Analysis
- max time kernel
151s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 10:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VirusShare_1d930a54791d56b6c10411570b57d2cb.exe
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
VirusShare_1d930a54791d56b6c10411570b57d2cb.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target VirusShare_1d930a54791d56b6c10411570b57d2cb.exe
- Size 368KB
- Sample240610-msxjragg28
- SHA256 83427ffa553f49bb627045c609b5d4e505f7129616cccce9958f61c084985676
- MD5 1d930a54791d56b6c10411570b57d2cb
- SHA1 f5af265bf35d0e740de05d04873b200d34bed46d
- SHA512 b26f1eefb57d981dba9cac12ccfabd8440af680536e323f05b87d635fb03d89c4bffa0e6fce3ba6c43222c4755077a4de98ba6ee9defce3597e12767237f6e03
- SSDEEP 6144:iBVsLLdsgLTCEUyQETKuSkPZ5PMVhewjAn6EYIW2gBsKTp0aLXWoRRBJY9HJJRws:VV3hLQET9P5UP06E+HsKl0aLNbs
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\PerfLogs\+-xxx-HELP-xxx-+nioms-+.txt
Ransom Note
- ---------------------------------------------------- NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://9hrds.wolfcrap.at/1638ED9D9FCDAA7 http://6g4ds.froekuge.com/1638ED9D9FCDAA7 http://vewrb.italisumo.at/1638ED9D9FCDAA7 If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/1638ED9D9FCDAA7 *** Follow instructions on your screen !!! *** *** *** *** *** *** *** IMPORTANT INFORMATION *** *** *** *** *** *** Your personal homepages http://9hrds.wolfcrap.at/1638ED9D9FCDAA7 http://6g4ds.froekuge.com/1638ED9D9FCDAA7 http://vewrb.italisumo.at/1638ED9D9FCDAA7 Your personal homepage Tor-Browser k7tlx3ghr3m4n2tu.onion/1638ED9D9FCDAA7 Your personal ID 1638ED9D9FCDAA7
URLs
-
http://9hrds.wolfcrap.at/1638ED9D9FCDAA7
-
http://6g4ds.froekuge.com/1638ED9D9FCDAA7
-
http://vewrb.italisumo.at/1638ED9D9FCDAA7
-
http://k7tlx3ghr3m4n2tu.onion/1638ED9D9FCDAA7
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation VirusShare_1d930a54791d56b6c10411570b57d2cb.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation kvdfuxd.exe - Executes dropped EXE 2 IoCs
pid Process 2364 kvdfuxd.exe 5296 kvdfuxd.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svc-rkam = "C:\\Windows\\system32\\cmd /C start \" \" \"C:\\Users\\Admin\\Documents\\kvdfuxd.exe\"" kvdfuxd.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2428 set thread context of 5996 2428 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 99 PID 2364 set thread context of 5296 2364 kvdfuxd.exe 104 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\offlineUtilities.js kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-30_contrast-black.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-fullcolor.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\LockScreenBadgeLogo.scale-100.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_contrast-black.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\Fonts\+-xxx-HELP-xxx-+nioms-+.html kvdfuxd.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lv-LV\+-xxx-HELP-xxx-+nioms-+.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-125_contrast-white.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-lightunplated.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_altform-unplated_contrast-black.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200_contrast-high.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxSmallTile.scale-200.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-256_altform-unplated_contrast-black.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\LargeTile.scale-125.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-48_altform-unplated.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\MoveToFolderToastQuickAction.scale-80.png kvdfuxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-black_scale-125.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-400_contrast-black.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60_altform-unplated_contrast-white.png kvdfuxd.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\+-xxx-HELP-xxx-+nioms-+.html kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\Microsoft Office\+-xxx-HELP-xxx-+nioms-+.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-400.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-96.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-400.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\WideTile.scale-100.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\+-xxx-HELP-xxx-+nioms-+.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-32_contrast-white.png kvdfuxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\+-xxx-HELP-xxx-+nioms-+.html kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare150x150Logo.scale-125_contrast-white.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\+-xxx-HELP-xxx-+nioms-+.html kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\save-money.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-125.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\MedTile.scale-200.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Sounds\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-16_altform-unplated.png kvdfuxd.exe File opened for modification C:\Program Files\Windows Media Player\+-xxx-HELP-xxx-+nioms-+.html kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-200.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe\+-xxx-HELP-xxx-+nioms-+.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\174.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-150.png kvdfuxd.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Heart.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSmallTile.scale-150.png kvdfuxd.exe File opened for modification C:\Program Files\dotnet\host\+-xxx-HELP-xxx-+nioms-+.html kvdfuxd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-256_altform-unplated.png kvdfuxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\+-xxx-HELP-xxx-+nioms-+.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-150.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-100.png kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\+-xxx-HELP-xxx-+nioms-+.png kvdfuxd.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\+-xxx-HELP-xxx-+nioms-+.png kvdfuxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\+-xxx-HELP-xxx-+nioms-+.txt kvdfuxd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png kvdfuxd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2440 vssadmin.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\trueimg kvdfuxd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe 5296 kvdfuxd.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5296 kvdfuxd.exe Token: SeBackupPrivilege 2964 vssvc.exe Token: SeRestorePrivilege 2964 vssvc.exe Token: SeAuditPrivilege 2964 vssvc.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2428 wrote to memory of 5996 2428 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 99 PID 2428 wrote to memory of 5996 2428 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 99 PID 2428 wrote to memory of 5996 2428 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 99 PID 2428 wrote to memory of 5996 2428 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 99 PID 2428 wrote to memory of 5996 2428 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 99 PID 2428 wrote to memory of 5996 2428 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 99 PID 2428 wrote to memory of 5996 2428 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 99 PID 2428 wrote to memory of 5996 2428 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 99 PID 2428 wrote to memory of 5996 2428 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 99 PID 2428 wrote to memory of 5996 2428 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 99 PID 5996 wrote to memory of 2364 5996 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 100 PID 5996 wrote to memory of 2364 5996 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 100 PID 5996 wrote to memory of 2364 5996 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 100 PID 5996 wrote to memory of 3308 5996 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 101 PID 5996 wrote to memory of 3308 5996 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 101 PID 5996 wrote to memory of 3308 5996 VirusShare_1d930a54791d56b6c10411570b57d2cb.exe 101 PID 2364 wrote to memory of 5296 2364 kvdfuxd.exe 104 PID 2364 wrote to memory of 5296 2364 kvdfuxd.exe 104 PID 2364 wrote to memory of 5296 2364 kvdfuxd.exe 104 PID 2364 wrote to memory of 5296 2364 kvdfuxd.exe 104 PID 2364 wrote to memory of 5296 2364 kvdfuxd.exe 104 PID 2364 wrote to memory of 5296 2364 kvdfuxd.exe 104 PID 2364 wrote to memory of 5296 2364 kvdfuxd.exe 104 PID 2364 wrote to memory of 5296 2364 kvdfuxd.exe 104 PID 2364 wrote to memory of 5296 2364 kvdfuxd.exe 104 PID 2364 wrote to memory of 5296 2364 kvdfuxd.exe 104 PID 5296 wrote to memory of 2440 5296 kvdfuxd.exe 105 PID 5296 wrote to memory of 2440 5296 kvdfuxd.exe 105 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_1d930a54791d56b6c10411570b57d2cb.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_1d930a54791d56b6c10411570b57d2cb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\VirusShare_1d930a54791d56b6c10411570b57d2cb.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_1d930a54791d56b6c10411570b57d2cb.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\Documents\kvdfuxd.exeC:\Users\Admin\Documents\kvdfuxd.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\Documents\kvdfuxd.exeC:\Users\Admin\Documents\kvdfuxd.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:2440
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL3⤵PID:3308
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3904 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵PID:1004
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PerfLogs\+-xxx-HELP-xxx-+nioms-+.html
- Size 6KB
- SHA256 60239874064263c5ca72fa54b6078546f56727f10fd9ee94c1833c7fd2fcebcc
- MD5 a279f7d3d0b71bbcd8c4803dd1df36c1
- SHA1 40ab239a8fa063ce0aeb4affb7e31f7b555e6612
- SHA512 50cef28150b1a1b39ea21c2bfbf21ea670411e0896267c3519ec2f329434d2ac2e2592db286cc1d22ed00fd513fe462b20d14d7580cae176e76a146f136bc3cb
- SSDEEP 192:uqcpqMYjB2JcDDdEBuzcdlu8xCi0oEqxUTrm:6BYt2Jiddziu8xCi0Hmk6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PerfLogs\+-xxx-HELP-xxx-+nioms-+.png
- Size 75KB
- SHA256 90daff7283d273250c01549b6e99ae5cd3ce29f75135f0a6b9f01b17d64b6261
- MD5 a7337df1c9343c75c48d5fce0137e4f4
- SHA1 bd67db0abf43cf00be0a1f5ece22f05ff84eb0e4
- SHA512 bd1d84d6a371afe0a27a9781c52e7fb22064f4f439a0c532f38564b7ed33655bc50734cc16a5150f7c0f89006790bb44dd7187321bd9c5d7921a3e6299722dad
- SSDEEP 1536:yxdfhWC3YSF9AjmEHlRw7gk4TGq/BTAo+F/KxZ2oVttFy9BZ72:8wSC6Efw7gk43dAo+FixfVtK9f72
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PerfLogs\+-xxx-HELP-xxx-+nioms-+.txt
- Size 2KB
- SHA256 85248d6c0f0e74ff91f97c386e9e30f1b84bc4904ac36f7ba5413f08193a5924
- MD5 87e6d0ba12d600f2de2a7e0bb1fa3763
- SHA1 4862957c8f3e883cd210c82276ad6625544fa2d1
- SHA512 a897ca34dc945e5e4d6aee9ade6ece3d10a22691d800d1d88a6842f22e71f622d7247f4bf7135991de67919d9b2439bf3dee574ec317c4d27752bc3909d9d585
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Documents\kvdfuxd.exe
- Size 368KB
- SHA256 83427ffa553f49bb627045c609b5d4e505f7129616cccce9958f61c084985676
- MD5 1d930a54791d56b6c10411570b57d2cb
- SHA1 f5af265bf35d0e740de05d04873b200d34bed46d
- SHA512 b26f1eefb57d981dba9cac12ccfabd8440af680536e323f05b87d635fb03d89c4bffa0e6fce3ba6c43222c4755077a4de98ba6ee9defce3597e12767237f6e03
- SSDEEP 6144:iBVsLLdsgLTCEUyQETKuSkPZ5PMVhewjAn6EYIW2gBsKTp0aLXWoRRBJY9HJJRws:VV3hLQET9P5UP06E+HsKl0aLNbs
- MD5 SHA1 SHA512 SSDEEP