Analysis
-
max time kernel
299s -
max time network
301s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10-08-2024 19:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
test.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
300 seconds
General
-
Target
test.exe
-
Size
297KB
-
MD5
314558f9a6da39ffd12cba6c1064b3b8
-
SHA1
2c416cbfa8aeee687534b7c0888d411c0a837c59
-
SHA256
64a45b42204cf4412dc2891368a4b72670642a008b13f3d99f6d3d42de95a842
-
SHA512
41fdd3cff2e4620c0dfc7adca6a985ba5af69c1e72be409ae8d206534e32e1d3d34358f3f90521f57969c3cdf391442f4dfeba2a174b3abcbe72257d36706947
-
SSDEEP
6144:ZUL4NWKzjkaphkIOe2q4EVSh/Bw/mhMgAB:ZUsNWK3bT4EneIB
Malware Config
Extracted
Path
C:\PerfLogs\NGLFMA-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.0.4 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .NGLFMA
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/9e5effb25e31e8b0
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAJPoOjdMYqQrOCjYMpJ3vmAzCBDgs96gAaxmNh3MwitGr+OTufc7IvdlEggRIebJSlh702yHjEDIZ0kSJdyH2kwnkaDp99MAlZrpDH9O13fNdo7jCRYJZlKVI6jQFM6SjFTCOkUnMdXyBLzayJv3nmgDucdrQsqpJHjLbN1XFjqbO/Z4z60oUDgmM3YbSayUKW+VWhq9jEqKkFvoizfK3NuzpHeo/ACz5+5vaJ/llNXDUin/IWDmScSHhWFI3/h5iO93qHLfrJMax6VpKwvypU09Ijs2/HloLBc0mVlGkrUWVtZF6ThdFTq71pafxKwF2kAm4tYZs2+MDtRrMy8K03OFcsj1fxYFHlYpp17iNpbG9Vqzm7PgBUhc5ciqwzcFndCVVm5u2awUcOET7jzO/7jht4we0n+TZnW9jRACbqW1Y1CAyPCXMKXZROD4qFptmpubZIKMVpRlyxCADh92TBUEgcnjeySLtWD2PqKgWliNm+unkq6g4WG8YZ7CFJMrQCzXO+q5oFiaSVNkauofIsNBizDRXXNOHbOsTIIkWIoEgA91irUF/95X/3tHHD7Iybqqc22hhv4neR4O8uoR+5oGNDlbmDmqNM3h668kD+PKzwbWL0XcTtmrzL2WY0G6SecniduS4NbdDrX5PMcZb4R4a6ariYqXp6i8LBpFsJ4BAv12JqGNRGM634v94AQnz9fPCCXR1LZTLtbYTI6D/u4Yu+02YufaY/5WGRytBCQjgQPOt1s+21WIlIDAkEAy6Qv2iWxAl7h9vXhpPUL+oVeZE/ASW0dqkX/OCpxnSwap0+xUBYP4+M97X95aW4iK3wa/PLnQd6Q1mmA0x0PoeGewREAVlGqAuFzu0HgxFaxVcDPtvpfGAVFwUyfiLNvwDFep+oroVr/NDS0T22MxuJylKpvqMz5PMWbPZgSL60ejBeERHqrCJ3lUiJUd0dcrTu6lri9ObufMAw+8wU/RTZ0pqcceGFXCPngxKUA92MRxjqhoK/ikGFJPfX0XvU39CvwJt28zM1vFvUC0TZnByNL+14b+6+9I/EzMp3BgWVX116kjuYhOEkTTihF4TzSUGogXtfYTISRscxGZXF/1AqLJYOyiT67GU3HN5oPiUOhGaXH1K+AGWLKYxzFqeZb0ZVCjDe3pjnNQrESioNsqW+w+QiTObmQdcCU5P36GenjTPO9+rfSfK/zJRjyxfFWpaLFGA33WLRnfxJCZnZq2rjSsfjtsgBfDeMJbDS3VwSN9vwPOt9atJ/iSsuUC8C+WJdE5xHJjrgdARkmlFe1KjdpYPcpGje79yLYQMVXcTvczmWbBGFG9RSjVW4NpccQ3aVz7HYPvnPCpspwyq9PKxTnqeDF9zqe+OIgKfunPaAyuxOaI1pX4IP/dkHoF7h0CIKCZxa0XWPA5HCjhycSvxOBQCVxm7eVxEcpIS+ekStvlwepEK9w6fyAIMU/NLit53dFpsDmmeZq+6fIXxVTbliBu0nvUaNZ/8i5fzfgXJ2D74BHsbvCkdRqwc8X+xS7QkEeUdPkhy7W4eeawfy9KvE8+zj8k+eU7k1afDyDQ4nDWPCb/xNs3odq7zvzdIDstIJhKTzrek3qGWaTvCQzxX4D9QWRq+bR85UU+p4lt/LqQ4PGsU+IEe4FheluEJjwbuNtiNzafaHmg7dCcesgCwtR6BPWqkbknRKuGLsuIVLCPxmXEaiDRO1ih5OWrTWsCO7nZNPnG9JJMqjNutmSzWVtvPUSkBJEu5ZmXn4D07hVM/Ksps/pmEaQObt/8CkYmTyCK/RdI8nwxyJLTV0VQU1nHBn30pBKGNVc5xawrwpWqN0XJiT2y7TPM2aYetTLoYEOzS+KrUoT5YHWatIvyRnhyLgTyGPTrp1HY4dhyG4Txpz/HR/3X8x/wfSU1XSYGvSwJwCjba4uKOvNTKkQrU0P0jX0fBMsjUWozVPmGcBBkXULfXsIPEriz0C2hn3d4q/SyRPx3yhhIlqjh2vpS4OvlkOiMPgqnrLWRCHQFVMA4u5i3t4NfV1R0TlI+8L9gtCCCBn3xGlScXbyNhjxwKvEO68TFfXjElKfMK8oVtyxQTqq+hMirIqyrj3R1D9K2BbqkxtxrEAsMrQ2/dQoObfBgQV75zfnn0GT1gRsUl61qT+r681ygiT6dDwoQjnFfUkiZvOjAQRd8iGhRRxjNfMkyBCLJermBJVCeFHSzXEbAX8QrJVNXg1Z9zg38gqYuqQpbcAg=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZfToFRunYP7ntWvLfSTHKHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB6eLx/2M2ROtwGo1YPlqBBiLt+BHVEdgb9Cca4ou4O6b3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDxFM3vTLNOav1w4ZMHQURl2KYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOfr/KRdwPsok9V+butLOnzJ/9bHYIh8cz6exNRettGP+Pbn3W/eJIXs9ebdQm9EdhJFLd2qBglmnMLQYzygtAfj75QWEAiTIEnbJST+zbSAE=
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/9e5effb25e31e8b0
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation test.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\NGLFMA-DECRYPT.txt test.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\5e31ef5d5e31e8be12.lock test.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: test.exe File opened (read-only) \??\E: test.exe File opened (read-only) \??\G: test.exe File opened (read-only) \??\I: test.exe File opened (read-only) \??\S: test.exe File opened (read-only) \??\U: test.exe File opened (read-only) \??\V: test.exe File opened (read-only) \??\X: test.exe File opened (read-only) \??\H: test.exe File opened (read-only) \??\L: test.exe File opened (read-only) \??\P: test.exe File opened (read-only) \??\R: test.exe File opened (read-only) \??\T: test.exe File opened (read-only) \??\W: test.exe File opened (read-only) \??\Z: test.exe File opened (read-only) \??\A: test.exe File opened (read-only) \??\B: test.exe File opened (read-only) \??\M: test.exe File opened (read-only) \??\Q: test.exe File opened (read-only) \??\J: test.exe File opened (read-only) \??\K: test.exe File opened (read-only) \??\N: test.exe File opened (read-only) \??\O: test.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp" test.exe -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification C:\Program Files\ExportSwitch.MTS test.exe File opened for modification C:\Program Files\RenameClose.wpl test.exe File opened for modification C:\Program Files\SkipWait.midi test.exe File opened for modification C:\Program Files\SplitProtect.3gp2 test.exe File created C:\Program Files (x86)\NGLFMA-DECRYPT.txt test.exe File created C:\Program Files\NGLFMA-DECRYPT.txt test.exe File opened for modification C:\Program Files\DebugBackup.zip test.exe File opened for modification C:\Program Files\FormatDisable.DVR-MS test.exe File opened for modification C:\Program Files\RedoRename.jfif test.exe File created C:\Program Files\5e31ef5d5e31e8be12.lock test.exe File opened for modification C:\Program Files\ConnectOut.m4a test.exe File opened for modification C:\Program Files\PublishAssert.vsw test.exe File opened for modification C:\Program Files\RemoveExit.xps test.exe File opened for modification C:\Program Files\SelectMerge.xps test.exe File opened for modification C:\Program Files\SwitchOpen.ex_ test.exe File created C:\Program Files (x86)\5e31ef5d5e31e8be12.lock test.exe File opened for modification C:\Program Files\DebugConfirm.mht test.exe File opened for modification C:\Program Files\DebugPush.html test.exe File opened for modification C:\Program Files\LimitUnlock.vb test.exe File opened for modification C:\Program Files\SearchEnable.tiff test.exe File opened for modification C:\Program Files\ShowJoin.xls test.exe File opened for modification C:\Program Files\SwitchSync.dwfx test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 test.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString test.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier test.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E test.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 5c0000000100000004000000000800000b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f51400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa46030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 test.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945 test.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 0f0000000100000010000000824bae7c7cb3a15ce851a396760574a30b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000006200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c07090000000100000020000000301e06082b0601050507030306082b0601050507030406082b06010505070301140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c1d0000000100000010000000d06bc27453aa4f6d586437e5d3b377986800000001000000080000000000876ace99d1010300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a194520000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 test.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 0400000001000000100000008f5d770627c4983c5b9378e7d77d9bcc0300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a19456800000001000000080000000000876ace99d1011d0000000100000010000000d06bc27453aa4f6d586437e5d3b37798140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c090000000100000020000000301e06082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c070b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000000f0000000100000010000000824bae7c7cb3a15ce851a396760574a320000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 test.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 190000000100000010000000e559465e28a60e5499846f194087b0e50f0000000100000010000000824bae7c7cb3a15ce851a396760574a30b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000006200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c07090000000100000020000000301e06082b0601050507030306082b0601050507030406082b06010505070301140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c1d0000000100000010000000d06bc27453aa4f6d586437e5d3b377986800000001000000080000000000876ace99d1010300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a19450400000001000000100000008f5d770627c4983c5b9378e7d77d9bcc20000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 test.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945\Blob = 5c0000000100000004000000000400000400000001000000100000008f5d770627c4983c5b9378e7d77d9bcc0300000001000000140000007e784a101c8265cc2de1f16d47b440cad90a19456800000001000000080000000000876ace99d1011d0000000100000010000000d06bc27453aa4f6d586437e5d3b37798140000000100000014000000bea8a07472506b44b7c923d8fba8ffb3576b686c090000000100000020000000301e06082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000005f0b62eab5e353ea6521651658fbb65359f443280a4afbd104d77d10f9f04c070b000000010000004a00000045007100750069006600610078002000530065006300750072006500200047006c006f00620061006c002000650042007500730069006e006500730073002000430041002d00310000000f0000000100000010000000824bae7c7cb3a15ce851a396760574a3190000000100000010000000e559465e28a60e5499846f194087b0e520000000010000009402000030820290308201f9a003020102020101300d06092a864886f70d0101040500305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d31301e170d3939303632313034303030305a170d3230303632313034303030305a305a310b3009060355040613025553311c301a060355040a1313457175696661782053656375726520496e632e312d302b06035504031324457175696661782053656375726520476c6f62616c2065427573696e6573732043412d3130819f300d06092a864886f70d010101050003818d0030818902818100bae717900265b134553c49c251d5dfa7d1378fd1e781734152609b9da1172678adc7b1e8269432b5de338d3a2fdbf29a7a5a7398a35ce9fb8a731b5ce7c3bf806ccda9f4d62bc0f7f999aa63a2b147020fd4e4513a123c6c8a5a548470dbc1c590cf7245cba859c0cd339d3fa396eb8533211c3e1e3e606e769c6785c5c8c3610203010001a3663064301106096086480186f8420101040403020007300f0603551d130101ff040530030101ff301f0603551d23041830168014bea8a07472506b44b7c923d8fba8ffb3576b686c301d0603551d0e04160414bea8a07472506b44b7c923d8fba8ffb3576b686c300d06092a864886f70d01010405000381810030e20151aac7ea5fdab9d0650f30d63eda0d14496e9193271431efc4f72d45f8ecc7bfa2410d23b492f9190067bd01afcde071fc5acf64c4e09698d0a340e2018aef2707f165018a442d06657552c0861020215f6c6b0f6cae091caff2a21834c475a4731cf18ddcefadf9b376b492bfdc95101ebecbc83b5a8460195694a955 test.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3364 test.exe 3364 test.exe 3364 test.exe 3364 test.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4752 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4752 taskmgr.exe Token: SeSystemProfilePrivilege 4752 taskmgr.exe Token: SeCreateGlobalPrivilege 4752 taskmgr.exe Token: SeBackupPrivilege 3024 vssvc.exe Token: SeRestorePrivilege 3024 vssvc.exe Token: SeAuditPrivilege 3024 vssvc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe 4752 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3364 wrote to memory of 3316 3364 test.exe 98 PID 3364 wrote to memory of 3316 3364 test.exe 98 PID 3364 wrote to memory of 3316 3364 test.exe 98 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- System Location Discovery: System Language Discovery
PID:3316
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4752
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\NGLFMA-DECRYPT.txt1⤵PID:1172
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD53cf4ec4e095e9124e24d3b497131b8f4
SHA1bd4e3b5e0afdce68fa786f2b36a02285a1c41f98
SHA256e1bb6a6da828e453b9d5ff32e13b77a1141864b30e7016ea2416d12684c600ce
SHA512e03ea241a2189ff4e87ebfae344abc55766b4791d8dc015d0b6b47712b5f121c1e8373af0ad40512213ac002663624a5f327f15090d2add0a8ae22836061a98f