targetcompany | 55a35e274170365cb002d6fb694f02fe5b69311aa610b4979166e48057c12191

General

Target

d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
Size

544KB
MD5

d201bd19e60d500963aff0c235b07727
SHA1

341552a8650d2bdad5f3ec12e333e3153172ee66
SHA256

d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
SHA512

4afa7da1bf2a86dc9a3b94b674ecffea638304c42c43c955631bbe29c605be673b7182ed1fcb8997c55c6bbd2a48e5ec46177e8327e9e903781d1ffb2abd991c
SSDEEP

6144:h0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:Gzv66zaISTW9asWxxAh4IlXC4PUqBq/

Score

10^/10

targetcompany evasion execution ransomware

Malware Config

Extracted

Path

C:\HOW TO BACK FILES.txt

Ransom Note

Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: B9AA0BBAF8CCB382CDE37D2C 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion �

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
ransomware targetcompany
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

1692 bcdedit.exe
1708 bcdedit.exe
2412 bcdedit.exe
2420 bcdedit.exe
Renames multiple (7262) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2508 powershell.exe
Executes dropped EXE 2 IoCs

Processes:

red.exered.exe

pid process

1904 red.exe
1724 red.exe
Loads dropped DLL 7 IoCs

Processes:

powershell.exe

pid process

1200
1200
2508 powershell.exe
1200
1200
1200
1200

pid	process
1692	bcdedit.exe
1708	bcdedit.exe
2412	bcdedit.exe
2420	bcdedit.exe

pid	process
2508	powershell.exe

pid	process
1904	red.exe
1724	red.exe

pid	process
1200
1200
2508	powershell.exe
1200
1200
1200
1200

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

red.exe

description	ioc	process
File opened (read-only)	\??\D:	red.exe
File opened (read-only)	\??\A:	red.exe
File opened (read-only)	\??\J:	red.exe
File opened (read-only)	\??\L:	red.exe
File opened (read-only)	\??\T:	red.exe
File opened (read-only)	\??\W:	red.exe
File opened (read-only)	\??\M:	red.exe
File opened (read-only)	\??\S:	red.exe
File opened (read-only)	\??\U:	red.exe
File opened (read-only)	\??\Y:	red.exe
File opened (read-only)	\??\Z:	red.exe
File opened (read-only)	\??\H:	red.exe
File opened (read-only)	\??\I:	red.exe
File opened (read-only)	\??\O:	red.exe
File opened (read-only)	\??\P:	red.exe
File opened (read-only)	\??\R:	red.exe
File opened (read-only)	\??\E:	red.exe
File opened (read-only)	\??\B:	red.exe
File opened (read-only)	\??\G:	red.exe
File opened (read-only)	\??\K:	red.exe
File opened (read-only)	\??\N:	red.exe
File opened (read-only)	\??\Q:	red.exe
File opened (read-only)	\??\V:	red.exe
File opened (read-only)	\??\X:	red.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org

flow	ioc
5	api.ipify.org

Drops file in Program Files directory 64 IoCs

Processes:

red.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar	red.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387591.JPG	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143749.GIF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck.css	red.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\EmptyDatabase.zip	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01590_.WMF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0211949.WMF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10253_.GIF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21481_.GIF	red.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif	red.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186364.WMF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237336.WMF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00833_.WMF	red.exe
File created	C:\Program Files (x86)\Adobe\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLNOTER.FAE	red.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png	red.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg	red.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP	red.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau	red.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107090.WMF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR50F.GIF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\COUGH.WAV	red.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENV98.POC	red.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png	red.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar	red.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar	red.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199465.WMF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\RE00006_.WMF	red.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar	red.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIconMask.bmp	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16ImagesMask.bmp	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css	red.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api	red.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02313_.WMF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198377.WMF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341455.JPG	red.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK	red.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar	red.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105912.WMF	red.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15302_.GIF	red.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\HOW TO BACK FILES.txt	red.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exered.exered.exe

pid process

2508 powershell.exe
2508 powershell.exe
2508 powershell.exe
1904 red.exe
1724 red.exe
1724 red.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

2596 7zFM.exe

pid	process
2508	powershell.exe
2508	powershell.exe
2508	powershell.exe
1904	red.exe
1724	red.exe
1724	red.exe

pid	process
2596	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exepowershell.exered.exered.exe

description	pid	process
Token: SeRestorePrivilege	2596	7zFM.exe
Token: 35	2596	7zFM.exe
Token: SeSecurityPrivilege	2596	7zFM.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeTakeOwnershipPrivilege	1904	red.exe
Token: SeDebugPrivilege	1904	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeDebugPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe
Token: SeTakeOwnershipPrivilege	1724	red.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

2596 7zFM.exe
2596 7zFM.exe

pid	process
2596	7zFM.exe
2596	7zFM.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

cmd.exepowershell.exered.execmd.execmd.exered.execmd.execmd.exe

description	pid	process	target process
PID 1192 wrote to memory of 2676	1192	cmd.exe	isoburn.exe
PID 1192 wrote to memory of 2676	1192	cmd.exe	isoburn.exe
PID 1192 wrote to memory of 2676	1192	cmd.exe	isoburn.exe
PID 2508 wrote to memory of 1904	2508	powershell.exe	red.exe
PID 2508 wrote to memory of 1904	2508	powershell.exe	red.exe
PID 2508 wrote to memory of 1904	2508	powershell.exe	red.exe
PID 1904 wrote to memory of 1960	1904	red.exe	cmd.exe
PID 1904 wrote to memory of 1960	1904	red.exe	cmd.exe
PID 1904 wrote to memory of 1960	1904	red.exe	cmd.exe
PID 1904 wrote to memory of 1940	1904	red.exe	cmd.exe
PID 1904 wrote to memory of 1940	1904	red.exe	cmd.exe
PID 1904 wrote to memory of 1940	1904	red.exe	cmd.exe
PID 1960 wrote to memory of 1692	1960	cmd.exe	bcdedit.exe
PID 1960 wrote to memory of 1692	1960	cmd.exe	bcdedit.exe
PID 1960 wrote to memory of 1692	1960	cmd.exe	bcdedit.exe
PID 1940 wrote to memory of 1708	1940	cmd.exe	bcdedit.exe
PID 1940 wrote to memory of 1708	1940	cmd.exe	bcdedit.exe
PID 1940 wrote to memory of 1708	1940	cmd.exe	bcdedit.exe
PID 1724 wrote to memory of 2172	1724	red.exe	cmd.exe
PID 1724 wrote to memory of 2172	1724	red.exe	cmd.exe
PID 1724 wrote to memory of 2172	1724	red.exe	cmd.exe
PID 1724 wrote to memory of 2212	1724	red.exe	cmd.exe
PID 1724 wrote to memory of 2212	1724	red.exe	cmd.exe
PID 1724 wrote to memory of 2212	1724	red.exe	cmd.exe
PID 2172 wrote to memory of 2412	2172	cmd.exe	bcdedit.exe
PID 2172 wrote to memory of 2412	2172	cmd.exe	bcdedit.exe
PID 2172 wrote to memory of 2412	2172	cmd.exe	bcdedit.exe
PID 2212 wrote to memory of 2420	2212	cmd.exe	bcdedit.exe
PID 2212 wrote to memory of 2420	2212	cmd.exe	bcdedit.exe
PID 2212 wrote to memory of 2420	2212	cmd.exe	bcdedit.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

red.exered.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	red.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "1"	red.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	red.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso"
  2⤵
  PID:2676

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:2624

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -command start red.exe "1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\Desktop\red.exe
  "C:\Users\Admin\Desktop\red.exe" 1
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1904
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1692
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1708

C:\Users\Admin\Desktop\red.exe
"C:\Users\Admin\Desktop\red.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2420

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\HOW TO BACK FILES.txt
1⤵
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\Admin\Recent\CustomDestinations\d2905e77b2d1aac0.customDestinations-ms

Filesize
6KB

MD5
96e053ed2cf9cf1d9b97f3066b4b90b0

SHA1
6202eb4253ce83eb1762a7d5ba52e515e96c359a

SHA256
0d6b9d126d68c217bfcdc7edfb99e4af9edb04b9c5c56247aeb79fd586fdd8e8

SHA512
63bc8b644970e9fa6cec31de813d9df6de2364d7abb6f771c26241fcde5c20b290c7b3f5faf5db9620c45166876e95f6342c244e584e9485f21482ad5711a15d

Download Submit
C:\HOW TO BACK FILES.txt

Filesize
910B

MD5
ef899f12bae05f99b4e48bf670e53680

SHA1
7b811dcc9ef59e8fa7d02fe33a5f5111f389a2c6

SHA256
f6324dccf234fc5431f9f54d1a4d5443c2003f8e1b76fe4b107372f7d2522fec

SHA512
d1f6c2892622e1d15b5f65503f32f6848a3c0dcb01f0a8a350c2a3a02d13bcb65fda99a3e2d5b888db9e1f1c6ac066ad4c6c363b54b6232befee884c2f133a74

Download Submit
C:\Users\Admin\Desktop\Reader.lnk

Filesize
2KB

MD5
66bb9363e23c7ef2d16c89cd654b491e

SHA1
c20e8d536804cf97584eec93d9a89c09541155bc

SHA256
61f36c5ae038faa2b58a9a17b464d01414b4265e46634f353319c471d0a35789

SHA512
b7a751e49218230d574ca9cc4cbbb1995d89798268124b1617889c7558c66902f81fdb77a299edcc6d96452cec81adb76768172710e00c9272d30821ab0089c5

Download Submit
\Users\Admin\Desktop\red.exe

Filesize
478KB

MD5
71efe7a21da183c407682261612afc0f

SHA1
0f1aea2cf0c9f2de55d2b920618a5948c5e5e119

SHA256
45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d

SHA512
3cff597dbd7f0d5ab45b04e3c3731e38626b7b082a0ede7ab9a7826921848edb3c033f640da2cb13916febf84164f7415ca9ac50c3d927f04d9b61fcadb7801c

Download Submit
memory/2508-32-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2508-33-0x0000000002280000-0x0000000002288000-memory.dmp

Filesize
32KB

Download
memory/2676-24-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads