log Security
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe clear-log Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C wevtutil.exe clear-log System
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe clear-log System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C sc config eventlog start=disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\sc.exe
    sc config eventlog start=disabled
    3⤵
    - Launches sc.exe
    PID:2692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" sc stop eventlog
  2⤵
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C REG add "HKLM\SYSTEM\CurrentControlSet\services\eventlog" / v Start / t REG_DWORD / d 4 / f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\reg.exe
    REG add "HKLM\SYSTEM\CurrentControlSet\services\eventlog" / v Start / t REG_DWORD / d 4 / f
    3⤵
    PID:2724
- C:\Windows\SysWOW64\tasklist.exe
  "tasklist" /V /FO CSV
  2⤵
  - Enumerates processes with tasklist
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S "C:\Users\Admin\AppData\Local\Temp\60121ea2ab380455f7e143cd9438443e.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - Runs ping.exe
    PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\# How to Decrypt Files-V5G6N.html

Filesize
9KB

MD5
9cd7bafc81fd809e6db5810f160d74f8

SHA1
9c1fd42e3aac53609bd802cd470c48162de13e7d

SHA256
3516c1f5d2e16993819c26ae1fefefb569ed213ecaedb41a2d32604feb754f14

SHA512
a34ce3f073526297686c12e52ab79086e47048ca8594d4c32a239ba87b56e88ebc639c0ada7a6ab25a42b666b4ff4d3a64bea31ebef2c8c5a471a19d4665f067

Download Submit
memory/1652-0-0x0000000074AD1000-0x0000000074AD2000-memory.dmp

Filesize
4KB

Download
memory/1652-1-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download
memory/1652-2-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download
memory/1652-3-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download
memory/1652-4-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download
memory/1652-400-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download