Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 11:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target setup.exe
- Size 316KB
- Sample240610-nrpyyshh73
- SHA256 17d404a44c0a3a44feae9a8b00afe517ec2e3d207e7be49385903407d3d67321
- MD5 4c8362e917fe00cfe4e92593e6ce125d
- SHA1 25f2507d317918cf07b5dca58353757988987079
- SHA512 85d398d8f5f963331ad4c93032822097ac13687582db866b7ef8f19832a332d17fb96ff0f174690b1b43836bac6e575962726204c4b96d0073772673910c9355
- SSDEEP 6144:efEmm90rilfrgPGIWBJCDZ74JAd+byEKf/YVXIQIxeyXKz+/i:edmCixEPGIWB8q+dYyEKfgFIQIol+/i
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Program Files\7-Zip\Lang\RECOVERtuvva.txt
Ransom Note
- NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com/D3D82265951DFEC8 http://94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at/D3D82265951DFEC8 http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/D3D82265951DFEC8 If you can't access your personal homepage or the addresses are not working, complete the following steps: 1 Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2 Install TOR Browser 3 Open TOR Browser 4 Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/D3D82265951DFEC8 5 Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com/D3D82265951DFEC8 http://94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at/D3D82265951DFEC8 http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/D3D82265951DFEC8 Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/D3D82265951DFEC8 Your personal identification ID: D3D82265951DFEC8
URLs
-
http://uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com/D3D82265951DFEC8
-
http://94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at/D3D82265951DFEC8
-
http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/D3D82265951DFEC8
-
http://k7tlx3ghr3m4n2tu.onion/D3D82265951DFEC8
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation setup.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation vkeqsl.exe - Drops startup file 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RECOVERtuvva.txt vkeqsl.exe - Executes dropped EXE 1 IoCs
pid Process 3196 vkeqsl.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\_kchn = "C:\\Windows\\SYSTEM32\\CMD.EXE /C START C:\\Users\\Admin\\Documents\\vkeqsl.exe" vkeqsl.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\lib\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\pref\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\SmallTile.scale-125_contrast-white.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fa-IR\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-100.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-100.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80_altform-unplated_contrast-black.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_altform-unplated_contrast-white.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\StartScreen\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-125_contrast-black.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-80.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-96.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlOuterCircleHover.png vkeqsl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-200_contrast-black.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1850_24x24x32.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_altform-unplated.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ar-SA\View3d\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\eu-ES\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-400.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-white_scale-100.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] vkeqsl.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppStoreLogo.scale-125.png vkeqsl.exe File opened for modification C:\Program Files\Microsoft Office\Updates\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\MedTile.scale-100.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30.png vkeqsl.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-100_altform-lightunplated.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\YellowAbstractNote.scale-200.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Velocity\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\SmallTile.scale-125.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black_devicefamily-colorfulunplated.png vkeqsl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\osfFPA\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-125_contrast-black.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookMedTile.scale-400.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-400.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-250.png vkeqsl.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\RECOVERtuvva.html vkeqsl.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\lua\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-150.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\RECOVERtuvva.png vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-60_contrast-black.png vkeqsl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\RECOVERtuvva.txt vkeqsl.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\RECOVERtuvva.html vkeqsl.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 548 vssadmin.exe 3040 vssadmin.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\trueimg vkeqsl.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings vkeqsl.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2120 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe 3196 vkeqsl.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3196 vkeqsl.exe Token: SeBackupPrivilege 1824 vssvc.exe Token: SeRestorePrivilege 1824 vssvc.exe Token: SeAuditPrivilege 1824 vssvc.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 3196 2356 setup.exe 83 PID 2356 wrote to memory of 3196 2356 setup.exe 83 PID 2356 wrote to memory of 3196 2356 setup.exe 83 PID 2356 wrote to memory of 2760 2356 setup.exe 85 PID 2356 wrote to memory of 2760 2356 setup.exe 85 PID 2356 wrote to memory of 2760 2356 setup.exe 85 PID 3196 wrote to memory of 548 3196 vkeqsl.exe 87 PID 3196 wrote to memory of 548 3196 vkeqsl.exe 87 PID 3196 wrote to memory of 2120 3196 vkeqsl.exe 100 PID 3196 wrote to memory of 2120 3196 vkeqsl.exe 100 PID 3196 wrote to memory of 2120 3196 vkeqsl.exe 100 PID 3196 wrote to memory of 1888 3196 vkeqsl.exe 101 PID 3196 wrote to memory of 1888 3196 vkeqsl.exe 101 PID 1888 wrote to memory of 2228 1888 msedge.exe 102 PID 1888 wrote to memory of 2228 1888 msedge.exe 102 PID 3196 wrote to memory of 3040 3196 vkeqsl.exe 103 PID 3196 wrote to memory of 3040 3196 vkeqsl.exe 103 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 2432 1888 msedge.exe 105 PID 1888 wrote to memory of 4884 1888 msedge.exe 106 PID 1888 wrote to memory of 4884 1888 msedge.exe 106 PID 1888 wrote to memory of 2448 1888 msedge.exe 107 PID 1888 wrote to memory of 2448 1888 msedge.exe 107 PID 1888 wrote to memory of 2448 1888 msedge.exe 107 PID 1888 wrote to memory of 2448 1888 msedge.exe 107 PID 1888 wrote to memory of 2448 1888 msedge.exe 107 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" vkeqsl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System vkeqsl.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\Documents\vkeqsl.exeC:\Users\Admin\Documents\vkeqsl.exe2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3196 -
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:548
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERtuvva.txt3⤵
- Opens file in notepad (likely ransom note)
PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERtuvva.html3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff862a646f8,0x7ff862a64708,0x7ff862a647184⤵PID:2228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,18224650655336789229,17099439181778812631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:24⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,18224650655336789229,17099439181778812631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:34⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,18224650655336789229,17099439181778812631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:84⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18224650655336789229,17099439181778812631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:14⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18224650655336789229,17099439181778812631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:14⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,18224650655336789229,17099439181778812631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:84⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,18224650655336789229,17099439181778812631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:84⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18224650655336789229,17099439181778812631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:14⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18224650655336789229,17099439181778812631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:14⤵PID:620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18224650655336789229,17099439181778812631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:14⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18224650655336789229,17099439181778812631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:14⤵PID:4652
-
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:3040
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\DOCUME~1\vkeqsl.exe >> NUL3⤵PID:4368
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\setup.exe >> NUL2⤵PID:2760
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2352
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\Lang\RECOVERtuvva.html
- Size 7KB
- SHA256 a5b2a63eac0d8c169fecbbca654be1378ecaf841d49d22d8041941459df4d3c6
- MD5 43454b29b6bf48868a4103ac4cf9f76a
- SHA1 20ba9674ee56348975d01f2977d11cca3caf03ab
- SHA512 129f9f00f2ee1bcf629543c30f65b897746d08f4ccf48468876599fb83cc6bb1d5e6d23043d486d745957f6c7cba23d1e1cc9c15d0c97c250311e8fdc6d62e94
- SSDEEP 192:Lg6d2thHQWf0zbue9D03/vMcpvSMNu5cEqxQHjXrQ:khHXf0fu2D03/vbp6Mo5mik
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Lang\RECOVERtuvva.png
- Size 80KB
- SHA256 239c43f3528f7f69a5746699f0dfb35c42fae3f0499256b0396d609c6cc27978
- MD5 99efea44ba24507c17b9e1c6f19f7be3
- SHA1 3aeb40ed133e2554e74dda805ece02d0413e4cd7
- SHA512 adb402f55e0ee8aea65331400c5d6e243db08cb91fd8bd00d9f908653dadcc3df6cd08e12a38a68db0279ac95a43ee05487a22500ca3fb2b2aa1189e322edf1f
- SSDEEP 1536:R6DWmXLJdqBVsrUJZAk56v4W7bgt3mZrbkyv5mC/btvK4y3:RSbJYMuZAk56Q9BmZpBxK4+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Lang\RECOVERtuvva.txt
- Size 2KB
- SHA256 ec65246b9e6b483109817206423c9ac06471a84ce15055873e01ba14bfafb099
- MD5 a27f45642dfb22d8c18610c351d476ea
- SHA1 d41840b7a993c7fbda8b8b604a137b26e8fb9012
- SHA512 793933b9fecfff6d5978584c785aa7e6d70ff5813cfdf1a6db827f815e27b5704902b1ecaca924fa208b29e2c63d3b8c0f77c6c086f4074148b88b8f0a3f4c86
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
- MD5 8b167567021ccb1a9fdf073fa9112ef0
- SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
- SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
- MD5 537815e7cc5c694912ac0308147852e4
- SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
- SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 0f2551edd132a8a4b7fb3e7362f4c3d708aed13aa9315bb6870fe35968ffb839
- MD5 4476b8594e9f60e412e6c87910bb052a
- SHA1 9e872846d518d9dcb4a801514d00db464a62ac94
- SHA512 b5d316581c566f612fdcef9f48080fe81192572f19909a52a86867bd2bb3a847083931d60cc2ba5d139ae65fb32b19110f4980ee83b4ba280444c993a4af65ea
- SSDEEP 96:nek8r1KD9wpvWMoiVmdeHpRQ5yUWQyV+VDCziEwb:nekWkD9GWMXpgyro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 2a836b38e87ea72ef09b506538383ca221661826f72d50c6bf5ac9e877f5ecab
- MD5 80e2f4384b236ea0004ebda53a912eec
- SHA1 2d494e8c8e219d8450209185d7ef4ae85f6d0b5d
- SHA512 9e6448ff8c26ebf2d15f06dba7ef6123dcebb2c0ac008221a795ae5140adc81474054f635d419e93629354cf199d32c1fddbee11749ce5c7af26173aebac2e1d
- SSDEEP 96:nekHr1Kz9wpvWMoiVmdeHpRQ5yUWQyV+VD7AiEwb:nekLkz9GWMXpgyrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 0cbb925caf0508ea2ea67a207a47092ed4dc5d468263cfd5cc893e262f87d77a
- MD5 95285ffb5e9cd207a301803f9f65a582
- SHA1 1261bcfb062a48645c0ea9c32219a07feb047da5
- SHA512 b86d756b7dceab7647deeeb4580e57ef397f8fe9d9cc995081fa60290fae73efd92c7780ad1a113d5ec904c54b6f38036bc04583c9321d59dd50c39d41c2c8bf
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgye2RUnqT23z2OMDCRHqlR:A9iIxuERzA83h09RZxYgMz2aOMWRHqlR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\vkeqsl.exe
- Size 316KB
- SHA256 17d404a44c0a3a44feae9a8b00afe517ec2e3d207e7be49385903407d3d67321
- MD5 4c8362e917fe00cfe4e92593e6ce125d
- SHA1 25f2507d317918cf07b5dca58353757988987079
- SHA512 85d398d8f5f963331ad4c93032822097ac13687582db866b7ef8f19832a332d17fb96ff0f174690b1b43836bac6e575962726204c4b96d0073772673910c9355
- SSDEEP 6144:efEmm90rilfrgPGIWBJCDZ74JAd+byEKf/YVXIQIxeyXKz+/i:edmCixEPGIWB8q+dYyEKfgFIQIol+/i
- MD5 SHA1 SHA512 SSDEEP