Overview
overview
10Static
static
32272954a2c...5a.exe
windows7-x64
1072716d15ea...21.exe
windows7-x64
7Bit Paymer.exe
windows7-x64
10KeepCalm.exe
windows7-x64
1LockedIn.exe
windows7-x64
9NotPetya.dll
windows7-x64
10Purge.exe
windows7-x64
1Scarab.exe
windows7-x64
10a631ad1b1a...4b.exe
windows7-x64
6a9053a3a52...bc.exe
windows7-x64
7b764629e1f...1c.exe
windows7-x64
10cf89f70633...5c.exe
windows7-x64
1e951e82867...50.exe
windows7-x64
1fa0c321e1a...d2.exe
windows7-x64
9fc184274ad...27.exe
windows7-x64
10Resubmissions
18-07-2024 07:25
240718-h84wjs1hpb 1018-07-2024 07:19
240718-h51pqa1gng 1017-07-2024 20:55
240717-zqkhmaydmq 1017-07-2024 19:21
240717-x2pwdaycjb 10Analysis
-
max time kernel
1558s -
max time network
1559s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 19:21
Static task
static1
Behavioral task
behavioral1
Sample
2272954a2c9f631b4f9c5f6d230287b0989ab3b512bb5f4a282214eadf42085a.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe
Resource
win7-20240705-en
Behavioral task
behavioral3
Sample
Bit Paymer.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
KeepCalm.exe
Resource
win7-20240708-en
Behavioral task
behavioral5
Sample
LockedIn.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
NotPetya.dll
Resource
win7-20240705-en
Behavioral task
behavioral7
Sample
Purge.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Scarab.exe
Resource
win7-20240705-en
Behavioral task
behavioral9
Sample
a631ad1b1a59001a5f594880c6ae3337bda98f8ce3bb46cd7a9de0b35cd2bc4b.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe
Resource
win7-20240704-en
Behavioral task
behavioral11
Sample
b764629e1f43851daf984c9372422b65ddceae28f83d6211873f4c8f8672c41c.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
cf89f70633865aa06123062a7dc51f8158905afb4b00f6f3597de3edfba97c5c.exe
Resource
win7-20240705-en
Behavioral task
behavioral13
Sample
e951e82867a4f3af5a34b714571e9acf99cca794c4ed1895c9025a642d5d4350.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
Resource
win7-20240708-en
Behavioral task
behavioral15
Sample
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe
Resource
win7-20240708-en
General
-
Target
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
-
Size
121KB
-
MD5
eac0a08470ee67c63b14ae2ce7f6aa61
-
SHA1
285c0163376d5d9a5806364411652fe73424d571
-
SHA256
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7
-
SHA512
f3fd7eeae18843d049443f0d5e818302eb3b3f73ad85e26c01e1ddc0a102a0a22b065afe01879aafc95ff3a2d15b5c302394bd03d91e6c4401648cd4222bddc5
-
SSDEEP
1536:3THoX8wNjiMsyPcjgbKx534oU6Llg/iLBkZhifkdol9LYuVF5yZbn:DjksYKx5o3Slg/itMg8+LYu9ubn
Malware Config
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
BC1C9B74EA.exeBC1C9B74EA.exepid process 2116 BC1C9B74EA.exe 3064 BC1C9B74EA.exe -
Loads dropped DLL 2 IoCs
Processes:
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exepid process 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exeBC1C9B74EA.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\BC1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Roaming\\BC1C9B74EA.exe\"" fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*BC1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Roaming\\BC1C9B74EA.exe\"" fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\00FF1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Roaming\\BC1C9B74EA.exe\"" BC1C9B74EA.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\00FF1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe\"" fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe -
Drops desktop.ini file(s) 26 IoCs
Processes:
BC1C9B74EA.exedescription ioc process File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Videos\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Searches\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Desktop\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Music\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Pictures\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Music\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Documents\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Downloads\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Links\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Videos\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Documents\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Libraries\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini BC1C9B74EA.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini BC1C9B74EA.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exeBC1C9B74EA.exedescription pid process target process PID 2624 set thread context of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2116 set thread context of 3064 2116 BC1C9B74EA.exe BC1C9B74EA.exe -
Drops file in Program Files directory 2 IoCs
Processes:
BC1C9B74EA.exedescription ioc process File opened for modification C:\Program Files\_HELP_INSTRUCTION.TXT BC1C9B74EA.exe File opened for modification C:\Program Files (x86)\_HELP_INSTRUCTION.TXT BC1C9B74EA.exe -
Drops file in Windows directory 1 IoCs
Processes:
BC1C9B74EA.exedescription ioc process File opened for modification C:\Windows\_HELP_INSTRUCTION.TXT BC1C9B74EA.exe -
Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 3000 sc.exe 2608 sc.exe 848 sc.exe 2560 sc.exe 2200 sc.exe 2556 sc.exe 2952 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1108 vssadmin.exe -
NTFS ADS 1 IoCs
Processes:
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe:Zone.Identifier fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe -
Opens file in notepad (likely ransom note) 5 IoCs
Processes:
NOTEPAD.EXENOTEPAD.EXENOTEPAD.EXENOTEPAD.EXENOTEPAD.EXEpid process 2148 NOTEPAD.EXE 752 NOTEPAD.EXE 2708 NOTEPAD.EXE 2040 NOTEPAD.EXE 844 NOTEPAD.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2912 vssvc.exe Token: SeRestorePrivilege 2912 vssvc.exe Token: SeAuditPrivilege 2912 vssvc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
NOTEPAD.EXENOTEPAD.EXENOTEPAD.EXEpid process 844 NOTEPAD.EXE 2148 NOTEPAD.EXE 2040 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exefa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2624 wrote to memory of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2624 wrote to memory of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2624 wrote to memory of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2624 wrote to memory of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2624 wrote to memory of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2624 wrote to memory of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2624 wrote to memory of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2624 wrote to memory of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2624 wrote to memory of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2624 wrote to memory of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2624 wrote to memory of 2236 2624 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe PID 2236 wrote to memory of 2784 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2784 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2784 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2784 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2896 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2896 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2896 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2896 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2664 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2664 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2664 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2664 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2692 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2692 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2692 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2692 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2712 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2712 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2712 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2712 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2896 wrote to memory of 2200 2896 cmd.exe sc.exe PID 2896 wrote to memory of 2200 2896 cmd.exe sc.exe PID 2896 wrote to memory of 2200 2896 cmd.exe sc.exe PID 2896 wrote to memory of 2200 2896 cmd.exe sc.exe PID 2784 wrote to memory of 2560 2784 cmd.exe sc.exe PID 2784 wrote to memory of 2560 2784 cmd.exe sc.exe PID 2784 wrote to memory of 2560 2784 cmd.exe sc.exe PID 2784 wrote to memory of 2560 2784 cmd.exe sc.exe PID 2664 wrote to memory of 2556 2664 cmd.exe sc.exe PID 2664 wrote to memory of 2556 2664 cmd.exe sc.exe PID 2664 wrote to memory of 2556 2664 cmd.exe sc.exe PID 2664 wrote to memory of 2556 2664 cmd.exe sc.exe PID 2236 wrote to memory of 2668 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2668 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2668 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 2668 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 1716 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 1716 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 1716 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2236 wrote to memory of 1716 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe PID 2712 wrote to memory of 2608 2712 cmd.exe sc.exe PID 2712 wrote to memory of 2608 2712 cmd.exe sc.exe PID 2712 wrote to memory of 2608 2712 cmd.exe sc.exe PID 2712 wrote to memory of 2608 2712 cmd.exe sc.exe PID 2692 wrote to memory of 2952 2692 cmd.exe sc.exe PID 2692 wrote to memory of 2952 2692 cmd.exe sc.exe PID 2692 wrote to memory of 2952 2692 cmd.exe sc.exe PID 2692 wrote to memory of 2952 2692 cmd.exe sc.exe PID 2668 wrote to memory of 3000 2668 cmd.exe sc.exe PID 2668 wrote to memory of 3000 2668 cmd.exe sc.exe PID 2668 wrote to memory of 3000 2668 cmd.exe sc.exe PID 2668 wrote to memory of 3000 2668 cmd.exe sc.exe PID 2236 wrote to memory of 2720 2236 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe cmd.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe"C:\Users\Admin\AppData\Local\Temp\fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe"C:\Users\Admin\AppData\Local\Temp\fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop VVS3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop VVS4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop wscsvc3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop wscsvc4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop WinDefend3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop wuauserv3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop BITS3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop BITS4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop ERSvc3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop ERSvc4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop WerSvc3⤵
-
C:\Windows\SysWOW64\sc.exesc stop WerSvc4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exeC:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exeC:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT5⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT5⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT5⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT5⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT5⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Windows Management Instrumentation
1System Services
1Service Execution
1Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\_HELP_INSTRUCTION.TXTFilesize
1KB
MD5a66096f3592531f74e0d5ebb9539d925
SHA1b7b1ccc2932bf4c97b2481529919d44c3fbde055
SHA2566f5bf60dc263c7a4dc5d0489b32e7ef2ed1203e3a19567a49ea56cdcda7f6ce1
SHA5123da01c19c8982dd588843dee1ea31bbaae6536c768131a6e5bb134720f780080efdfe2ac5b5346f976a7f4252d65e86683018d9888c23eab66588391f524801b
-
\Users\Admin\AppData\Roaming\BC1C9B74EA.exeFilesize
121KB
MD5eac0a08470ee67c63b14ae2ce7f6aa61
SHA1285c0163376d5d9a5806364411652fe73424d571
SHA256fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7
SHA512f3fd7eeae18843d049443f0d5e818302eb3b3f73ad85e26c01e1ddc0a102a0a22b065afe01879aafc95ff3a2d15b5c302394bd03d91e6c4401648cd4222bddc5
-
memory/2236-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2236-4-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2236-6-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2624-1-0x0000000000470000-0x0000000000570000-memory.dmpFilesize
1024KB
-
memory/3064-72-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-97-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-32-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-37-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-42-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-47-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-52-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-57-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-62-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-67-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-26-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-77-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-82-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-87-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-92-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-28-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-102-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-23-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-118-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-120-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-131-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-137-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-142-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-144-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-146-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-148-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-150-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-152-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3064-154-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB