Analysis
-
max time kernel
9s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09-06-2024 18:37
Static task
static1
Behavioral task
behavioral1
Sample
b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe
Resource
win10v2004-20240508-en
General
-
Target
b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe
-
Size
1.2MB
-
MD5
44a259805268ce9dafc43aebfbb5e40f
-
SHA1
fc6880a063418ecdcb9db640612a4d5ecedaeeb2
-
SHA256
b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb
-
SHA512
1f1db6827ef29189e75f06f85608120202d096169127e189d6e4061a8cd1caa42b1a91587cf4f8602ecfde0908642d0388141fe44eef939a44f687a86531923b
-
SSDEEP
12288:p6SlL8qX0+SWaAg0Rj1aV1RY7Q6/gnKmcMdsx/3Ot3s8fjVOJ/i6h62G0Go01x4y:p6SlL8qX0+S/0RstwxA8M
Malware Config
Extracted
C:\Users\Admin\Desktop\_HELP_HELP_HELP_CC86QNJK_.hta
http://p27dokhpz2n7nvgr.tor2web.org/6A10-8F58-F0A2-0006-4656http://p27dokhpz2n7nvgr.onion.link/6A10-8F58-F0A2-0006-4656http://p27dokhpz2n7nvgr.onion.nu/6A10-8F58-F0A2-0006-4656http://p27dokhpz2n7nvgr.onion.cab/6A10-8F58-F0A2-0006-4656http://p27dokhpz2n7nvgr.onion.to/6A10-8F58-F0A2-0006-4656
http://p27dokhpz2n7nvgr.onion/6A10-8F58-F0A2-0006-4656
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1095) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2913.bmp" b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\steam b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\thunderbird b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files\ b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\microsoft\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\microsoft\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\the bat! b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\microsoft\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\ b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\bitcoin b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\program files (x86)\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\ b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2284 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1680 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2468 b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2468 b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe"C:\Users\Admin\AppData\Local\Temp\b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe"1⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_HELP_HELP_HELP_CC86QNJK_.hta"2⤵PID:2556
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵PID:2924
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "b118f7bfeb377d3944bc7a7d3b7c907967ad6669697df69a036060328d4bc1eb.exe"3⤵
- Kills process with taskkill
PID:2284
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:1680
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵PID:2856
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
73KB
MD52b79885c6d3d0458894ff62ea2101b4b
SHA11dd90ef87d2607c90f89c95b829dde27566b9036
SHA256ad58d27d7c28c6c5bcd3e043017771eb00620ce63bda16577e569b81e5b4e54e
SHA512733909c1c5b27d48dcbfcbf74565acb6fd7e96e310dd80ae0064cb5ec42709de44396de4d58c87f268ad060e580673f2c134fec5067775995d423f1d15ce1bb2
-
Filesize
426KB
MD5761daa435ce3368018f3b0ea1f682b7f
SHA11d2b8bc4408033a294f4d9e0bdada2ec7877e5ba
SHA256ff25bbccad4b51fc75729b86daf74b8f2aca8132b2e09f67d96f147267b0f62e
SHA512fee8299e0aa64f72de11399f0cefc5686fe67e8b2e82e9c359dd3f8dfb93e69419bcf8b8ce48d215843249508259387d628c1c41dc85fe9605db62e8e4c4d657