lockbit | 1ce80b2bb2a5f56573ca7b6f662accea56f4b9e0e3052ddec14fe03364c14dfe

Resubmissions

19-07-2024 11:43

240719-nvvnlssera 10

19-07-2024 11:41

19-07-2024 11:40

19-07-2024 11:40

19-07-2024 11:30

Analysis

max time kernel
147s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cryp_RAT.rtf
Size

662KB
MD5

1fc2941b70df9dd6cdf4cb82af740fe9
SHA1

e5d18e3487ca2d5037215c0e0ebfaf7ccae1c655
SHA256

44b87df9f68f5a3084c7d80c1c7492ca5209e816a4e83fdbd6e2fcb6f1ff936f
SHA512

d5da156e406093bfd398d78a36962360ed6918d6b96e641843e7eeddbd6fe41c0a1681bf0a4fe9e31be22d7b1e16267e62abafc9c14d1dea223e72f3ef810081
SSDEEP

12288:6NtcndUa0XzmFe4lT+F4qZDGefM4qeF4C:6Oua0XzmFFI+7Z4VT

Score

10^/10

lockbit neshta persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Searches\TdGeIqAUn.README.txt

Family

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom If you not pay Payment:BITCOIN AFTER SEND BITCOIN Contact [email protected]

Emails

[email protected]

Signatures

Detect Neshta payload 15 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0007000000015d18-9.dat	family_neshta
behavioral1/files/0x0001000000010312-22.dat	family_neshta
behavioral1/files/0x0005000000018634-1048.dat	family_neshta
behavioral1/files/0x00050000000055de-1078.dat	family_neshta
behavioral1/files/0x0003000000005ab6-1079.dat	family_neshta
behavioral1/files/0x000300000000e6f5-1080.dat	family_neshta
behavioral1/files/0x000b000000005986-1083.dat	family_neshta
behavioral1/files/0x000d0000000056d4-1082.dat	family_neshta
behavioral1/files/0x0004000000005725-1081.dat	family_neshta
behavioral1/files/0x001700000000f7f7-1085.dat	family_neshta
behavioral1/files/0x001400000001033a-1084.dat	family_neshta
behavioral1/files/0x0001000000010314-1087.dat	family_neshta
behavioral1/memory/2892-1115-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1736-1117-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2892-1118-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Renames multiple (329) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 5 IoCs

Processes:

Client.exeClient.exeClient.exeA219.tmpsvchost.com

pid	Process
2892	Client.exe
2516	Client.exe
1016	Client.exe
2412	A219.tmp
1736	svchost.com

Loads dropped DLL 19 IoCs

Processes:

cmd.exeClient.exeClient.exeClient.exesvchost.com

pid	Process
2684	cmd.exe
2684	cmd.exe
2892	Client.exe
2516	Client.exe
2892	Client.exe
1016	Client.exe
1736	svchost.com
1736	svchost.com
1736	svchost.com
1736	svchost.com
1736	svchost.com
1736	svchost.com
1736	svchost.com
1736	svchost.com
1736	svchost.com
1736	svchost.com
1736	svchost.com
1736	svchost.com
1736	svchost.com

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

Client.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Client.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

Client.exe

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini	Client.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini	Client.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Client.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\TdGeIqAUn.bmp"	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\TdGeIqAUn.bmp"	Client.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

A219.tmp

pid	Process
2412	A219.tmp

Suspicious use of SetThreadContext 1 IoCs

Processes:

Client.exe

description	pid	Process	procid_target
PID 2516 set thread context of 1016	2516	Client.exe	37

Drops file in Program Files directory 64 IoCs

Processes:

Client.exesvchost.com

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	Client.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	Client.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	Client.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	Client.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	Client.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	Client.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	Client.exe

Drops file in Windows directory 4 IoCs

Processes:

WINWORD.EXEClient.exesvchost.com

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\svchost.com	Client.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Launches Equation Editor 1 TTPs 2 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

Processes:

EQNEDT32.EXEEQNEDT32.EXE

pid	Process
2796	EQNEDT32.EXE
2812	EQNEDT32.EXE

Modifies Control Panel 2 IoCs

evasion

Processes:

Client.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\WallpaperStyle = "10"	Client.exe

Modifies registry class 6 IoCs

Processes:

Client.exeClient.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.TdGeIqAUn\ = "TdGeIqAUn"	Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TdGeIqAUn\DefaultIcon	Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TdGeIqAUn	Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TdGeIqAUn\DefaultIcon\ = "C:\\ProgramData\\TdGeIqAUn.ico"	Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.TdGeIqAUn	Client.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
2640	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid	Process
2428	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

Client.exe

pid	Process
1016	Client.exe
1016	Client.exe
1016	Client.exe
1016	Client.exe
1016	Client.exe
1016	Client.exe
1016	Client.exe
1016	Client.exe
1016	Client.exe
1016	Client.exe
1016	Client.exe
1016	Client.exe
1016	Client.exe
1016	Client.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

Client.exe

pid	Process
1016	Client.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Client.exeClient.exe

description	pid	Process
Token: SeDebugPrivilege	2516	Client.exe
Token: SeAssignPrimaryTokenPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeDebugPrivilege	1016	Client.exe
Token: 36	1016	Client.exe
Token: SeImpersonatePrivilege	1016	Client.exe
Token: SeIncBasePriorityPrivilege	1016	Client.exe
Token: SeIncreaseQuotaPrivilege	1016	Client.exe
Token: 33	1016	Client.exe
Token: SeManageVolumePrivilege	1016	Client.exe
Token: SeProfSingleProcessPrivilege	1016	Client.exe
Token: SeRestorePrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSystemProfilePrivilege	1016	Client.exe
Token: SeTakeOwnershipPrivilege	1016	Client.exe
Token: SeShutdownPrivilege	1016	Client.exe
Token: SeDebugPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeBackupPrivilege	1016	Client.exe
Token: SeSecurityPrivilege	1016	Client.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid	Process
2428	WINWORD.EXE
2428	WINWORD.EXE

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

EQNEDT32.EXEcmd.exeClient.exeClient.exeClient.exeA219.tmpsvchost.com

description	pid	Process	procid_target
PID 2812 wrote to memory of 2684	2812	EQNEDT32.EXE	32
PID 2812 wrote to memory of 2684	2812	EQNEDT32.EXE	32
PID 2812 wrote to memory of 2684	2812	EQNEDT32.EXE	32
PID 2812 wrote to memory of 2684	2812	EQNEDT32.EXE	32
PID 2684 wrote to memory of 2892	2684	cmd.exe	35
PID 2684 wrote to memory of 2892	2684	cmd.exe	35
PID 2684 wrote to memory of 2892	2684	cmd.exe	35
PID 2684 wrote to memory of 2892	2684	cmd.exe	35
PID 2892 wrote to memory of 2516	2892	Client.exe	36
PID 2892 wrote to memory of 2516	2892	Client.exe	36
PID 2892 wrote to memory of 2516	2892	Client.exe	36
PID 2892 wrote to memory of 2516	2892	Client.exe	36
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 2516 wrote to memory of 1016	2516	Client.exe	37
PID 1016 wrote to memory of 2412	1016	Client.exe	40
PID 1016 wrote to memory of 2412	1016	Client.exe	40
PID 1016 wrote to memory of 2412	1016	Client.exe	40
PID 1016 wrote to memory of 2412	1016	Client.exe	40
PID 1016 wrote to memory of 2412	1016	Client.exe	40
PID 2412 wrote to memory of 1736	2412	A219.tmp	41
PID 2412 wrote to memory of 1736	2412	A219.tmp	41
PID 2412 wrote to memory of 1736	2412	A219.tmp	41
PID 2412 wrote to memory of 1736	2412	A219.tmp	41
PID 1736 wrote to memory of 3052	1736	svchost.com	42
PID 1736 wrote to memory of 3052	1736	svchost.com	42
PID 1736 wrote to memory of 3052	1736	svchost.com	42
PID 1736 wrote to memory of 3052	1736	svchost.com	42

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Cryp_RAT.rtf"
1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2428

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Launches Equation Editor
PID:2796

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c%tmp%\Client.exe AC
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Client.exe
    C:\Users\Admin\AppData\Local\Temp\Client.exe AC
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe" A C
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops desktop.ini file(s)
        Sets desktop wallpaper using registry
        Modifies Control Panel
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: RenamesItself
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1016
      - C:\ProgramData\A219.tmp
        
        "C:\ProgramData\A219.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A219.tmp >> NUL
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /C DEL /F /Q C:\PROGRA~3\A219.tmp >> NUL
        8⤵
        
        PID:3052

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x14c
1⤵
PID:2936

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\TdGeIqAUn.README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini

Filesize
129B

MD5
472658016d3cf53a1cada6d0094a9fa3

SHA1
7e6b1224389326fc65520c217273c3ec13e83e7a

SHA256
c442f52967f70c06d44eee5414d24c701a5bc08c7f796816d8cb4c2e39ba3239

SHA512
0a9f8383e4b1ff717a4c1be7d041cd982b41cde24a1484ecf1a9148913baffacf035329cc4cc87430aacb986616871b407acb76a3278db13e86a0172a78e49f7

Download Submit
C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

Filesize
485KB

MD5
86749cd13537a694795be5d87ef7106d

SHA1
538030845680a8be8219618daee29e368dc1e06c

SHA256
8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5

SHA512
7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

Download Submit
C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

Filesize
674KB

MD5
97510a7d9bf0811a6ea89fad85a9f3f3

SHA1
2ac0c49b66a92789be65580a38ae9798237711db

SHA256
c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea

SHA512
2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

Download Submit
C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{57A73~1\VC_RED~1.EXE

Filesize
674KB

MD5
9c10a5ec52c145d340df7eafdb69c478

SHA1
57f3d99e41d123ad5f185fc21454367a7285db42

SHA256
ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36

SHA512
2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f

Download Submit
C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{61087~1\VCREDI~1.EXE

Filesize
495KB

MD5
9597098cfbc45fae685d9480d135ed13

SHA1
84401f03a7942a7e4fcd26e4414b227edd9b0f09

SHA256
45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c

SHA512
16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164

Download Submit
C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{CA675~1\VCREDI~1.EXE

Filesize
485KB

MD5
87f15006aea3b4433e226882a56f188d

SHA1
e3ad6beb8229af62b0824151dbf546c0506d4f65

SHA256
8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919

SHA512
b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1

Download Submit
C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

Filesize
495KB

MD5
07e194ce831b1846111eb6c8b176c86e

SHA1
b9c83ec3b0949cb661878fb1a8b43a073e15baf1

SHA256
d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac

SHA512
55f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5

Download Submit
C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

Filesize
859KB

MD5
02ee6a3424782531461fb2f10713d3c1

SHA1
b581a2c365d93ebb629e8363fd9f69afc673123f

SHA256
ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

SHA512
6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

Download Submit
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe

Filesize
186KB

MD5
58b58875a50a0d8b5e7be7d6ac685164

SHA1
1e0b89c1b2585c76e758e9141b846ed4477b0662

SHA256
2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

SHA512
d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe

Filesize
1.1MB

MD5
566ed4f62fdc96f175afedd811fa0370

SHA1
d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

SHA256
e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

SHA512
cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C1952244.wmf

Filesize
316B

MD5
95bb648d6eb9265eeaf0f889731b1e23

SHA1
631d60a024835f4e53ceb9d0a987ce52fe517df4

SHA256
9639441a9d36e7e4fda980961b75eeb334540b8cfbcee71eb3cd857e0a838e0c

SHA512
184414ea68092124290049282147070a86172833359404ee26199a36083d720e291d55bb85e4ae1d02504ce841efbc646760e7cc5af4088a253aed7b2665c420

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\DDDDDDDDDD

Filesize
282KB

MD5
004ea5230758e1b9abf7a32dbb79ecc0

SHA1
673da06cc3b55e49c473e7507aa35e02aafbd13d

SHA256
6c362f6f9f1e8010b7a5b0e265a75978abfc78c15956828ab83cb2d3a6e21568

SHA512
7b8d8d44a512c5aac698e84da83d1df888253edac8baa7f1e65bdef7b713019df00c52e8eeb39f0dfd90f7c16245f9a3a571b1152105bd4f3a9c9e93b44d5b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
323KB

MD5
2b9a1b7a5e13b8672655d0a09ce50217

SHA1
2b62dbb4edbc5460bb42e790ca1a4ba7a4821362

SHA256
f6c559c031b7b16b1edf34b38e74b6bf3a7106ca34881d7f5c63b8e0d7ac3694

SHA512
db34521fbd83a5c9a3671f2ed14854e98c83256a8e16b809d7a165754e5f02c3c6b7dd1f4e994be7e859da5a5a852b5a93d4846cefbc6985d81a56a34a766f52

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$yp_RAT.rtf

Filesize
162B

MD5
2bf56fd2d95e6ce9708eb7805cc15a6b

SHA1
85753b5611e9d5ebfba70debcdc4de8899b8db5c

SHA256
f1378b9a9849b381f583b1aa440ea49c9505be3426ab9e5fcf95fd71b488020f

SHA512
8476a6252eaa850ac99af6cda13d651bac59e899e48518963f1f66ed5084566a63bd72d9ac6128a2b8be7d180614e1376ba1439d0e30e83f27525e11b16bd379

Download Submit
C:\Users\Admin\Searches\TdGeIqAUn.README.txt

Filesize
289B

MD5
47bf1514a0892e2468125cbf3b32caa9

SHA1
c3c24479ebefd9a0a05b0db879941951a702c77b

SHA256
a0c4eeae47956b19b2667ae5c94a154fc5002a78dea22e028049ece1d7a0c920

SHA512
252d78c25d9d5bd3eece76ce940cfadd6f80a81f59fea34c37495388cba4baccf1982cc2098cba28ee933b1d18cfbaa485b9e0fafa1791edfc5c86dd463329aa

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
27cc46f9e49226bff7bd9d80ceb6f00b

SHA1
ce38b70cb368a5047c32a63f5c1942e04e1d8d3d

SHA256
91a8a010b76f69ec29934c4d0fa207c54850daa5941aeccea941d46e0525fc27

SHA512
c3a9d7886aa34ef77bffdc55c5aa59eff8eed4367b514606f197590cf63deadf5f1e83b4aaf5d87e668e5e5f710ee0737b7cf64416892fcdfc6430f28b356f65

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\DDDDDDDDDDD

Filesize
129B

MD5
4b3152f62a8eb7bc029d8c0b9b8af013

SHA1
2cd1179a2b11d491aca5a6c6b51773cec740cce7

SHA256
784826a074519e0b89996845ec28e26b96047fa49bf62ec9be21648424d1c10e

SHA512
17ae98a4d17f26c3081bc77a79abbe47b53ef07d312eb6007e30419a75d4c9d08d1266955b692ac590ae4dda398143af45e293696e132d4894f7efb4b9b42833

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\ProgramData\A219.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\Client.exe

Filesize
282KB

MD5
035a441e07c7d7797cccfc92a988e156

SHA1
7d33fe3c6e43ae0440db5fc51d7d9fe653379902

SHA256
f00b211b5f93e23409e9383930c79990949b3671b1c1e0dc00208bb1c8f1e10d

SHA512
9b10c302581fed3b186ee9ad598ba98597318ae09a538eaedab7bffa0db5d4dea82d1a2ae4e320e210575763073f0e58be9416e8758ab495b02f9a54360a6636

Download Submit
\Users\Admin\AppData\Local\Temp\ose00000.exe

Filesize
145KB

MD5
9d10f99a6712e28f8acd5641e3a7ea6b

SHA1
835e982347db919a681ba12f3891f62152e50f0d

SHA256
70964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc

SHA512
2141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5

Download Submit
memory/1016-37-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1016-163-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-31-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-50-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-285-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-41-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-993-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-996-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-1003-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-1006-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-43-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-55-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-46-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-39-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-33-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-35-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-48-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1736-1117-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2428-0-0x000000002F611000-0x000000002F612000-memory.dmp

Filesize
4KB

Download
memory/2428-59-0x0000000070BCD000-0x0000000070BD8000-memory.dmp

Filesize
44KB

Download
memory/2428-2-0x0000000070BCD000-0x0000000070BD8000-memory.dmp

Filesize
44KB

Download
memory/2428-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2516-29-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/2516-24-0x0000000000E70000-0x0000000000EBC000-memory.dmp

Filesize
304KB

Download
memory/2892-1115-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2892-1118-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download