targetcompany | 55a35e274170365cb002d6fb694f02fe5b69311aa610b4979166e48057c12191

General

Target

d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
Size

544KB
MD5

d201bd19e60d500963aff0c235b07727
SHA1

341552a8650d2bdad5f3ec12e333e3153172ee66
SHA256

d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
SHA512

4afa7da1bf2a86dc9a3b94b674ecffea638304c42c43c955631bbe29c605be673b7182ed1fcb8997c55c6bbd2a48e5ec46177e8327e9e903781d1ffb2abd991c
SSDEEP

6144:h0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:Gzv66zaISTW9asWxxAh4IlXC4PUqBq/

Score

10^/10

targetcompany evasion execution ransomware

Malware Config

Extracted

Path

\Device\HarddiskVolume1\HOW TO BACK FILES.txt

Ransom Note

Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: C20BBF8E22A6E8D22DF798B4 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion �

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
ransomware targetcompany
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

4372 bcdedit.exe
4936 bcdedit.exe
2252 bcdedit.exe
3508 bcdedit.exe
Renames multiple (6514) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4904 powershell.exe

pid	process
4372	bcdedit.exe
4936	bcdedit.exe
2252	bcdedit.exe
3508	bcdedit.exe

pid	process
4904	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

red.exered.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	red.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	red.exe

Executes dropped EXE 2 IoCs

Processes:

red.exered.exe

pid process

4268 red.exe
1060 red.exe

pid	process
4268	red.exe
1060	red.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

red.exe

description	ioc	process
File opened (read-only)	\??\D:	red.exe
File opened (read-only)	\??\K:	red.exe
File opened (read-only)	\??\M:	red.exe
File opened (read-only)	\??\N:	red.exe
File opened (read-only)	\??\O:	red.exe
File opened (read-only)	\??\P:	red.exe
File opened (read-only)	\??\R:	red.exe
File opened (read-only)	\??\Z:	red.exe
File opened (read-only)	\??\B:	red.exe
File opened (read-only)	\??\H:	red.exe
File opened (read-only)	\??\S:	red.exe
File opened (read-only)	\??\T:	red.exe
File opened (read-only)	\??\V:	red.exe
File opened (read-only)	\??\Y:	red.exe
File opened (read-only)	\??\L:	red.exe
File opened (read-only)	\??\U:	red.exe
File opened (read-only)	\??\W:	red.exe
File opened (read-only)	\??\E:	red.exe
File opened (read-only)	\??\A:	red.exe
File opened (read-only)	\??\G:	red.exe
File opened (read-only)	\??\I:	red.exe
File opened (read-only)	\??\J:	red.exe
File opened (read-only)	\??\Q:	red.exe
File opened (read-only)	\??\X:	red.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

51 api.ipify.org

flow	ioc
51	api.ipify.org

Drops file in Program Files directory 64 IoCs

Processes:

red.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\198.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-24_altform-unplated.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\SmallTile.scale-100.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.scale-200.png	red.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\HOW TO BACK FILES.txt	red.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pl-PL\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\ui-strings.js	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\ui-strings.js	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppxManifest.xml	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.scale-125.png	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif	red.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Planet.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\StartScreen\Tips_Image.png	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js	red.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-black_scale-125.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\processing.slk	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-125_contrast-white.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-16_altform-unplated.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionSmallTile.scale-150.png	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark-2x.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\resources.pri	red.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.scale-100.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-125_contrast-white.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html	red.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\HOW TO BACK FILES.txt	red.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL	red.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-16_contrast-white.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\8.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-48.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteWideTile.scale-400.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailBadge.scale-100.png	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_Full.aapp	red.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailWideTile.scale-150.png	red.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-96.png	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js	red.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\ui-strings.js	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\ui-strings.js	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\ui-strings.js	red.exe
File created	C:\Program Files\Microsoft Office\root\Client\HOW TO BACK FILES.txt	red.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\HOW TO BACK FILES.txt	red.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings cmd.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exered.exered.exe

pid process

4904 powershell.exe
4904 powershell.exe
4904 powershell.exe
4268 red.exe
4268 red.exe
1060 red.exe
1060 red.exe
1060 red.exe
1060 red.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

4660 7zFM.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cmd.exe

pid	process
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4268	red.exe
4268	red.exe
1060	red.exe
1060	red.exe
1060	red.exe
1060	red.exe

pid	process
4660	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

cmd.exe7zFM.exepowershell.exered.exered.exe

description	pid	process
Token: SeManageVolumePrivilege	1588	cmd.exe
Token: SeManageVolumePrivilege	1588	cmd.exe
Token: SeRestorePrivilege	4660	7zFM.exe
Token: 35	4660	7zFM.exe
Token: SeSecurityPrivilege	4660	7zFM.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeTakeOwnershipPrivilege	4268	red.exe
Token: SeDebugPrivilege	4268	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeDebugPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe
Token: SeTakeOwnershipPrivilege	1060	red.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

4660 7zFM.exe
4660 7zFM.exe

pid	process
4660	7zFM.exe
4660	7zFM.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

powershell.exered.execmd.execmd.exered.execmd.execmd.exe

description	pid	process	target process
PID 4904 wrote to memory of 4268	4904	powershell.exe	red.exe
PID 4904 wrote to memory of 4268	4904	powershell.exe	red.exe
PID 4268 wrote to memory of 4636	4268	red.exe	cmd.exe
PID 4268 wrote to memory of 4636	4268	red.exe	cmd.exe
PID 4268 wrote to memory of 2088	4268	red.exe	cmd.exe
PID 4268 wrote to memory of 2088	4268	red.exe	cmd.exe
PID 4636 wrote to memory of 4372	4636	cmd.exe	bcdedit.exe
PID 4636 wrote to memory of 4372	4636	cmd.exe	bcdedit.exe
PID 2088 wrote to memory of 4936	2088	cmd.exe	bcdedit.exe
PID 2088 wrote to memory of 4936	2088	cmd.exe	bcdedit.exe
PID 1060 wrote to memory of 2216	1060	red.exe	cmd.exe
PID 1060 wrote to memory of 2216	1060	red.exe	cmd.exe
PID 1060 wrote to memory of 1056	1060	red.exe	cmd.exe
PID 1060 wrote to memory of 1056	1060	red.exe	cmd.exe
PID 2216 wrote to memory of 3508	2216	cmd.exe	bcdedit.exe
PID 2216 wrote to memory of 3508	2216	cmd.exe	bcdedit.exe
PID 1056 wrote to memory of 2252	1056	cmd.exe	bcdedit.exe
PID 1056 wrote to memory of 2252	1056	cmd.exe	bcdedit.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

red.exered.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	red.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "1"	red.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	red.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1192

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -command start red.exe "1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\Desktop\red.exe
"C:\Users\Admin\Desktop\red.exe" 1
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
3⤵
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:4372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
3⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:4936

C:\Users\Admin\Desktop\red.exe
"C:\Users\Admin\Desktop\red.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
2⤵
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:3508

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
2⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\Admin\Local Settings\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
98f2bd054ee794188c9d78982b5bc4a9

SHA1
b8348efb577d250f2cc1988265a25a0302ddf0e3

SHA256
b1b43928560fb71e14c95836e96b6533d0d7fd1eaf0b65523e76f493414f9e71

SHA512
c856414d4a9667e3ae620a4c51df5b163e721df245af5184c55d37572304ee4dd2fd1d790efb37814c6f04fcec4bd8461bf0171971817bc1513baf10cb790264

Download Submit
C:\Documents and Settings\Admin\Recent\CustomDestinations\d2905e77b2d1aac0.customDestinations-ms
Filesize
5KB

MD5
0b5e3e7f28b428068e2ee68779a5ace4

SHA1
77716ce25e77177b1204b53b0577a4e01a2d1a6d

SHA256
4c921f19a39fb95e8ed20e74b3e9ad50229c7f9f38bf3d008ed4f3fe4447ce61

SHA512
dcac0a18c7edfe585f01b084f475f8aac86b0225eca3836dba508565813cb261d252614ede978d162c7890e513a0574172b1de00d54a0ce833b7248cf44b2cd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yhzwx1xh.4is.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\Reader.lnk
Filesize
2KB

MD5
66bb9363e23c7ef2d16c89cd654b491e

SHA1
c20e8d536804cf97584eec93d9a89c09541155bc

SHA256
61f36c5ae038faa2b58a9a17b464d01414b4265e46634f353319c471d0a35789

SHA512
b7a751e49218230d574ca9cc4cbbb1995d89798268124b1617889c7558c66902f81fdb77a299edcc6d96452cec81adb76768172710e00c9272d30821ab0089c5

Download Submit
C:\Users\Admin\Desktop\red.exe
Filesize
478KB

MD5
71efe7a21da183c407682261612afc0f

SHA1
0f1aea2cf0c9f2de55d2b920618a5948c5e5e119

SHA256
45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d

SHA512
3cff597dbd7f0d5ab45b04e3c3731e38626b7b082a0ede7ab9a7826921848edb3c033f640da2cb13916febf84164f7415ca9ac50c3d927f04d9b61fcadb7801c

Download Submit
\Device\HarddiskVolume1\HOW TO BACK FILES.txt
Filesize
910B

MD5
5888b20d7fc5d16555c5d7f18bb5d92e

SHA1
50cd96f988cc3ac399767296ddf07b8050e99a27

SHA256
cdcf517b57695aa656793de12b8de971493d460a6bf020bd6cfb84ac46159f2d

SHA512
9a4fd5edf870ba66ef5511acd092e87f2b031f2850af123dd2e0d429168fe8679621aba35762e9fde4b4dd4106ad865c39f2762780ab4876c10c043467cae1b3

Download Submit
memory/4904-6-0x00000182EAC10000-0x00000182EAC32000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads