Overview
overview
10Static
static
32272954a2c...5a.exe
windows7-x64
1072716d15ea...21.exe
windows7-x64
7Bit Paymer.exe
windows7-x64
10KeepCalm.exe
windows7-x64
1LockedIn.exe
windows7-x64
9NotPetya.dll
windows7-x64
10Purge.exe
windows7-x64
1Scarab.exe
windows7-x64
10a631ad1b1a...4b.exe
windows7-x64
6a9053a3a52...bc.exe
windows7-x64
7b764629e1f...1c.exe
windows7-x64
10cf89f70633...5c.exe
windows7-x64
1e951e82867...50.exe
windows7-x64
1fa0c321e1a...d2.exe
windows7-x64
9fc184274ad...27.exe
windows7-x64
10Resubmissions
18-07-2024 07:25
240718-h84wjs1hpb 1018-07-2024 07:19
240718-h51pqa1gng 1017-07-2024 20:55
240717-zqkhmaydmq 1017-07-2024 19:21
240717-x2pwdaycjb 10Analysis
-
max time kernel
1565s -
max time network
1566s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 19:21
Static task
static1
Behavioral task
behavioral1
Sample
2272954a2c9f631b4f9c5f6d230287b0989ab3b512bb5f4a282214eadf42085a.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe
Resource
win7-20240705-en
Behavioral task
behavioral3
Sample
Bit Paymer.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
KeepCalm.exe
Resource
win7-20240708-en
Behavioral task
behavioral5
Sample
LockedIn.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
NotPetya.dll
Resource
win7-20240705-en
Behavioral task
behavioral7
Sample
Purge.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Scarab.exe
Resource
win7-20240705-en
Behavioral task
behavioral9
Sample
a631ad1b1a59001a5f594880c6ae3337bda98f8ce3bb46cd7a9de0b35cd2bc4b.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe
Resource
win7-20240704-en
Behavioral task
behavioral11
Sample
b764629e1f43851daf984c9372422b65ddceae28f83d6211873f4c8f8672c41c.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
cf89f70633865aa06123062a7dc51f8158905afb4b00f6f3597de3edfba97c5c.exe
Resource
win7-20240705-en
Behavioral task
behavioral13
Sample
e951e82867a4f3af5a34b714571e9acf99cca794c4ed1895c9025a642d5d4350.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
Resource
win7-20240708-en
Behavioral task
behavioral15
Sample
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe
Resource
win7-20240708-en
General
-
Target
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe
-
Size
268KB
-
MD5
d3fdd9807a32f5c27c14879336762119
-
SHA1
73132972d130adb7106e6b9319b21856434eff65
-
SHA256
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527
-
SHA512
87468ab4136f449cab6e3689b4460de6dc59421ad20ce8208e251b3e4ef63f4ac281288ec51a35469e2473328de8b45b487cd72f40ba72d304a44b89a99a7a80
-
SSDEEP
6144:IXJ6Mv/PMB5lZOx4ccuiA8HYVVo7bBPxwdNaLvo:KJf/kBrZOxfwAsYVVoZZwdNaE
Malware Config
Extracted
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___5GFQ2ZM_.txt
cerber
http://xpcx6erilkjced3j.onion/85A4-3B17-D2F0-005C-97F6
http://xpcx6erilkjced3j.1t2jhk.top/85A4-3B17-D2F0-005C-97F6
http://xpcx6erilkjced3j.1e6ly3.top/85A4-3B17-D2F0-005C-97F6
http://xpcx6erilkjced3j.1ewuh5.top/85A4-3B17-D2F0-005C-97F6
http://xpcx6erilkjced3j.15ezkm.top/85A4-3B17-D2F0-005C-97F6
http://xpcx6erilkjced3j.16umxg.top/85A4-3B17-D2F0-005C-97F6
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exeflow pid process 2181 2228 mshta.exe 2184 2228 mshta.exe 2186 2228 mshta.exe 2188 2228 mshta.exe 2190 2228 mshta.exe -
Contacts a large (1095) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2772 netsh.exe 2712 netsh.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1492 cmd.exe -
Drops startup file 1 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process File opened (read-only) \??\k: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\l: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\s: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\t: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\w: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\x: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\b: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\p: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\r: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\h: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\i: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\j: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\o: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\q: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\u: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\a: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\g: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\m: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\n: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\v: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\y: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\z: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened (read-only) \??\e: fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Drops file in System32 directory 38 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2FC7.bmp" fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Drops file in Program Files directory 20 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process File opened for modification \??\c:\program files (x86)\ fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\bitcoin fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files\ fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\program files (x86)\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Drops file in Windows directory 64 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1536 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2364 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe Token: SeDebugPrivilege 1536 taskkill.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exepid process 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.execmd.exedescription pid process target process PID 2080 wrote to memory of 2772 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2080 wrote to memory of 2772 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2080 wrote to memory of 2772 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2080 wrote to memory of 2772 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2080 wrote to memory of 2712 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2080 wrote to memory of 2712 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2080 wrote to memory of 2712 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2080 wrote to memory of 2712 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe netsh.exe PID 2080 wrote to memory of 2228 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe mshta.exe PID 2080 wrote to memory of 2228 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe mshta.exe PID 2080 wrote to memory of 2228 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe mshta.exe PID 2080 wrote to memory of 2228 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe mshta.exe PID 2080 wrote to memory of 2364 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe NOTEPAD.EXE PID 2080 wrote to memory of 2364 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe NOTEPAD.EXE PID 2080 wrote to memory of 2364 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe NOTEPAD.EXE PID 2080 wrote to memory of 2364 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe NOTEPAD.EXE PID 2080 wrote to memory of 1492 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe cmd.exe PID 2080 wrote to memory of 1492 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe cmd.exe PID 2080 wrote to memory of 1492 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe cmd.exe PID 2080 wrote to memory of 1492 2080 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe cmd.exe PID 1492 wrote to memory of 1536 1492 cmd.exe taskkill.exe PID 1492 wrote to memory of 1536 1492 cmd.exe taskkill.exe PID 1492 wrote to memory of 1536 1492 cmd.exe taskkill.exe PID 1492 wrote to memory of 1536 1492 cmd.exe taskkill.exe PID 1492 wrote to memory of 1980 1492 cmd.exe PING.EXE PID 1492 wrote to memory of 1980 1492 cmd.exe PING.EXE PID 1492 wrote to memory of 1980 1492 cmd.exe PING.EXE PID 1492 wrote to memory of 1980 1492 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe"C:\Users\Admin\AppData\Local\Temp\fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2772 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2712 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___G9G4_.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
PID:2228 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___5GFQ2ZM_.txt2⤵
- Opens file in notepad (likely ransom note)
PID:2364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe" > NUL && exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:1980
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD56b9787bb734cab9c6eff252b698d5653
SHA18b928ed630f328756f3a74bcfc41a35825bfbb8d
SHA2568246f0a33a3c9fb13525918430193612d5c9b39b98c3c66c348cd7d592252fa7
SHA51283c3ab5e58bd4e8a062856f214115dfca20f5d5ceb6aa3bd68b0ce5104aab00056683db65fe9bd11e27efef50f98e5736a312cffda9f0419973c4dc21a3f985e
-
Filesize
75KB
MD5067bfeba2980aeefca63149c61967f1b
SHA16503eac9e1b8c903b3995d8747950094a1d1e49a
SHA2569ee92770562b62695c341b9971a408c97fa451bd63c79fcc677a2c8caf8d3821
SHA512ed3c0b7473bae008f4f5d82bcd0c050da62675623e8d283302627d8d70a625b6a61deadba8030b336321b3223759da578f62b94b0bbddbd376cca6918e357513