Analysis
- max time kernel
150s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 10:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe
- Size 388KB
- Sample240610-mreybagf73
- SHA256 a26a0cad5a16fb9c971fe4f4cd0a94134102923d8ac37d208434bc9bf3b66195
- MD5 11dc4c02d1217da78f3242f4bfcd58e0
- SHA1 c72ef51760802755b1c83d42b7365389a89b1ef1
- SHA512 83627f93578bf9188687f188952d09b40188fa0a0a4786851799ad637d3e44013af74a231d43d41da1f174804d7427ec54c8a97589444389580c0382b2980cf3
- SSDEEP 6144:+da8uOhcMWhqVln4xKDutRCbAjFLOSO6/NvsHJxc00d+DzRLITiNs:ga8ivhqVl+K6tokjQSO62DzRLm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Program Files\7-Zip\Lang\HELP_RESTORE_FILES.txt
Ransom Note
- All your documents, photos, databases and other important files have been encrypted with strongest encryption RSA-2048 key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main encryptor red window, examine it and follow the instructions. Otherwise, it seems that you or your antivirus deleted the encryptor program. Now you have the last chance to decrypt your files. Open http://tkj3higtqlvohs7z.aw49f4j3n26.com or http://tkj3higtqlvohs7z.dfj3d8w3n27.com , https://tkj3higtqlvohs7z.s5.tor-gateways.de/ in your browser. They are public gates to the secret server. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 1LMTVJkhioTNKEh6f75zZnFnoqsrec9m3L Follow the instructions on the server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://tkj3higtqlvohs7z.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 1LMTVJkhioTNKEh6f75zZnFnoqsrec9m3L Follow the instructions on the server.
Wallets
-
1LMTVJkhioTNKEh6f75zZnFnoqsrec9m3L
URLs
-
http://tkj3higtqlvohs7z.aw49f4j3n26.com
-
http://tkj3higtqlvohs7z.dfj3d8w3n27.com
-
https://tkj3higtqlvohs7z.s5.tor-gateways.de/
-
http://tkj3higtqlvohs7z.onion/
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (705) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation xgnijly.exe - Executes dropped EXE 2 IoCs
pid Process 4540 xgnijly.exe 1316 xgnijly.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdedf = "C:\\Users\\Admin\\AppData\\Roaming\\xgnijly.exe" xgnijly.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msdedf = "C:\\Users\\Admin\\AppData\\Roaming\\xgnijly.exe" xgnijly.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ipinfo.io - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\HeLP_ReSTORe_FILeS.bmp" xgnijly.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1384 set thread context of 4952 1384 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 81 PID 4540 set thread context of 1316 4540 xgnijly.exe 84 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\LargeTile.scale-100.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\IDPValueAssets\PCMobileValueProp.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-200.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-200.png xgnijly.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_SadMouth.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-96_altform-unplated.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-black_scale-200.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-150.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-200.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_contrast-high.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteLargeTile.scale-200.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-200_contrast-white.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\ShareProvider_CopyFile24x24.scale-200.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-125.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-32_contrast-white.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-125_contrast-white.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\7px.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-lightunplated.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lo-LA\View3d\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_altform-lightunplated.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_Objects.jpg xgnijly.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.XlsIO.Base.dll xgnijly.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Resources\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-96_altform-unplated.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\LargeTile.scale-200.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileSmallSquare.scale-200.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GooglePromoTile.scale-200.png xgnijly.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\THMBNAIL.PNG xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-125_contrast-black.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\FetchingMail.scale-150.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-80_altform-unplated.png xgnijly.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll xgnijly.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-100_contrast-black.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-400_contrast-black.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-100.png xgnijly.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\SplashScreen.scale-125.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_ForwardDirection_DeskScale.jpg xgnijly.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-125_contrast-white.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-200_contrast-black.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Studio.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\8080_36x36x32.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-48_altform-lightunplated.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosWideTile.scale-200.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-150.png xgnijly.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-16_altform-unplated.png xgnijly.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt xgnijly.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll xgnijly.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\HELP_RESTORE_FILES.txt xgnijly.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\Unipulator.mp4 xgnijly.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2528 vssadmin.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\WallpaperStyle = "0" xgnijly.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\TileWallpaper = "0" xgnijly.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe 1316 xgnijly.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4952 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe Token: SeDebugPrivilege 1316 xgnijly.exe Token: SeBackupPrivilege 1076 vssvc.exe Token: SeRestorePrivilege 1076 vssvc.exe Token: SeAuditPrivilege 1076 vssvc.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1384 wrote to memory of 4952 1384 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 81 PID 1384 wrote to memory of 4952 1384 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 81 PID 1384 wrote to memory of 4952 1384 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 81 PID 1384 wrote to memory of 4952 1384 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 81 PID 1384 wrote to memory of 4952 1384 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 81 PID 1384 wrote to memory of 4952 1384 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 81 PID 1384 wrote to memory of 4952 1384 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 81 PID 1384 wrote to memory of 4952 1384 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 81 PID 1384 wrote to memory of 4952 1384 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 81 PID 4952 wrote to memory of 4540 4952 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 82 PID 4952 wrote to memory of 4540 4952 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 82 PID 4952 wrote to memory of 4540 4952 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 82 PID 4952 wrote to memory of 652 4952 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 83 PID 4952 wrote to memory of 652 4952 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 83 PID 4952 wrote to memory of 652 4952 VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe 83 PID 4540 wrote to memory of 1316 4540 xgnijly.exe 84 PID 4540 wrote to memory of 1316 4540 xgnijly.exe 84 PID 4540 wrote to memory of 1316 4540 xgnijly.exe 84 PID 4540 wrote to memory of 1316 4540 xgnijly.exe 84 PID 4540 wrote to memory of 1316 4540 xgnijly.exe 84 PID 4540 wrote to memory of 1316 4540 xgnijly.exe 84 PID 4540 wrote to memory of 1316 4540 xgnijly.exe 84 PID 4540 wrote to memory of 1316 4540 xgnijly.exe 84 PID 4540 wrote to memory of 1316 4540 xgnijly.exe 84 PID 1316 wrote to memory of 2528 1316 xgnijly.exe 88 PID 1316 wrote to memory of 2528 1316 xgnijly.exe 88 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xgnijly.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" xgnijly.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exeC:\Users\Admin\AppData\Local\Temp\VirusShare_11dc4c02d1217da78f3242f4bfcd58e0.exe2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Roaming\xgnijly.exeC:\Users\Admin\AppData\Roaming\xgnijly.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Roaming\xgnijly.exeC:\Users\Admin\AppData\Roaming\xgnijly.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1316 -
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet5⤵
- Interacts with shadow copies
PID:2528
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL3⤵PID:652
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\Lang\HELP_RESTORE_FILES.txt
- Size 2KB
- SHA256 a51c12a79d9c736db61d3244334a9bd9209446a3cd8814a700120259ed06c5cd
- MD5 994e04396509550a170408260296419d
- SHA1 51cceaae68d5b306ce02b28e953046e48e668226
- SHA512 1102101beed226b77d0286f32683698a9699faf467e96a459ffc34fe3987db12c68a7e4157c689dea81c8914f28164b0a9fc66bb0a77803638bf195f9415b01c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\xgnijly.exe
- Size 388KB
- SHA256 a26a0cad5a16fb9c971fe4f4cd0a94134102923d8ac37d208434bc9bf3b66195
- MD5 11dc4c02d1217da78f3242f4bfcd58e0
- SHA1 c72ef51760802755b1c83d42b7365389a89b1ef1
- SHA512 83627f93578bf9188687f188952d09b40188fa0a0a4786851799ad637d3e44013af74a231d43d41da1f174804d7427ec54c8a97589444389580c0382b2980cf3
- SSDEEP 6144:+da8uOhcMWhqVln4xKDutRCbAjFLOSO6/NvsHJxc00d+DzRLITiNs:ga8ivhqVl+K6tokjQSO62DzRLm
- MD5 SHA1 SHA512 SSDEEP