cc65535243dfd3cd54a9c5ecfcb93c7f918a87c725e9c52925017ab92effe278

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
Size

112KB
MD5

b6cfdefd2ef6bb507cbac8634ec3f6a1
SHA1

583bbf424a7114586dd48fe57be999cbd750ba56
SHA256

1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1
SHA512

5b8ea7112f2f5ef2f34ac18b9ce8b3afc0016c4603fe222a02a8fc03e115890bcdb4929db273026aded00aa8a226cd49c2b5cd1279086aea049c13ae7608f5e1
SSDEEP

1536:R2HSDWrKs9S4AZvJHU4mKQvXqWJLsYfgIXE0FtRhSH0SJE3PpgNmKRUM:RjaWP3vQNJLsUE03RA1eP87

Score

9^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 6 IoCs

Processes:

1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\How to decrypt your files.txt	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\How to decrypt your files.jpg	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hafxxxar = "C:\\Windows\\System32\\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe"	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

description	ioc	process
File opened for modification	C:\Program Files\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZI5WZ4I\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\4TWWWYKL\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\L0CT0ZLQ\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U0AIBA2P\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFPGXSZI\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K9RFKP48\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MZGHW204\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2660163958-4080398480-1122754539-1000\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2660163958-4080398480-1122754539-1000\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

Drops file in System32 directory 1 IoCs

Processes:

1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

description	ioc	process
File created	C:\Windows\SysWOW64\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\How to decrypt your files.jpg"	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

Drops file in Program Files directory 64 IoCs

Processes:

1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05870_.WMF.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\WMPDMCCore.dll.mui	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107300.WMF.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MY.XML	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\settings.css	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Essential.thmx.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45F.GIF	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\en-US\ieinstal.exe.mui	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212299.WMF.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libpva_plugin.dll	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199303.WMF	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00172_.WMF	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jre7\bin\sunmscapi.dll	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Casual.gif.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47B.GIF.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\THMBNAIL.PNG.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\SUMIPNTG.ELM.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239967.WMF.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKACC.CFG.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BANNER.XML	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Manila	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Halifax.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME02.CSS.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\SOLVER32.DLL.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232797.WMF	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\form_edit.js	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107342.WMF	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\17.png	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSTORYVERT.XML.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_id.dll.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143746.GIF.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABON.JPG.id-943DC563.{[email protected]}.xtbl	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.GIF	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exe

pid process

2220 vssadmin.exe
2488 vssadmin.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2184 vssvc.exe
Token: SeRestorePrivilege 2184 vssvc.exe
Token: SeAuditPrivilege 2184 vssvc.exe

pid	process
2220	vssadmin.exe
2488	vssadmin.exe

description	pid	process
Token: SeBackupPrivilege	2184	vssvc.exe
Token: SeRestorePrivilege	2184	vssvc.exe
Token: SeAuditPrivilege	2184	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.execmd.execmd.exe

description	pid	process	target process
PID 2072 wrote to memory of 3052	2072	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe	cmd.exe
PID 2072 wrote to memory of 3052	2072	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe	cmd.exe
PID 2072 wrote to memory of 3052	2072	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe	cmd.exe
PID 2072 wrote to memory of 3052	2072	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe	cmd.exe
PID 3052 wrote to memory of 2376	3052	cmd.exe	mode.com
PID 3052 wrote to memory of 2376	3052	cmd.exe	mode.com
PID 3052 wrote to memory of 2376	3052	cmd.exe	mode.com
PID 3052 wrote to memory of 2220	3052	cmd.exe	vssadmin.exe
PID 3052 wrote to memory of 2220	3052	cmd.exe	vssadmin.exe
PID 3052 wrote to memory of 2220	3052	cmd.exe	vssadmin.exe
PID 2072 wrote to memory of 2700	2072	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe	cmd.exe
PID 2072 wrote to memory of 2700	2072	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe	cmd.exe
PID 2072 wrote to memory of 2700	2072	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe	cmd.exe
PID 2072 wrote to memory of 2700	2072	1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe	cmd.exe
PID 2700 wrote to memory of 1028	2700	cmd.exe	mode.com
PID 2700 wrote to memory of 1028	2700	cmd.exe	mode.com
PID 2700 wrote to memory of 1028	2700	cmd.exe	mode.com
PID 2700 wrote to memory of 2488	2700	cmd.exe	vssadmin.exe
PID 2700 wrote to memory of 2488	2700	cmd.exe	vssadmin.exe
PID 2700 wrote to memory of 2488	2700	cmd.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
"C:\Users\Admin\AppData\Local\Temp\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:2376
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2220
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:1028
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\How to decrypt your files.txt
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.id-943DC563.{[email protected]}.xtbl

Filesize
24.4MB

MD5
9a2df248c922208d5f591710c24b2751

SHA1
f6159656e3c42011d7206e2dc1af59611681d3da

SHA256
8bf4eb586170379c9771ee4cf1dcc76af95a34de93d8ffb364e22b2aee22db11

SHA512
3995ef000504bdce32ba4965d8e3697559fe474827aae81d7481f380e46c6f384eeea1a717a1d9c91bc8a435bc163e17657736a9790c19e54ea71fda1ac6a5c2

Download Submit
C:\Users\Admin\Desktop\How to decrypt your files.txt

Filesize
110B

MD5
5433f42607a7437245a6a036736cffe6

SHA1
fee3b3806d8377968734e806be1f84f301d35c3f

SHA256
b64134f3c6e2175ce91ba8bae9c2c87f168eb0e8f86860b7ec9c785a48d6a56c

SHA512
9ad1e6666ed0ae4b94ab22af16df2bfb309648aeec73a1fb1bd1c623ef8c5d66e48d16712aaf3750f55bf691075e4a6c3550fdcb46c7ae24e586e80c681b53e8

Download Submit