Analysis
- max time kernel
153s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 15:19
Behavioral task
behavioral1
Sample
f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.exe
- Size 212KB
- Sample240608-sqmvesch2s
- SHA256 f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb
- MD5 723825ad69a5d55a1e5ed3d1ee831f0d
- SHA1 7e082df63c3de0f8bf9d38edf72ba5268078275a
- SHA512 dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78
- SSDEEP 6144:tia1gMH2EXtAup5Qnqn64DQFu/U3buRKlemZ9DnGAe+hsO6a+8:tIMHxGe5Qb4DQFu/U3buRKlemZ9DnGAb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Program Files\7-Zip\Lang\RECOVERY DATA INFORMATION.TXT
-
balaclava
Ransom Note
- Hello! If you see this message - this means your files are now encrypted and are in a non-working state! Now only we can help you recover. If you are ready to restore the work - send us an email to the address [email protected] In the letter, specify your personal identifier, which you will see below. In the reply letter we will inform you the cost of decrypting your files. Also from your servers files, documents, databases SQL, PDF were uploaded to our cloud storage After we agree, you will receive a decryption program, as well as all your files on our server will be deleted. Otherwise, they will fall into the open access of the Internet! Before payment you can send us 1-2 files for test decryption. We will decrypt the files you requested and send you back. This ensures that we own the key to recover your data. The total file size should be no more than 3 MB, the files should not contain valuable information (databases, backups, large Excel spreadsheets ...). Please be sure that we will find common languge. We will restore all the data. Email to contact us - [email protected] Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. Your personal ID: 304-BAC-7BC
Emails
Signatures
- Balaclava Malware
Balaclava malware is a ransomware program.
- Detects Zeppelin payload 17 IoCs
resource yara_rule behavioral2/files/0x0008000000023268-24.dat family_zeppelin behavioral2/memory/3540-28-0x0000000000730000-0x0000000000870000-memory.dmp family_zeppelin behavioral2/memory/3712-51-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3712-55-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/4340-56-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-1941-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-3068-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-5009-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-7431-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-8919-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-10665-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-13097-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-14227-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-14229-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-14231-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-14233-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin behavioral2/memory/3096-14235-0x0000000000800000-0x0000000000940000-memory.dmp family_zeppelin - Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (3439) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.exe - Executes dropped EXE 3 IoCs
pid Process 3712 spoolsv.exe 3096 spoolsv.exe 4340 spoolsv.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\spoolsv.exe\" -start" f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: spoolsv.exe File opened (read-only) \??\L: spoolsv.exe File opened (read-only) \??\I: spoolsv.exe File opened (read-only) \??\W: spoolsv.exe File opened (read-only) \??\V: spoolsv.exe File opened (read-only) \??\S: spoolsv.exe File opened (read-only) \??\R: spoolsv.exe File opened (read-only) \??\Q: spoolsv.exe File opened (read-only) \??\G: spoolsv.exe File opened (read-only) \??\A: spoolsv.exe File opened (read-only) \??\Y: spoolsv.exe File opened (read-only) \??\X: spoolsv.exe File opened (read-only) \??\Z: spoolsv.exe File opened (read-only) \??\U: spoolsv.exe File opened (read-only) \??\K: spoolsv.exe File opened (read-only) \??\E: spoolsv.exe File opened (read-only) \??\B: spoolsv.exe File opened (read-only) \??\H: spoolsv.exe File opened (read-only) \??\T: spoolsv.exe File opened (read-only) \??\P: spoolsv.exe File opened (read-only) \??\N: spoolsv.exe File opened (read-only) \??\M: spoolsv.exe File opened (read-only) \??\J: spoolsv.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 40 iplogger.org 38 iplogger.org - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 geoiptool.com - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ka.txt spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\MSWDS_FR.LEX.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.WPG spoolsv.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\PREVIEW.GIF.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML spoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c spoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar spoolsv.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\RECOVERY DATA INFORMATION.TXT spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management-agent.jar.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html spoolsv.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\RECOVERY DATA INFORMATION.TXT spoolsv.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALN.TTF spoolsv.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\RECOVERY DATA INFORMATION.TXT spoolsv.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms spoolsv.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\RECOVERY DATA INFORMATION.TXT spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\GIFIMP32.FLT spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\orcl7.xsl spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\MSWDS_ES.LEX.304-BAC-7BC spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4 spoolsv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.304-BAC-7BC spoolsv.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1760 WMIC.exe Token: SeSecurityPrivilege 1760 WMIC.exe Token: SeTakeOwnershipPrivilege 1760 WMIC.exe Token: SeLoadDriverPrivilege 1760 WMIC.exe Token: SeSystemProfilePrivilege 1760 WMIC.exe Token: SeSystemtimePrivilege 1760 WMIC.exe Token: SeProfSingleProcessPrivilege 1760 WMIC.exe Token: SeIncBasePriorityPrivilege 1760 WMIC.exe Token: SeCreatePagefilePrivilege 1760 WMIC.exe Token: SeBackupPrivilege 1760 WMIC.exe Token: SeRestorePrivilege 1760 WMIC.exe Token: SeShutdownPrivilege 1760 WMIC.exe Token: SeDebugPrivilege 1760 WMIC.exe Token: SeSystemEnvironmentPrivilege 1760 WMIC.exe Token: SeRemoteShutdownPrivilege 1760 WMIC.exe Token: SeUndockPrivilege 1760 WMIC.exe Token: SeManageVolumePrivilege 1760 WMIC.exe Token: 33 1760 WMIC.exe Token: 34 1760 WMIC.exe Token: 35 1760 WMIC.exe Token: 36 1760 WMIC.exe Token: SeIncreaseQuotaPrivilege 3544 WMIC.exe Token: SeSecurityPrivilege 3544 WMIC.exe Token: SeTakeOwnershipPrivilege 3544 WMIC.exe Token: SeLoadDriverPrivilege 3544 WMIC.exe Token: SeSystemProfilePrivilege 3544 WMIC.exe Token: SeSystemtimePrivilege 3544 WMIC.exe Token: SeProfSingleProcessPrivilege 3544 WMIC.exe Token: SeIncBasePriorityPrivilege 3544 WMIC.exe Token: SeCreatePagefilePrivilege 3544 WMIC.exe Token: SeBackupPrivilege 3544 WMIC.exe Token: SeRestorePrivilege 3544 WMIC.exe Token: SeShutdownPrivilege 3544 WMIC.exe Token: SeDebugPrivilege 3544 WMIC.exe Token: SeSystemEnvironmentPrivilege 3544 WMIC.exe Token: SeRemoteShutdownPrivilege 3544 WMIC.exe Token: SeUndockPrivilege 3544 WMIC.exe Token: SeManageVolumePrivilege 3544 WMIC.exe Token: 33 3544 WMIC.exe Token: 34 3544 WMIC.exe Token: 35 3544 WMIC.exe Token: 36 3544 WMIC.exe Token: SeIncreaseQuotaPrivilege 1760 WMIC.exe Token: SeSecurityPrivilege 1760 WMIC.exe Token: SeTakeOwnershipPrivilege 1760 WMIC.exe Token: SeLoadDriverPrivilege 1760 WMIC.exe Token: SeSystemProfilePrivilege 1760 WMIC.exe Token: SeSystemtimePrivilege 1760 WMIC.exe Token: SeProfSingleProcessPrivilege 1760 WMIC.exe Token: SeIncBasePriorityPrivilege 1760 WMIC.exe Token: SeCreatePagefilePrivilege 1760 WMIC.exe Token: SeBackupPrivilege 1760 WMIC.exe Token: SeRestorePrivilege 1760 WMIC.exe Token: SeShutdownPrivilege 1760 WMIC.exe Token: SeDebugPrivilege 1760 WMIC.exe Token: SeSystemEnvironmentPrivilege 1760 WMIC.exe Token: SeRemoteShutdownPrivilege 1760 WMIC.exe Token: SeUndockPrivilege 1760 WMIC.exe Token: SeManageVolumePrivilege 1760 WMIC.exe Token: 33 1760 WMIC.exe Token: 34 1760 WMIC.exe Token: 35 1760 WMIC.exe Token: 36 1760 WMIC.exe Token: SeIncreaseQuotaPrivilege 3544 WMIC.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3540 wrote to memory of 3712 3540 f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.exe 91 PID 3540 wrote to memory of 3712 3540 f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.exe 91 PID 3540 wrote to memory of 3712 3540 f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.exe 91 PID 3712 wrote to memory of 3308 3712 spoolsv.exe 100 PID 3712 wrote to memory of 3308 3712 spoolsv.exe 100 PID 3712 wrote to memory of 3308 3712 spoolsv.exe 100 PID 3712 wrote to memory of 404 3712 spoolsv.exe 101 PID 3712 wrote to memory of 404 3712 spoolsv.exe 101 PID 3712 wrote to memory of 404 3712 spoolsv.exe 101 PID 3712 wrote to memory of 3052 3712 spoolsv.exe 102 PID 3712 wrote to memory of 3052 3712 spoolsv.exe 102 PID 3712 wrote to memory of 3052 3712 spoolsv.exe 102 PID 3712 wrote to memory of 1864 3712 spoolsv.exe 103 PID 3712 wrote to memory of 1864 3712 spoolsv.exe 103 PID 3712 wrote to memory of 1864 3712 spoolsv.exe 103 PID 3712 wrote to memory of 3332 3712 spoolsv.exe 104 PID 3712 wrote to memory of 3332 3712 spoolsv.exe 104 PID 3712 wrote to memory of 3332 3712 spoolsv.exe 104 PID 3712 wrote to memory of 2300 3712 spoolsv.exe 105 PID 3712 wrote to memory of 2300 3712 spoolsv.exe 105 PID 3712 wrote to memory of 2300 3712 spoolsv.exe 105 PID 3712 wrote to memory of 3096 3712 spoolsv.exe 106 PID 3712 wrote to memory of 3096 3712 spoolsv.exe 106 PID 3712 wrote to memory of 3096 3712 spoolsv.exe 106 PID 3712 wrote to memory of 4340 3712 spoolsv.exe 107 PID 3712 wrote to memory of 4340 3712 spoolsv.exe 107 PID 3712 wrote to memory of 4340 3712 spoolsv.exe 107 PID 3308 wrote to memory of 3544 3308 cmd.exe 114 PID 3308 wrote to memory of 3544 3308 cmd.exe 114 PID 3308 wrote to memory of 3544 3308 cmd.exe 114 PID 2300 wrote to memory of 1760 2300 cmd.exe 115 PID 2300 wrote to memory of 1760 2300 cmd.exe 115 PID 2300 wrote to memory of 1760 2300 cmd.exe 115 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.exe"C:\Users\Admin\AppData\Local\Temp\f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -start2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no3⤵PID:404
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵PID:3052
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet3⤵PID:1864
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet3⤵PID:3332
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -agent 03⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3096
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -agent 13⤵
- Executes dropped EXE
PID:4340
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3084
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:2204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\Lang\RECOVERY DATA INFORMATION.TXT
- Size 1KB
- SHA256 f6fe8a339dc94d3f03281f167f9fba13f9586e45faaff8c5762bb706e1fd9718
- MD5 2a0527d06f8d54ffff394a617e01cc96
- SHA1 0cb3978290eefb1564384d37b9e4a0cef69e4521
- SHA512 e15cc16d44a371461f5b8a28a675b248c93103f31c3e1f1cf50a772b3e5baf83da92e2c114b81c6085154040d02fa86669165a2fe84afaa41ed30115bd078531
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX
- Size 292KB
- SHA256 8f5d4e8fdb88c190364532f991154c802adc6f3dfbef0ba237f81b59de7bf76e
- MD5 6b796ca92b7681dd3f0fef6f23f660d6
- SHA1 191096b3a61d67607286cd78958a32271dc02ca1
- SHA512 10846b584a2d1220623e6ced7edcbeea1a158e41059b8e219ff505c56824d532e1c97e5321cabda996fc116066af64736a0733ed4d6e04a350346d9e8bc28250
- SSDEEP 6144:y7ptVPrJ5gP3BNld+ESK/O4CgEo6qCgDBJ4cEqhN4ARfb8h:y7BluJQESK/b5IfgNKDqhN4M8h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp64.msi
- Size 2.4MB
- SHA256 c33dcb85107d7b8be09e26f44c7239fe0492e25f922f4d13195c5ed051f1ff1b
- MD5 7bd77637d0677c1a3a70b7cd55e6910f
- SHA1 7a585a2a117090e25ee9c52bb8c3b937c0779422
- SHA512 fb9de4ebedc7451db6e1f898e0a53dbc448f77308973b2a88d2ca0220baefe968c8c25f0083b8f523ca51276f80e67411cabea0d969d9ceac78b4e75289d83ae
- SSDEEP 49152:mVz6v5jaQgQC1t7ZfxRnYleaZshcuRY18k0ifSn:m0vRQjdJGsQ2U8WfSn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe
- Size 62KB
- SHA256 7bbebd2a34047217d2880f9fa86eb14f3f8b686e561cf0d70c0ec1fc479e3107
- MD5 299748178fd5927ea6242752b4803849
- SHA1 9c0cf5248eb29bddf589c1cacac7c6a56e52010f
- SHA512 2c2c37ea7f65ddbba2cdfcfbb49e92ef8e300ce9aee617d4249a5592ecc36b7e5acef0b22eda6b7ad87340ad4a7e68fb4eb34248195221129527c82176e88919
- SSDEEP 1536:ybeW3WntTO6+XOaz3hb2yTJcOnbnOBPNJT/e0dygeX+M0vnV:XW3W3+XO8AyPaBPNZeTgeX+dV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
- Size 1015KB
- SHA256 39ffeeb975683fd755c12e5a37a2d9f96e8072fc892ca5e9b483cd0da315a115
- MD5 fa3ac699024df40e076d98739e088ce4
- SHA1 8d410563ddb51dbeb262b2b47402ed069812e18b
- SHA512 dc34c8c355dc3e7e65d64e423d0b34ee5f29e95277cc9579ed7b5e4929f276ba9cc9be02a2baef0e8a9b8fe1f7123399fa1d58b81aa5941472e3e488ff9e8b93
- SSDEEP 12288:BvHMwZ0Cxe+Ym+CWDNVFTX3vUMTkkXU5mOF/L0CSWt1Ut7i:BvHrZa+YLCUcMfXsmOJbL1+i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo
- Size 604KB
- SHA256 a7223b7ef70f11ac4d7e7ea088a4434cbdce094e428ab91451d66e71eca640e8
- MD5 4e10dc48fdc5f8cfdd4a1667c5c1628f
- SHA1 def34f1d4a201da1b9f25b669389e607c27f2276
- SHA512 1d118107bd5d0cc2e7ff50348ea71335d5cdd0a162a7c487707a8c10589ecd4d39cf890a37e027b20a1393f21215e053ebe4aba9719d1ca5c136622d4a591e93
- SSDEEP 12288:E0KI8X0Q8C7heLU2Eo3Xh+TtG6F7/lFhlwjrlC8qIG40CXU+P3z9saGfGoBg:SDX2CNcU2Hnwlrmk8qIGWkicOoO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo
- Size 606KB
- SHA256 aabddb92cb8ec58b482a20c7b14ed338daa99b02752dd8105a2409fb1f4d5284
- MD5 446a43c2cf880118e116f23e6ab19253
- SHA1 d50a8029ec2db98403dacc02815a55481c85e3a5
- SHA512 843c1080c08afd2dad6e99e0068875d3a6ec3cf6761846634db247d226bd5c2448f8b439cb7060d44accbbca5c8440f70a76f7331184d3855fec15094e724f54
- SSDEEP 12288:EZlWH/PwRmTiIWUR0LJCtCJ0Iu/8POPF23oUQW:YCP04iITiLJqCJTu8PC23oU1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo
- Size 785KB
- SHA256 587110551de817acb4ae4bd0872ccaadbca7f75eb7d0a9362d71cc1bf1b1de20
- MD5 aed8719d33f193f3efcbbcd13c0189d9
- SHA1 a4c99135e7790b41be96c3db69791021a96ea599
- SHA512 bd638b2e986cf7e19f7aa152b6631275a61567e21ab584ab00e4bb145063354e4f2a9f82b8b2f5936a46e189b2d041efe820d63c47b25e937108eb98170feed6
- SSDEEP 12288:Kq2NW+vVt/TU9fmSFpsTtJentzTFxH7X0ocve8ok7cgdO:5lED/T+TYtJent37IIC7K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo
- Size 587KB
- SHA256 9a4be1a95f6d8e65bb937c327c0ccdc5b49c1f9ab409616b94126ee7c3021c01
- MD5 e6e434ffb04e959be4325f5bb960cce8
- SHA1 4ab54cd7ea86988572545ffbab09ea5644c790f6
- SHA512 73b8446a338a382435e25614cefa7f40beebe792ee3088361389847e8fa1192203bcc25e7de6c12bd54b44444e0bb56917b01365be4ef21b27205df07d5c3b0f
- SSDEEP 12288:vukFAn4YC79h+DzDy9L41aVO4eCaiJ+1EymCHXYmMh:mDn6+Tyy1CheCaiJ+iymC3Y/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo
- Size 527KB
- SHA256 ab752e8c275369b39ef84776d95f92248d783f9c6e2df64a3096e83ffd03aaba
- MD5 e52ed69b8da54e38c7060ec724f26e8d
- SHA1 203c54e31cfec3f175803b0c6fb5105036aa830d
- SHA512 1f6ad587accbd52b3196b7f93bf8d5b1ea8de57c4d10f381b121c998dae635acdf07466e6fe9276a92c10be46e00d8a8523f9ccf6b2b798001a3f09aa61ae88b
- SSDEEP 12288:qmv3p0eRlZZWL5P+ZncYtUM1Kyj19es5hi/BE9K2xfTCn:zyeTHWP+ZnccUqKypRbRocS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo
- Size 621KB
- SHA256 6902555147627541e1ce1b01ee602bcaf61f5ced55b15f13d7b869e77cc2c883
- MD5 5526fffc7a8aaa7e8e3e039e430876c0
- SHA1 60fba52c52b294ceee11b32e517ebf07b4bd28b9
- SHA512 4a4379dd5738310d1c65489d0a5f0d09831ac55953dbcf5b3d25a8d5c63de57160d14b298637ff579239bf315f4e34b74d398494baef052af8eb05c04207fc75
- SSDEEP 12288:/CjlUFplSa4CV143ZlwD1vmBbb3Ter+cUsT0CkDsXaC5wSN4zc/J:/M+pEatQLwBvI/3Te/NqChSI/J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo
- Size 771KB
- SHA256 a0dbbdfeee6456295e993621e3cd6e6eabf132e2b5a9370d80a2f1149825a508
- MD5 0735301b1e60778012d798d5043c4e16
- SHA1 d6d0e0363bab619d3c1bb64fbaeb0d1e4ebcbe6e
- SHA512 33b9b0939a2b9d4e66c733318f563b6428dd131039b8dab6d2637c2bdd4f392661f4127620c91fae59220fec99377723b5f18bf463b073a9f3c88f37fd2bbd01
- SSDEEP 12288:YbB3ZwFjUuhW35xby8Ses8ANa00PPy4tDwzjuFbVSRaruDEZw3XCd2WPv1Fr:YbBZwFzW359yf3JatzcKAaFGXCd2E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
- Size 2KB
- SHA256 0b38c2b473c1e02da927633233632da350f216e558cffdcd8da705d6d376ef9a
- MD5 6bfced3d108f9e5aa027f414cfe238e0
- SHA1 8a2ed4d19bd317e6ee0e7d25facd84955d1f5eb8
- SHA512 0599eebdb98cad52c6087a081449477f38c62cb76fa2bc60797574c329769063dff6f7ccbb8912bfe95467c4fe361a64fba86e0861bc401f36c364ac0ae660c8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_3F2A9DB42365395CA97CFD2FA38D17E4
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1230D967FD647CD5194F3FFA6C7E7E4
- Size 144KB
- SHA256 bb9b8cccfaf1896caf4533e139bf9e8278f3451b20f3244e4a540f45432c8166
- MD5 66b6a26fc52329aef1228a78776ad59e
- SHA1 c31d1841e1f555b1f7b475368e2d515fa7753324
- SHA512 b834697654cedf2a59b2eb1ebd9f5f98c4c42c48359f051d969235e148a5f32b7ecc5073dec72b880328714c5445e7da3053596fb6b8db0cf1118f59f96978be
- SSDEEP 1536:PrtHkkDndZoPGVqRvRkx16+M0Zh3th9ZG7EABWLOMNRhm2TO8vxz/I9hJqlZLk2:PND4OmRYo0ZhdJLNVOUTKhA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
- Size 1KB
- SHA256 de15c1206295e29c2f646e44c26be75afe8e9ddc121f0a12c5097f2546f2e9ac
- MD5 4364933eb6dd73008e0616e0cf50c1d1
- SHA1 d3c132bc1398039890f604587533015045dc3733
- SHA512 63372c5abfe5066a4365184a1d5af1716b8296ac3630cde403ec0f86e8df59014d3f9facee4fb9c0fe87baa9202466984575f3acf436e00b3ee3830adb78c51f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
- Size 484B
- SHA256 bb4ec653c46621fff105ea7d471b08888e14d261fbc9bc02348b0d7d224e1b51
- MD5 81445bde639b2f633179a3111a62b07a
- SHA1 1d51948e1820f8816c7efeebe6053d45ea893907
- SHA512 51901adcfc0820d40ddd7dd53421550191f0f9f7f05b3ee8163334febbd820b67323ac62e34abe061373a33885b0f4d9b5be4b2677f3be0e3d3411bf7cd01d68
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_3F2A9DB42365395CA97CFD2FA38D17E4
- Size 402B
- SHA256 2f0ba1c8a71222a8409472698ffdb09097b85e1af40054962f82c6cb0e659cd0
- MD5 bf4492703279f8fd817155f62154f29f
- SHA1 28da19a7bd4ed32141a38fb177385841936cdbe7
- SHA512 ef7070d0fe1269eb56e3452b37bbad829b558cd378cd54afa969edace0441f429f569bc0adaab23cca88cf75e80a755572aa9dc347acb7f036dedcd6b6cffc68
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1230D967FD647CD5194F3FFA6C7E7E4
- Size 292B
- SHA256 91ba8d6ef1ed0e395a7a0a40f6f463f36fe495142d0f6d861579a8e249e9e3a4
- MD5 413d81ff6f6e36312a79a1ff7a42ad7d
- SHA1 804a23bfd4b805a58081b58519638d530af37d72
- SHA512 fe47f4d39f5d9ce98efab331f8153dc33f32be79db01e18ee66986d34a5af8a8f6aa800bc9504a0557c0ee938c258e5afc901ef048f40754827f3511a28f1689
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
- Size 482B
- SHA256 8bb58a2f6398f09e957c0499a0093cde6a75a5dad61531e06667ff85bac8605d
- MD5 9c6764be0b3fd133ef8fb543d6763b43
- SHA1 677b92fecc34ff15fa2ea694dae62db9a6b07592
- SHA512 868ce3c1ffbb3ae0aa7605f0ea77eb3f9d24d01cc0c4db73e31e00cf213c8d28bcebd07c513e87559fd970283fca97b7409862d4fc6284ecdfa6d228e8c20faf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\5ZK22BN6.htm
- Size 18KB
- SHA256 e40cc25f9a709e182c284705b0b50b448deb4b1b81b456a633638003db77068b
- MD5 46e7f28a55cdab07533424725a04b9e5
- SHA1 48a915fe8958b0882f364b1e0ceb37e7b7948319
- SHA512 717be51be74aa8b36d714f35942d40c8c18bea13a49d293681e16f1b10dfbdf3887a887ca40688348eee38b10ec80c96a17c338378c315c70d4abebfd42e9076
- SSDEEP 384:fmH1fsIRfGJ6nVTJ6nVjJ6nVeJ6nVHJ6nV6J6nVQJ6nVlJ6nVSJ6nVEXiJO2rarc:fmlGSbh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\K1ROHDCR.htm
- Size 190B
- SHA256 a563426e24d132cd87b70d9cb5cd3d57c2e1428873a3f3eb94649cf42e37b6a1
- MD5 6ebbeb8c70d5f8ffc3fb501950468594
- SHA1 c06e60a316e48f5c35d39bcf7ed7e6254957ac9e
- SHA512 75cfab1c9f5a05c892cf3b564aed06d351c6dc40048faea03ae163154ff7635252817d66b72a6ef51c4f895eebf7728f302df51148acce2a0c285502bf13652c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\~temp001.bat
- Size 404B
- SHA256 dc94e21e80522b2cee097064c31a7720d70a02d0c55f290d59030fd0c995cac5
- MD5 78215698f8f9dc7941c9c287642bd02c
- SHA1 633cd0a6c76f080cdb6e0c98034b0b5dd7283a47
- SHA512 c0a05f8cc400855c40b8e8eb3e7f027b06553cc592eb2ab6ad0a8c33ed2d196c7eda358977edc3f34ce1fdbff30efe288725eb10ea463e622ee9eb8085e48f7d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
- Size 212KB
- SHA256 f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb
- MD5 723825ad69a5d55a1e5ed3d1ee831f0d
- SHA1 7e082df63c3de0f8bf9d38edf72ba5268078275a
- SHA512 dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78
- SSDEEP 6144:tia1gMH2EXtAup5Qnqn64DQFu/U3buRKlemZ9DnGAe+hsO6a+8:tIMHxGe5Qb4DQFu/U3buRKlemZ9DnGAb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\vcredist2010_x86.log.html
- Size 83KB
- SHA256 65f191ca53cad8135a9af6d0dfb0c7f1243a07a3ee4756f70e7e320b42e55d42
- MD5 5d60a18d1ab21352470a3d6d0715d67e
- SHA1 66596edc5a07651a145658dc89052548ceebc576
- SHA512 86763606f7de196cee81d40cf1b7d43896cfaeeb1c2ce989b1abf3d368ef2c30deed9740163d163e7b82a0f75a3d5b9697ced423b62ef599ee338f2db82c1ab9
- SSDEEP 1536:PUDIcSYCU+erm1MsSTeYxT93hsu1Qu2bLl6a97TV6p1HpZJBnM:P0IcSlU+eGkeaNh3P2t97TVmRpz5M
- MD5 SHA1 SHA512 SSDEEP