Analysis
- max time kernel
154s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 10:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VirusShare_248d88b4e968eec216ac3c06550522a1.exe
Resource
win7-20240221-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
VirusShare_248d88b4e968eec216ac3c06550522a1.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target VirusShare_248d88b4e968eec216ac3c06550522a1.exe
- Size 332KB
- Sample240610-mt1ykagg54
- SHA256 df4d8bdc2be2de41b265d510744c2083c883c087ce2ea45507b55834be2a27aa
- MD5 248d88b4e968eec216ac3c06550522a1
- SHA1 dc6e19fbf04758d35c361d224086311e6f639527
- SHA512 42ef83ca743af10b2d40ff85273f30d0acc078121908c62abd39250eda2a463683e8b4f4b603d23f939b7e83559720de0bab85d9fdcc5af9d1ef11580f04b838
- SSDEEP 6144:viNEzZL9+eE5WAH4nt5ssWK2NTZ5wV/sRVLtuO/Y5UCyf1KyN8z8+Tl:wEzZh+eE5WASO7fOV/gN/SyNKyNmBJ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\PerfLogs\Recovery+fuysv.txt
Ransom Note
- __!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://ytrest84y5i456hghadefdsd.pontogrot.com/C162B1E763183FAD 2. http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/C162B1E763183FAD 3. http://5rport45vcdef345adfkksawe.bematvocal.at/C162B1E763183FAD If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/C162B1E763183FAD 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://ytrest84y5i456hghadefdsd.pontogrot.com/C162B1E763183FAD http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/C162B1E763183FAD http://5rport45vcdef345adfkksawe.bematvocal.at/C162B1E763183FAD *-*-* Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/C162B1E763183FAD *-*-* Your personal identification ID: C162B1E763183FAD
URLs
-
http://ytrest84y5i456hghadefdsd.pontogrot.com/C162B1E763183FAD
-
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/C162B1E763183FAD
-
http://5rport45vcdef345adfkksawe.bematvocal.at/C162B1E763183FAD
-
http://fwgrhsao3aoml7ej.onion/C162B1E763183FAD
-
http://fwgrhsao3aoml7ej.ONION/C162B1E763183FAD
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (870) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation alimbvcejpko.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation VirusShare_248d88b4e968eec216ac3c06550522a1.exe - Drops startup file 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+fuysv.txt alimbvcejpko.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+fuysv.txt alimbvcejpko.exe - Executes dropped EXE 1 IoCs
pid Process 2772 alimbvcejpko.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qdvaahnjwmfy = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\alimbvcejpko.exe\"" alimbvcejpko.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\Recovery+fuysv.txt alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-200.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-24.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60_contrast-black.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_In_App_Notification.m4a alimbvcejpko.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak alimbvcejpko.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\SmallTile.scale-125.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\27.jpg alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-30_altform-unplated_contrast-black.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\Recovery+fuysv.txt alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-48_altform-lightunplated.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\LargeTile.scale-100.png alimbvcejpko.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt alimbvcejpko.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\Recovery+fuysv.txt alimbvcejpko.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare71x71Logo.scale-100.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\az-Latn-AZ\View3d\Recovery+fuysv.txt alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionMedTile.scale-125.png alimbvcejpko.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-72_altform-unplated_contrast-white.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\TinyTile.scale-200_contrast-black.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\10.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-100.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-200.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-64_altform-unplated.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-80_altform-unplated.png alimbvcejpko.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\Recovery+fuysv.txt alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionWideTile.scale-100.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-24_contrast-white.png alimbvcejpko.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-125_contrast-black.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileSmallSquare.scale-200.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60_altform-lightunplated.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-64.png alimbvcejpko.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\SmallTile.scale-200.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc alimbvcejpko.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\Recovery+fuysv.txt alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\SplashScreen\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-64.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.js alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\Recovery+fuysv.html alimbvcejpko.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\Registration\Recovery+fuysv.txt alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\Welcome_Slide01.jpg alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Recovery+fuysv.png alimbvcejpko.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png alimbvcejpko.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\alimbvcejpko.exe VirusShare_248d88b4e968eec216ac3c06550522a1.exe File opened for modification C:\Windows\alimbvcejpko.exe VirusShare_248d88b4e968eec216ac3c06550522a1.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings alimbvcejpko.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2776 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe 2772 alimbvcejpko.exe - Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 4060 VirusShare_248d88b4e968eec216ac3c06550522a1.exe Token: SeDebugPrivilege 2772 alimbvcejpko.exe Token: SeIncreaseQuotaPrivilege 4428 WMIC.exe Token: SeSecurityPrivilege 4428 WMIC.exe Token: SeTakeOwnershipPrivilege 4428 WMIC.exe Token: SeLoadDriverPrivilege 4428 WMIC.exe Token: SeSystemProfilePrivilege 4428 WMIC.exe Token: SeSystemtimePrivilege 4428 WMIC.exe Token: SeProfSingleProcessPrivilege 4428 WMIC.exe Token: SeIncBasePriorityPrivilege 4428 WMIC.exe Token: SeCreatePagefilePrivilege 4428 WMIC.exe Token: SeBackupPrivilege 4428 WMIC.exe Token: SeRestorePrivilege 4428 WMIC.exe Token: SeShutdownPrivilege 4428 WMIC.exe Token: SeDebugPrivilege 4428 WMIC.exe Token: SeSystemEnvironmentPrivilege 4428 WMIC.exe Token: SeRemoteShutdownPrivilege 4428 WMIC.exe Token: SeUndockPrivilege 4428 WMIC.exe Token: SeManageVolumePrivilege 4428 WMIC.exe Token: 33 4428 WMIC.exe Token: 34 4428 WMIC.exe Token: 35 4428 WMIC.exe Token: 36 4428 WMIC.exe Token: SeIncreaseQuotaPrivilege 4428 WMIC.exe Token: SeSecurityPrivilege 4428 WMIC.exe Token: SeTakeOwnershipPrivilege 4428 WMIC.exe Token: SeLoadDriverPrivilege 4428 WMIC.exe Token: SeSystemProfilePrivilege 4428 WMIC.exe Token: SeSystemtimePrivilege 4428 WMIC.exe Token: SeProfSingleProcessPrivilege 4428 WMIC.exe Token: SeIncBasePriorityPrivilege 4428 WMIC.exe Token: SeCreatePagefilePrivilege 4428 WMIC.exe Token: SeBackupPrivilege 4428 WMIC.exe Token: SeRestorePrivilege 4428 WMIC.exe Token: SeShutdownPrivilege 4428 WMIC.exe Token: SeDebugPrivilege 4428 WMIC.exe Token: SeSystemEnvironmentPrivilege 4428 WMIC.exe Token: SeRemoteShutdownPrivilege 4428 WMIC.exe Token: SeUndockPrivilege 4428 WMIC.exe Token: SeManageVolumePrivilege 4428 WMIC.exe Token: 33 4428 WMIC.exe Token: 34 4428 WMIC.exe Token: 35 4428 WMIC.exe Token: 36 4428 WMIC.exe Token: SeBackupPrivilege 3524 vssvc.exe Token: SeRestorePrivilege 3524 vssvc.exe Token: SeAuditPrivilege 3524 vssvc.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4060 wrote to memory of 2772 4060 VirusShare_248d88b4e968eec216ac3c06550522a1.exe 91 PID 4060 wrote to memory of 2772 4060 VirusShare_248d88b4e968eec216ac3c06550522a1.exe 91 PID 4060 wrote to memory of 2772 4060 VirusShare_248d88b4e968eec216ac3c06550522a1.exe 91 PID 2772 wrote to memory of 4428 2772 alimbvcejpko.exe 92 PID 2772 wrote to memory of 4428 2772 alimbvcejpko.exe 92 PID 2772 wrote to memory of 2776 2772 alimbvcejpko.exe 107 PID 2772 wrote to memory of 2776 2772 alimbvcejpko.exe 107 PID 2772 wrote to memory of 2776 2772 alimbvcejpko.exe 107 PID 2772 wrote to memory of 4588 2772 alimbvcejpko.exe 108 PID 2772 wrote to memory of 4588 2772 alimbvcejpko.exe 108 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" alimbvcejpko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System alimbvcejpko.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_248d88b4e968eec216ac3c06550522a1.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_248d88b4e968eec216ac3c06550522a1.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\alimbvcejpko.exeC:\Windows\alimbvcejpko.exe2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2772 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT3⤵
- Opens file in notepad (likely ransom note)
PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM3⤵PID:4588
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE2⤵PID:4076
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3524
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵PID:4820
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3688 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:11⤵PID:4504
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=3876 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:11⤵PID:2472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5412 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵PID:1108
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5436 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:11⤵PID:4000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PerfLogs\Recovery+fuysv.html
- Size 9KB
- SHA256 b6f6dbf4b6f89e22e405465de0e8134ed25b7852fcee61e298110ffc0bd46223
- MD5 1e9e5dad82cea81812b384313a20f63b
- SHA1 51a928687b52a2bc81602b2b192eb2ce54e7da5e
- SHA512 68c2cb357d3c4a7e2e396681a9b0cbe6817040fca6dffd5805a110276925c4ca0e71800bac9bde2ed09d5d63a578ef1834c6fdf2bdf543bb47d75bc7117b025d
- SSDEEP 96:Jm1hpDl1ZiSi9/oVnrm9b5yM3IY5cc2lcS++/FPISRshFovUQvgMGhlYUkcaHcGs:UjCH/OrO5fVodGkMi8Q0h/k/Rbmg0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PerfLogs\Recovery+fuysv.png
- Size 69KB
- SHA256 1032cf6a7708f02f365c8e62f482265ca3fbc1c0079b16cde112e5a4285ab19e
- MD5 850c7256f49ed287968f01bae048416c
- SHA1 78cdd21197cdee697779954101534d67b093909c
- SHA512 2544f3c4aa5db11d71a78d6df33bcd7fe05e4cf59b92c9cc924f30dc79dde6c1bd68acaebea8183018ade87e9fa37f35888957a13780fc6229d6a888a78462f4
- SSDEEP 1536:PuhY3vThWixERyqzp5V5UwKD6/lB6WKsstUQdKC:QY3benpvC7gr6UQdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PerfLogs\Recovery+fuysv.txt
- Size 2KB
- SHA256 d9131e4d24efbc0ad2ea75eabbe283db5b5c121f7b266ddb821796ed6ca06244
- MD5 4bb7a3ce8477b4df027a792243a2af34
- SHA1 c7fde8f83a80c495c908905bdbe2e5f3063ad9b4
- SHA512 384d489abe3724da92fc3eebfdc6359b0d85bad174d28ba003332899b879787c0bea96033904924aeb6f25ae706a6df3c1315c0610ca4dacf67ffada3905d5ca
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
- Size 560B
- SHA256 d2bdb1ab32ba7572ce3cc72d44b1a9221ef0c49d738613c8f0382d6df414500d
- MD5 2118ba0d105e3582f478f4ea2f055ce1
- SHA1 a4e7eb1182d576743f691e9b9418043e23ea5411
- SHA512 78ade5c420bdc4fad7edbf9ad81761da8debdc1e54e04031a240d4e3b2b30c7d3e9400c0066343729ccf312a67eb8063acd5a177ee30ad749bc4f749c9495c95
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
- Size 560B
- SHA256 9f718c3351fab24e4370b813293f50ca8cbeb520b0852db0163bccf00aa0021c
- MD5 38c6014f91bdd6fb4d0ac9064118e73c
- SHA1 150803e2010ee3abbb61f5b5290dc935a04dbe28
- SHA512 0c9635655a6fe0caa897e81f882cc70892da951c088fdaa4ea7984a701a0551b671184ff913d7042a1bdc429db3360181587410c90fdf1d7ff5df6b66ff00d5a
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
- Size 416B
- SHA256 bdc3a8445967831d5a0d7692ce98dbe759c312d8c32f4eb60e3deebe9ab2da5f
- MD5 19e01c73ba253430df7daba2ee50c343
- SHA1 315e19da38b797bb37d224f7e33aa21d7845dfc4
- SHA512 c7c66990cf910571e11b8fb74b0485f3266fde8367c329c855b9db72b049f9f5db97f615147086e6a48870654eba56381d6be5215766dc77f69c02af7b3b3471
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534305838784240.txt
- Size 77KB
- SHA256 f436c5d945b4178e7f1161703bb17ee95d3419d46e13bea01013c45406490855
- MD5 40dda41fba4c3a90ee882ea989e691d2
- SHA1 0cf3f008ee6151999a6da9cc0f2e024a31a3ec3b
- SHA512 913f1d23d76afcc1b64b9d6216e98ceee701de5cf819a1285e0d91ca0635eb36b14c28cc2f72877391535290b7892ba8e74cd9e68a96c2f1b9b32eb871851444
- SSDEEP 1536:7yZFQOdrU2GhAh10Yt81Fm6MM2ynDqOTQIeCHZrrrN8v2gRjE7od:7CnLYAh2Yag6BDxUIeCu2gRY7od
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534325129811261.txt
- Size 74KB
- SHA256 adb646fe6c328e4e0565fc2d467e16145929a3785b82b00c8ec4bc0e2c22bfc6
- MD5 6ead5a0b8f43355c5026db66e7d5aac8
- SHA1 2630feed830c8465b881a7427a6e2bcabe6945bd
- SHA512 459b4fbbdd27836cfea7541e52f1e8f99c9f8a70dc186d41cb4d421eaaa771358a3bba0a63f22ca532202a1b8385de7cbe349eebb61b1952c317f96f09fef6a0
- SSDEEP 1536:j1e7G9jY529XUl/al5m+ozQJQn6Fro9Hj8n65rn9Yd+70hbH9A58:5e7R52PAuJQr99r9ee0BH9C8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\alimbvcejpko.exe
- Size 332KB
- SHA256 df4d8bdc2be2de41b265d510744c2083c883c087ce2ea45507b55834be2a27aa
- MD5 248d88b4e968eec216ac3c06550522a1
- SHA1 dc6e19fbf04758d35c361d224086311e6f639527
- SHA512 42ef83ca743af10b2d40ff85273f30d0acc078121908c62abd39250eda2a463683e8b4f4b603d23f939b7e83559720de0bab85d9fdcc5af9d1ef11580f04b838
- SSDEEP 6144:viNEzZL9+eE5WAH4nt5ssWK2NTZ5wV/sRVLtuO/Y5UCyf1KyN8z8+Tl:wEzZh+eE5WASO7fOV/gN/SyNKyNmBJ
- MD5 SHA1 SHA512 SSDEEP