Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 13:29
Static task
static1
Behavioral task
behavioral1
Sample
8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe
Resource
win10v2004-20240426-en
General
-
Target
8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe
-
Size
347KB
-
MD5
8f402d93d54d9e6dfa608e74f2b108c1
-
SHA1
236ef8c57c8567bdd723acbeb645ac9cbfbe0880
-
SHA256
8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04
-
SHA512
65184154587bcf48411bbc1f279a1a5b40cbcbd8403d17e792f3f525e1cb9ce685741659584cdc8d2258ed29f7c2521085e8c796bd219050af754a0ac6351041
-
SSDEEP
6144:xPtDXH/S/IQUjXeQvBAOMJmwFT//4OQ334gx6AdFCxPor:h5Xy6XekBkFTH4xYgFwxPO
Malware Config
Extracted
F:\$RECYCLE.BIN\FILE RECOVERY.txt
targetcompany
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (2602) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 3688 cmd.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\E: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\G: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\L: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\O: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\S: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\T: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\U: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\X: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\H: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\J: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\I: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\D: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\B: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\M: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\N: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\P: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\Q: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\R: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\V: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\A: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\K: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\W: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened (read-only) \??\Z: 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\InitializeSplit.emz 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Paper.xml 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime.css 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\FILE RECOVERY.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21328_.GIF 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\FILE RECOVERY.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\FILE RECOVERY.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00564_.WMF 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106146.WMF 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151041.WMF 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0332268.WMF 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImages256Colors.bmp 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\FILE RECOVERY.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert.css 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPIRM.XML 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FORM98.POC 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File created C:\Program Files\Mozilla Firefox\uninstall\FILE RECOVERY.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACT.CFG 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\GrantMount.DVR-MS 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\FILE RECOVERY.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215710.WMF 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_GreenTea.gif 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\HEADER.GIF 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\FILE RECOVERY.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\FILE RECOVERY.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10298_.GIF 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File created C:\Program Files\VideoLAN\VLC\locale\si\FILE RECOVERY.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\FILE RECOVERY.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01931J.JPG 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.HTM 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\FILE RECOVERY.txt 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099165.JPG 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00017_.WMF 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2B.GIF 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1436 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2664 vssadmin.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3748 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe Token: SeDebugPrivilege 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe Token: SeBackupPrivilege 320 vssvc.exe Token: SeRestorePrivilege 320 vssvc.exe Token: SeAuditPrivilege 320 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2664 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 28 PID 2232 wrote to memory of 2664 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 28 PID 2232 wrote to memory of 2664 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 28 PID 2232 wrote to memory of 2664 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 28 PID 2232 wrote to memory of 1648 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 30 PID 2232 wrote to memory of 1648 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 30 PID 2232 wrote to memory of 1648 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 30 PID 2232 wrote to memory of 1648 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 30 PID 2232 wrote to memory of 3068 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 31 PID 2232 wrote to memory of 3068 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 31 PID 2232 wrote to memory of 3068 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 31 PID 2232 wrote to memory of 3068 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 31 PID 2232 wrote to memory of 1328 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 33 PID 2232 wrote to memory of 1328 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 33 PID 2232 wrote to memory of 1328 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 33 PID 2232 wrote to memory of 1328 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 33 PID 1648 wrote to memory of 1436 1648 cmd.exe 36 PID 1648 wrote to memory of 1436 1648 cmd.exe 36 PID 1648 wrote to memory of 1436 1648 cmd.exe 36 PID 1648 wrote to memory of 1436 1648 cmd.exe 36 PID 2232 wrote to memory of 3688 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 43 PID 2232 wrote to memory of 3688 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 43 PID 2232 wrote to memory of 3688 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 43 PID 2232 wrote to memory of 3688 2232 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe 43 PID 3688 wrote to memory of 3748 3688 cmd.exe 45 PID 3688 wrote to memory of 3748 3688 cmd.exe 45 PID 3688 wrote to memory of 3748 3688 cmd.exe 45 PID 3688 wrote to memory of 3748 3688 cmd.exe 45 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" 8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe"C:\Users\Admin\AppData\Local\Temp\8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2232 -
C:\Windows\system32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2664
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher"3⤵
- Launches sc.exe
PID:1436
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵PID:3068
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵PID:1328
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\8ee70de7af7f22f072f09c7e1a780c9c915cf697d4a241cfbec1b0c00fa51c04.exe" >> NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3748
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:320
Network
MITRE ATT&CK Enterprise v15
Execution
System Services
1Service Execution
1Windows Management Instrumentation
1Defense Evasion
Impair Defenses
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD5c881da4c92c394fc2f3e3485968f888a
SHA18f98c90d05f570d425a7eda3915450d5619f0d8c
SHA2563c77722d6c35bc85369ec26172f92b1bde5f483a692607c73815ffcbb82fae11
SHA5124bf055198eae0c654db09562585bb8a50bdcf7393e60002e10bdc8e54ebc8b6b7f5b02804de4420640d46650b9930d6eb54deee6c8b61d1784ae14b7d152c505