Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07-06-2024 18:29
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe
Resource
win10v2004-20240426-en
General
-
Target
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe
-
Size
392KB
-
MD5
6653ef20d2a3a6ef656d9c886ebabd93
-
SHA1
bb0cc0b05bb70a3d347faa94fb36a35c771b0692
-
SHA256
48ff838a7fe98ec2c5bb59a8a76100047abcfa6db824f4982b8e7fdf2110f05d
-
SHA512
b68b37147ce0d1389d62f5f72ebb616edc7d2ed2aaa484e85f6dc4b6070c9ce973a523e11e311686dc0efb0757fe52dcfa430afb1f48f98ecfdc257c6f3cc360
-
SSDEEP
3072:viHZTdn6oWzjNtxPPnGau7GMuOYHAifZEeKPi6u7KzrN7ivE5oY4KppRsqYaefiU:QZqPtvGauSM4HAifkGOzrN+HKkalM
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.xlfp45.win/D4C0-8C47-6696-0291-945A
http://cerberhhyed5frqa.slr849.win/D4C0-8C47-6696-0291-945A
http://cerberhhyed5frqa.ret5kr.win/D4C0-8C47-6696-0291-945A
http://cerberhhyed5frqa.zgf48j.win/D4C0-8C47-6696-0291-945A
http://cerberhhyed5frqa.xltnet.win/D4C0-8C47-6696-0291-945A
http://cerberhhyed5frqa.onion/D4C0-8C47-6696-0291-945A
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16394) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2532 bcdedit.exe 1912 bcdedit.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exeReAgentc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\ReAgentc.exe\"" VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\ReAgentc.exe\"" ReAgentc.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2672 cmd.exe -
Drops startup file 2 IoCs
Processes:
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exeReAgentc.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ReAgentc.lnk VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ReAgentc.lnk ReAgentc.exe -
Executes dropped EXE 1 IoCs
Processes:
ReAgentc.exepid process 2252 ReAgentc.exe -
Loads dropped DLL 3 IoCs
Processes:
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exeReAgentc.exepid process 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe 2252 ReAgentc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exeReAgentc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ReAgentc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\ReAgentc.exe\"" VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ReAgentc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\ReAgentc.exe\"" VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ReAgentc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\ReAgentc.exe\"" ReAgentc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ReAgentc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\ReAgentc.exe\"" ReAgentc.exe -
Processes:
ReAgentc.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ReAgentc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
ReAgentc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpE7D0.bmp" ReAgentc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2724 vssadmin.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2740 taskkill.exe 1112 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exeReAgentc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\ReAgentc.exe\"" VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop ReAgentc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\ReAgentc.exe\"" ReAgentc.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F72E88E1-24FB-11EF-910D-CE7E212FECBD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F73F3281-24FB-11EF-910D-CE7E212FECBD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30bcdeb908b9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423946874" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000829cf48750f6d74a8777d2a2c78972a3000000000200000000001066000000010000200000008a2182c7b263ef000b40802a993aeb5cff03b096cc02037ada691b4b45191256000000000e8000000002000020000000b809aeab9cc58ea9acf55fb9e4eba85fcd31e6ff6c8ff99706dd1036829195d4200000003c68e966f8185e59973e4f6f2a23653c15c6c0eeac4e06ff3ec942f6f315ad7e40000000ff090bdc45ccc27ede9f058dd5e843b4c3bd083047f249b62be302209b9206dc9d333186535cc8583473a205d84608737960b9980cf9237aa5828b6a02496c40 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000829cf48750f6d74a8777d2a2c78972a30000000002000000000010660000000100002000000099e772b708ee75e6a4c0f66e34eab3ad8f4f368e58a4c1cbde45eed5fc1b9d38000000000e80000000020000200000009f1462f1c399ad57b49da93ab283f46c9708c735948e97fea449cae5b6c7d2c390000000649ea671e65c52d8f23a97971f4635c36dcd54d69101cd08ced2d5563dee6906dc6e7fe1c7aa3c536124c21c2741c9c53ca2285a9fb3dfdea139855cde9f4af9f1a9eeaa7e6eb846ce761eec6e5b43c88839dc686a60cd7957a4f697456b453e3258388facc6c1de66ec1e33d11b2431d50a1d9e8ef15efc3f21bd46cdcc18d230404ade5c1c6e564c2ee75c49c8e7e0400000001ce6d6ff1caba2c5944f12b54e6242c7bfe1dc9389f2b8b574c6d43f7f81e681b5d645e8deac1ba28650d143b3dfa17f867177088e4147c17d745de7862e7360 iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
ReAgentc.exepid process 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe 2252 ReAgentc.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exeReAgentc.exevssvc.exetaskkill.exewmic.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe Token: SeDebugPrivilege 2252 ReAgentc.exe Token: SeBackupPrivilege 2508 vssvc.exe Token: SeRestorePrivilege 2508 vssvc.exe Token: SeAuditPrivilege 2508 vssvc.exe Token: SeDebugPrivilege 2740 taskkill.exe Token: SeIncreaseQuotaPrivilege 708 wmic.exe Token: SeSecurityPrivilege 708 wmic.exe Token: SeTakeOwnershipPrivilege 708 wmic.exe Token: SeLoadDriverPrivilege 708 wmic.exe Token: SeSystemProfilePrivilege 708 wmic.exe Token: SeSystemtimePrivilege 708 wmic.exe Token: SeProfSingleProcessPrivilege 708 wmic.exe Token: SeIncBasePriorityPrivilege 708 wmic.exe Token: SeCreatePagefilePrivilege 708 wmic.exe Token: SeBackupPrivilege 708 wmic.exe Token: SeRestorePrivilege 708 wmic.exe Token: SeShutdownPrivilege 708 wmic.exe Token: SeDebugPrivilege 708 wmic.exe Token: SeSystemEnvironmentPrivilege 708 wmic.exe Token: SeRemoteShutdownPrivilege 708 wmic.exe Token: SeUndockPrivilege 708 wmic.exe Token: SeManageVolumePrivilege 708 wmic.exe Token: 33 708 wmic.exe Token: 34 708 wmic.exe Token: 35 708 wmic.exe Token: SeIncreaseQuotaPrivilege 708 wmic.exe Token: SeSecurityPrivilege 708 wmic.exe Token: SeTakeOwnershipPrivilege 708 wmic.exe Token: SeLoadDriverPrivilege 708 wmic.exe Token: SeSystemProfilePrivilege 708 wmic.exe Token: SeSystemtimePrivilege 708 wmic.exe Token: SeProfSingleProcessPrivilege 708 wmic.exe Token: SeIncBasePriorityPrivilege 708 wmic.exe Token: SeCreatePagefilePrivilege 708 wmic.exe Token: SeBackupPrivilege 708 wmic.exe Token: SeRestorePrivilege 708 wmic.exe Token: SeShutdownPrivilege 708 wmic.exe Token: SeDebugPrivilege 708 wmic.exe Token: SeSystemEnvironmentPrivilege 708 wmic.exe Token: SeRemoteShutdownPrivilege 708 wmic.exe Token: SeUndockPrivilege 708 wmic.exe Token: SeManageVolumePrivilege 708 wmic.exe Token: 33 708 wmic.exe Token: 34 708 wmic.exe Token: 35 708 wmic.exe Token: SeDebugPrivilege 1112 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2388 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
IEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1320 IEXPLORE.EXE 1320 IEXPLORE.EXE 2388 iexplore.exe 2388 iexplore.exe 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exeReAgentc.exepid process 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe 2252 ReAgentc.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exeReAgentc.execmd.exeiexplore.execmd.exedescription pid process target process PID 2232 wrote to memory of 2252 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe ReAgentc.exe PID 2232 wrote to memory of 2252 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe ReAgentc.exe PID 2232 wrote to memory of 2252 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe ReAgentc.exe PID 2232 wrote to memory of 2252 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe ReAgentc.exe PID 2252 wrote to memory of 2724 2252 ReAgentc.exe vssadmin.exe PID 2252 wrote to memory of 2724 2252 ReAgentc.exe vssadmin.exe PID 2252 wrote to memory of 2724 2252 ReAgentc.exe vssadmin.exe PID 2252 wrote to memory of 2724 2252 ReAgentc.exe vssadmin.exe PID 2232 wrote to memory of 2672 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe cmd.exe PID 2232 wrote to memory of 2672 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe cmd.exe PID 2232 wrote to memory of 2672 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe cmd.exe PID 2232 wrote to memory of 2672 2232 VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe cmd.exe PID 2672 wrote to memory of 2740 2672 cmd.exe taskkill.exe PID 2672 wrote to memory of 2740 2672 cmd.exe taskkill.exe PID 2672 wrote to memory of 2740 2672 cmd.exe taskkill.exe PID 2672 wrote to memory of 2740 2672 cmd.exe taskkill.exe PID 2672 wrote to memory of 2768 2672 cmd.exe PING.EXE PID 2672 wrote to memory of 2768 2672 cmd.exe PING.EXE PID 2672 wrote to memory of 2768 2672 cmd.exe PING.EXE PID 2672 wrote to memory of 2768 2672 cmd.exe PING.EXE PID 2252 wrote to memory of 708 2252 ReAgentc.exe wmic.exe PID 2252 wrote to memory of 708 2252 ReAgentc.exe wmic.exe PID 2252 wrote to memory of 708 2252 ReAgentc.exe wmic.exe PID 2252 wrote to memory of 708 2252 ReAgentc.exe wmic.exe PID 2252 wrote to memory of 2532 2252 ReAgentc.exe bcdedit.exe PID 2252 wrote to memory of 2532 2252 ReAgentc.exe bcdedit.exe PID 2252 wrote to memory of 2532 2252 ReAgentc.exe bcdedit.exe PID 2252 wrote to memory of 2532 2252 ReAgentc.exe bcdedit.exe PID 2252 wrote to memory of 1912 2252 ReAgentc.exe bcdedit.exe PID 2252 wrote to memory of 1912 2252 ReAgentc.exe bcdedit.exe PID 2252 wrote to memory of 1912 2252 ReAgentc.exe bcdedit.exe PID 2252 wrote to memory of 1912 2252 ReAgentc.exe bcdedit.exe PID 2252 wrote to memory of 2940 2252 ReAgentc.exe iexplore.exe PID 2252 wrote to memory of 2940 2252 ReAgentc.exe iexplore.exe PID 2252 wrote to memory of 2940 2252 ReAgentc.exe iexplore.exe PID 2252 wrote to memory of 2940 2252 ReAgentc.exe iexplore.exe PID 2252 wrote to memory of 1584 2252 ReAgentc.exe NOTEPAD.EXE PID 2252 wrote to memory of 1584 2252 ReAgentc.exe NOTEPAD.EXE PID 2252 wrote to memory of 1584 2252 ReAgentc.exe NOTEPAD.EXE PID 2252 wrote to memory of 1584 2252 ReAgentc.exe NOTEPAD.EXE PID 2388 wrote to memory of 2976 2388 iexplore.exe IEXPLORE.EXE PID 2388 wrote to memory of 2976 2388 iexplore.exe IEXPLORE.EXE PID 2388 wrote to memory of 2976 2388 iexplore.exe IEXPLORE.EXE PID 2388 wrote to memory of 2976 2388 iexplore.exe IEXPLORE.EXE PID 2252 wrote to memory of 204 2252 ReAgentc.exe WScript.exe PID 2252 wrote to memory of 204 2252 ReAgentc.exe WScript.exe PID 2252 wrote to memory of 204 2252 ReAgentc.exe WScript.exe PID 2252 wrote to memory of 204 2252 ReAgentc.exe WScript.exe PID 2252 wrote to memory of 1248 2252 ReAgentc.exe cmd.exe PID 2252 wrote to memory of 1248 2252 ReAgentc.exe cmd.exe PID 2252 wrote to memory of 1248 2252 ReAgentc.exe cmd.exe PID 2252 wrote to memory of 1248 2252 ReAgentc.exe cmd.exe PID 1248 wrote to memory of 1112 1248 cmd.exe taskkill.exe PID 1248 wrote to memory of 1112 1248 cmd.exe taskkill.exe PID 1248 wrote to memory of 1112 1248 cmd.exe taskkill.exe PID 1248 wrote to memory of 3016 1248 cmd.exe PING.EXE PID 1248 wrote to memory of 3016 1248 cmd.exe PING.EXE PID 1248 wrote to memory of 3016 1248 cmd.exe PING.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\ReAgentc.exe"C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\ReAgentc.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2724 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:708 -
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2532 -
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1912 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
PID:2940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:537601 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2232 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵PID:1584
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵PID:204
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "ReAgentc.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\ReAgentc.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\system32\taskkill.exetaskkill /t /f /im "ReAgentc.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1112 -
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
PID:3016 -
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2740 -
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:2768
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2976
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:2740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.htmlFilesize
12KB
MD5f43f12f762eb59bcbf80f925c923c973
SHA18eb33b8f9d7b2708791e4682e43b29778bd7e8df
SHA256d90753bb1217a9244dc97167ee7e7a63434f800b94885782ca2ec1455efd238f
SHA51242444b3947e7591b0b750888d5dd7127541a989bb94cad30401049d921224e41f7d87e3cc8258f1947398a991b6ccfddd51f77f3373c2cc60d19dc5a9a4f0c26
-
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txtFilesize
10KB
MD5a8eddb36e8a200530214f90ee9a913d2
SHA1b894daa2f4c880cd8bfc7521faf3c35980344e03
SHA256e5ceedc9b53a2c64ce8b576b40a9482a3c3640a4fe30d3169b1beb3cf6adabe7
SHA51207474f5f363554376145045a590fbc90f02fea0346925889365454f3a77da90f058bcfacb2892526f695e6cf2eda4d8c8362013e2e0e5d9ec026c15e7a53004a
-
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.urlFilesize
85B
MD52d5548469336d59cda3cea577009ce7c
SHA1de4a05b55232b8724c6e127d24bdde9c70dcee03
SHA256728e33fe74d5b2312106d0c20ef1bb86be107be1e7089d349484e5a124da92ec
SHA5120642a470be7c3c71b44eb0beadcbc43836b310825e92aace08da16d21fe9ea82d27f78f8e65b5c63ef4c9d6e3e3cec7592dd0ceacebfc77b723d2575519c7c9a
-
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbsFilesize
219B
MD535a3e3b45dcfc1e6c4fd4a160873a0d1
SHA1a0bcc855f2b75d82cbaae3a8710f816956e94b37
SHA2568ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934
SHA5126d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ReAgentc.lnkFilesize
1KB
MD533ed02a24e892df649326d2899c3c70f
SHA1d66ceef4f38ea3a118b54666d7dfe4244094d47f
SHA256c07c3192ce42d2ab83b9b3465f7bbd549480817dfcec805dfbfb702850904c3a
SHA512c2e3430711d277ce45dbd50eaa2c43bf1923144f6be43eef62d882cbc7d8755eb60cf9cc6db003765cfb28957ccad791209ab814df17072909e6a4638877d160
-
\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\ReAgentc.exeFilesize
392KB
MD56653ef20d2a3a6ef656d9c886ebabd93
SHA1bb0cc0b05bb70a3d347faa94fb36a35c771b0692
SHA25648ff838a7fe98ec2c5bb59a8a76100047abcfa6db824f4982b8e7fdf2110f05d
SHA512b68b37147ce0d1389d62f5f72ebb616edc7d2ed2aaa484e85f6dc4b6070c9ce973a523e11e311686dc0efb0757fe52dcfa430afb1f48f98ecfdc257c6f3cc360
-
memory/2232-1-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2232-2-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2232-0-0x0000000000220000-0x000000000023F000-memory.dmpFilesize
124KB
-
memory/2232-20-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-434-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-445-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-46-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-25-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-24-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-22-0x0000000002D60000-0x0000000002D61000-memory.dmpFilesize
4KB
-
memory/2252-38-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-26-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-16-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-443-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-442-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-440-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-439-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-48-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-466-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-464-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-462-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-460-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-458-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-456-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-454-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-432-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-429-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-469-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2252-477-0x00000000038A0000-0x00000000038A2000-memory.dmpFilesize
8KB
-
memory/2252-493-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB