Overview
overview
10Static
static
1001aabfaa41...50.exe
windows7-x64
301c647838c...7f.exe
windows7-x64
1002f5c32fa2...d6.exe
windows7-x64
61a05cba687...a3.exe
windows7-x64
101a8f35d0f2...b9.exe
windows7-x64
1af797776e...13.exe
windows7-x64
101b2b369f31...2e.exe
windows7-x64
31b4a0b685c...db.exe
windows7-x64
31b4d73a9a7...89.exe
windows7-x64
101ba8934b2e...4d.exe
windows7-x64
11c2a51daa5...5b.exe
windows7-x64
101c8bc3890f...45.exe
windows7-x64
61ce9fa5304...ef.exe
windows7-x64
1d51d46e07...cd.exe
windows7-x64
101db9ec5678...e0.exe
windows7-x64
101dbbed25cf...88.exe
windows7-x64
1de8054e71...a1.exe
windows7-x64
91e56efa724...ba.exe
windows7-x64
11e754e1c7e...44.exe
windows7-x64
31e8e39da21...bc.exe
windows7-x64
101e9e575dd3...86.exe
windows7-x64
31eb6de09f5...69.exe
windows7-x64
41f0daca3fc...d9.exe
windows7-x64
61f0efbc182...be.exe
windows7-x64
1fd42d07b4...6e.exe
windows7-x64
102a02608130...a1.exe
windows7-x64
12a05ac3c43...e4.exe
windows7-x64
102a32c84488...95.exe
windows7-x64
102a6c920bfb...dc.exe
windows7-x64
32aebddfd22...c8.exe
windows7-x64
32b245f773b...bb.exe
windows7-x64
102b331aa02a...b7.exe
windows7-x64
10Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 09:29
Static task
static1
19 signatures
Behavioral task
behavioral1
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win7-20240708-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral5
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win7-20240705-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral7
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win7-20240708-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral10
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win7-20240708-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral12
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral13
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral16
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
Resource
win7-20240705-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral18
Sample
1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069.exe
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be.exe
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe
Resource
win7-20240708-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral28
Sample
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe
Resource
win7-20240704-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral29
Sample
2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb.exe
Resource
win7-20240705-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral32
Sample
2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7.exe
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
-
Size
112KB
-
MD5
b6cfdefd2ef6bb507cbac8634ec3f6a1
-
SHA1
583bbf424a7114586dd48fe57be999cbd750ba56
-
SHA256
1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1
-
SHA512
5b8ea7112f2f5ef2f34ac18b9ce8b3afc0016c4603fe222a02a8fc03e115890bcdb4929db273026aded00aa8a226cd49c2b5cd1279086aea049c13ae7608f5e1
-
SSDEEP
1536:R2HSDWrKs9S4AZvJHU4mKQvXqWJLsYfgIXE0FtRhSH0SJE3PpgNmKRUM:RjaWP3vQNJLsUE03RA1eP87
Malware Config
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\How to decrypt your files.txt 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\How to decrypt your files.jpg 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hafxxxar = "C:\\Windows\\System32\\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe" 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Public\Music\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Public\Documents\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZI5WZ4I\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\4TWWWYKL\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\L0CT0ZLQ\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U0AIBA2P\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFPGXSZI\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K9RFKP48\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MZGHW204\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2660163958-4080398480-1122754539-1000\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2660163958-4080398480-1122754539-1000\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\How to decrypt your files.jpg" 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05870_.WMF.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\WMPDMCCore.dll.mui 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107300.WMF.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MY.XML 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\settings.css 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Essential.thmx.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45F.GIF 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\ieinstal.exe.mui 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212299.WMF.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libpva_plugin.dll 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199303.WMF 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00172_.WMF 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jre7\bin\sunmscapi.dll 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Casual.gif.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47B.GIF.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\THMBNAIL.PNG.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\SUMIPNTG.ELM.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239967.WMF.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKACC.CFG.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BANNER.XML 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Manila 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Halifax.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME02.CSS.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\SOLVER32.DLL.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232797.WMF 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\form_edit.js 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107342.WMF 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\17.png 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSTORYVERT.XML.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_id.dll.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143746.GIF.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABON.JPG.id-943DC563.{[email protected]}.xtbl 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.GIF 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2220 vssadmin.exe 2488 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2184 vssvc.exe Token: SeRestorePrivilege 2184 vssvc.exe Token: SeAuditPrivilege 2184 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2072 wrote to memory of 3052 2072 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe 30 PID 2072 wrote to memory of 3052 2072 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe 30 PID 2072 wrote to memory of 3052 2072 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe 30 PID 2072 wrote to memory of 3052 2072 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe 30 PID 3052 wrote to memory of 2376 3052 cmd.exe 32 PID 3052 wrote to memory of 2376 3052 cmd.exe 32 PID 3052 wrote to memory of 2376 3052 cmd.exe 32 PID 3052 wrote to memory of 2220 3052 cmd.exe 33 PID 3052 wrote to memory of 2220 3052 cmd.exe 33 PID 3052 wrote to memory of 2220 3052 cmd.exe 33 PID 2072 wrote to memory of 2700 2072 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe 38 PID 2072 wrote to memory of 2700 2072 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe 38 PID 2072 wrote to memory of 2700 2072 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe 38 PID 2072 wrote to memory of 2700 2072 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe 38 PID 2700 wrote to memory of 1028 2700 cmd.exe 40 PID 2700 wrote to memory of 1028 2700 cmd.exe 40 PID 2700 wrote to memory of 1028 2700 cmd.exe 40 PID 2700 wrote to memory of 2488 2700 cmd.exe 41 PID 2700 wrote to memory of 2488 2700 cmd.exe 41 PID 2700 wrote to memory of 2488 2700 cmd.exe 41 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe"C:\Users\Admin\AppData\Local\Temp\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2376
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2220
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1028
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2488
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\How to decrypt your files.txt1⤵PID:2336
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.id-943DC563.{[email protected]}.xtbl
Filesize24.4MB
MD59a2df248c922208d5f591710c24b2751
SHA1f6159656e3c42011d7206e2dc1af59611681d3da
SHA2568bf4eb586170379c9771ee4cf1dcc76af95a34de93d8ffb364e22b2aee22db11
SHA5123995ef000504bdce32ba4965d8e3697559fe474827aae81d7481f380e46c6f384eeea1a717a1d9c91bc8a435bc163e17657736a9790c19e54ea71fda1ac6a5c2
-
Filesize
110B
MD55433f42607a7437245a6a036736cffe6
SHA1fee3b3806d8377968734e806be1f84f301d35c3f
SHA256b64134f3c6e2175ce91ba8bae9c2c87f168eb0e8f86860b7ec9c785a48d6a56c
SHA5129ad1e6666ed0ae4b94ab22af16df2bfb309648aeec73a1fb1bd1c623ef8c5d66e48d16712aaf3750f55bf691075e4a6c3550fdcb46c7ae24e586e80c681b53e8