Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
15-08-2024 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
test.exe
Resource
win10-20240611-en
windows10-1703-x64
22 signatures
120 seconds
General
-
Target
test.exe
-
Size
297KB
-
MD5
314558f9a6da39ffd12cba6c1064b3b8
-
SHA1
2c416cbfa8aeee687534b7c0888d411c0a837c59
-
SHA256
64a45b42204cf4412dc2891368a4b72670642a008b13f3d99f6d3d42de95a842
-
SHA512
41fdd3cff2e4620c0dfc7adca6a985ba5af69c1e72be409ae8d206534e32e1d3d34358f3f90521f57969c3cdf391442f4dfeba2a174b3abcbe72257d36706947
-
SSDEEP
6144:ZUL4NWKzjkaphkIOe2q4EVSh/Bw/mhMgAB:ZUsNWK3bT4EneIB
Malware Config
Extracted
Path
F:\$RECYCLE.BIN\S-1-5-21-1453213197-474736321-1741884505-1000\BFCLV-DECRYPT.txt
Ransom Note
---= GANDCRAB V5.0.4 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .BFCLV
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/bdc7ac3f8d579690
| 4. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAGjz91g7Ulb5UePFTWRPDiGFzupKBksgjnftTbs+bwE4KF/EUhpEPfzNsknDPluXUzV7eCPt4xVvTEkKLYEY+l+L3TM1rwy/sMprIgO7ndU77p8Afyhwc0mHjCuh8A8aIv7VPhLTKuOhmDhf931HRc4tLhsWC8k5CXe6iVJ1tQgTc38nphQXFgo0ndlxQg8Ku2ciyLeos8Ynik1ftu2UeOwGLt60vAtigUxllKWNSsTXwUAvmyDurekzz5cLUFIjSb34sI1gauA63jazOzqMVUzUP/fx53ADJ52QKJjiPU8w38CNmR5C77wtkiUdEXaNSJlhw7tSEE96irp0Wr729UsUZSTs14+SRZXsaGffMWV7DF1axi+dF49jqc4s5AghHCv1WLNYV/A7L8nL2ZVy+zxE46LP/B5IGZeOurCBcOxgxESukP7vTARLXNbpEpl2ucuRzMxJ/zwq/t/WAELGq5e1gJJ5VO9DaxT8gZKqZ2Qj0tTbBusVoJbHDLCBD32WniaM5XSOODg59IrxsJwxxchn5ajFf6xk5xK1leatYyBE4pyBAzv4DxE3LQKyTzT2aV+rmTW409Mbyey68xChBmCH7vkuhMjhirQ1O7+Bhbm61GvzgjDr6VV6AslcBIApdR0X+FZyyMqHBNfgqq2TUlOADXXRm5olPIVqrl55mgkqTBl5oqprCbF66HVWa7jpg9O/rNQlFYHtqn0JxIDSospjlRP+8oI5L2Ulkr39iQHZfTKGEwObWTvKtReRLPqVkb8Z9vIB7ZJRjVJ4hmwQBcySB3wC6s2yfwcDBu/X5ffCR0A/EorevE7X1W9aUj7uy0lltyZ7+b7cXb1qQ8wqdj1mHfeODPMLaYMDLOs4JrCS/uZ0pjlC/Skd54JwFB2Cg6F014udT9L/snOSH+0oFD2bJnasbmt6TuC5lM1/LLGoSReu9VEnYSnP/2FUG2rfhlKSYsUFgVDtW+zxvXj2ei/LXSLFsTNynMwcNu+nWitLtZ6uzYy2QjjxnmQN/Y6R1r1hTUUUCVce3hYznL/N4bt4BN2YbiiMzxO8mh4qFfh8jdoX/YrEL5Cd27mOSuCx3yx4xGbrI+NcmEOD/aMQZNzgto0f1lPq+CUiut+agruolrk2mB+r6IHTLQmG0SgXtDQxEr/RfIXE9MwKwzgamqJtEMwsxMD7fQ6+blCGyMxT8DSq49symSDoJyyN4kbsFjir5VKo7iDc7YKSVhLJWwd79HksODNygjuBud0Y/40mreOORW1GqHDdg/jzKTwfrIrRV5kTbgVfaW0C0idwbngOzbCqNMumclDKRQV6czY90Vn6j5RDZoBYJP8WWgGkESg8AS3/pT1R4+Vl73/u0B57S1ngTrp8Cpb8ZVHtMFyzei1ITCP+24Vg1qtCt8djGl4WP16z/yJT1BLWyqwTASuy48LlI2ZGG5O2NFGAVaUcrosgRd5nXvGq7W7na5NjKIrUQFVcXxXMU12tNiFLddneEOTBUgQoYH3Rva37t2KHDQQhPo1pA6QXKCuXWSUzWZsbNxYi2kX0y/cnvj+pQfpBnh388usI335/frsLWx/I1GTBdEACqUZgnah6KLYN0n1rCh3DD7rB5kG6pZ1Kueg1DzK2BpKSUcCfM+zZhXmLNjk4sNW02gwd9sYvjY0kk6ksUJaufZ63p7vB5ZbZowWgIPsdT8u5hVp+/J5Y6aiMGnkDQxjCaAKculAXWLNdP/NK5yxUjGDxtSotCkgg24Oi0QbDc2xqU61WIEg3aINGdPprOPdJXLAhFr1SDDFdwhHQ03udeeoZY6SLEUPlux1b4uLJGl49hTYz9lyDRQRka9FFolOjKwk3OKHQGctmSbtMWbPNYhhOvnns5pJRAR3u5j2QkcST5bzXNbh5o12iBER2lxpw2/Ur5wk9/oNgcV1irenNnKxyrCcKOBBGYZSxN9M5IV34sW31TDMxarGF3TEg5kIPNUgXMnl/oFAKycjc6IyGxfSFZrTPds3jwNf151kDI+/EbB007GTFxbHjplzwMdiR9E0WwWP2P0vi3yqsw2tmnSOlEV1Xdpho4uSfUeYmusLnNFpdxo3ZQcmLTNk7GyY4Gf2IZr0NKvZbzKUvIuQVnZiNduX8J616PjcHqdSih3mpXsQwOZ31DGODO9hKlJA6BPIsCbMqGlTqaC9mf6P/18wSnrqpIxw7JTcanc/vRDUyEQdzLFTp//QnFedwJTVs/tWtTf2OPaZ4ZB6weVc=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZQTpxRq3YL7m9WorfRTGeHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZdP6U/VvqF1shzlzbajc1AHXg7l8xnT91gCFUxMg7ADMEr7316SnTFUg/DkeItL9jgqc2npLr75+pisrEhkUvBtuKs/zI2FOshGtJYalqKBiftuxGOEY0b9Scf4qq4MaaXY7JyAYzW2Q+irpQZTWoqbVO/JIoJpZFrwNsoAhPMnK4+DO5AAL2fjmE3g6prKQ3pxAlKxA7/ZibpCxFF3unLR+aj13AZSHR+RiCKCDm+1lPgdX8JmU/fnCz6QUpnn7Itlsew73IRVYjpezfyfBMcdMBhP3ZNin9AQyjCj6ZPEuHtKEitBZ9MLpGwHsgOE7+XRY0PqYl3V6Hu47PezID9bXZHh40zsuwXRaNtU//fbiHWvuIPXpReJdR69BFhflKE2uFgzGnXLQQzyAtYfjv5
---END PC DATA---
URLs
http://gandcrabmfe6mnef.onion/bdc7ac3f8d579690
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (292) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\BFCLV-DECRYPT.txt test.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\8d57917d8d57969e37.lock test.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: test.exe File opened (read-only) \??\Q: test.exe File opened (read-only) \??\U: test.exe File opened (read-only) \??\A: test.exe File opened (read-only) \??\G: test.exe File opened (read-only) \??\J: test.exe File opened (read-only) \??\M: test.exe File opened (read-only) \??\K: test.exe File opened (read-only) \??\P: test.exe File opened (read-only) \??\Y: test.exe File opened (read-only) \??\R: test.exe File opened (read-only) \??\T: test.exe File opened (read-only) \??\W: test.exe File opened (read-only) \??\H: test.exe File opened (read-only) \??\I: test.exe File opened (read-only) \??\L: test.exe File opened (read-only) \??\O: test.exe File opened (read-only) \??\X: test.exe File opened (read-only) \??\Z: test.exe File opened (read-only) \??\B: test.exe File opened (read-only) \??\E: test.exe File opened (read-only) \??\S: test.exe File opened (read-only) \??\V: test.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp" test.exe -
Drops file in Program Files directory 22 IoCs
description ioc Process File created C:\Program Files (x86)\BFCLV-DECRYPT.txt test.exe File opened for modification C:\Program Files\ClearSet.vssx test.exe File opened for modification C:\Program Files\DebugFind.M2T test.exe File opened for modification C:\Program Files\DismountSwitch.svgz test.exe File opened for modification C:\Program Files\UnlockFormat.search-ms test.exe File created C:\Program Files (x86)\8d57917d8d57969e37.lock test.exe File created C:\Program Files\8d57917d8d57969e37.lock test.exe File opened for modification C:\Program Files\ConvertRepair.edrwx test.exe File opened for modification C:\Program Files\MeasureRevoke.mpv2 test.exe File opened for modification C:\Program Files\RegisterExport.au test.exe File opened for modification C:\Program Files\OpenUse.mid test.exe File opened for modification C:\Program Files\ResizeFind.sql test.exe File opened for modification C:\Program Files\StopOptimize.edrwx test.exe File opened for modification C:\Program Files\TraceBackup.wps test.exe File created C:\Program Files\BFCLV-DECRYPT.txt test.exe File opened for modification C:\Program Files\ConfirmStep.css test.exe File opened for modification C:\Program Files\DismountWrite.vsdm test.exe File opened for modification C:\Program Files\InvokeExit.jpeg test.exe File opened for modification C:\Program Files\DebugSelect.dotx test.exe File opened for modification C:\Program Files\GrantResume.js test.exe File opened for modification C:\Program Files\ProtectFind.i64 test.exe File opened for modification C:\Program Files\WatchLimit.ttc test.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 test.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString test.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier test.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E test.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 5c0000000100000004000000000800000b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f51400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa46030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 test.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4496 test.exe 4496 test.exe 4496 test.exe 4496 test.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4920 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 4920 taskmgr.exe Token: SeSystemProfilePrivilege 4920 taskmgr.exe Token: SeCreateGlobalPrivilege 4920 taskmgr.exe Token: SeIncreaseQuotaPrivilege 4204 wmic.exe Token: SeSecurityPrivilege 4204 wmic.exe Token: SeTakeOwnershipPrivilege 4204 wmic.exe Token: SeLoadDriverPrivilege 4204 wmic.exe Token: SeSystemProfilePrivilege 4204 wmic.exe Token: SeSystemtimePrivilege 4204 wmic.exe Token: SeProfSingleProcessPrivilege 4204 wmic.exe Token: SeIncBasePriorityPrivilege 4204 wmic.exe Token: SeCreatePagefilePrivilege 4204 wmic.exe Token: SeBackupPrivilege 4204 wmic.exe Token: SeRestorePrivilege 4204 wmic.exe Token: SeShutdownPrivilege 4204 wmic.exe Token: SeDebugPrivilege 4204 wmic.exe Token: SeSystemEnvironmentPrivilege 4204 wmic.exe Token: SeRemoteShutdownPrivilege 4204 wmic.exe Token: SeUndockPrivilege 4204 wmic.exe Token: SeManageVolumePrivilege 4204 wmic.exe Token: 33 4204 wmic.exe Token: 34 4204 wmic.exe Token: 35 4204 wmic.exe Token: 36 4204 wmic.exe Token: SeIncreaseQuotaPrivilege 4204 wmic.exe Token: SeSecurityPrivilege 4204 wmic.exe Token: SeTakeOwnershipPrivilege 4204 wmic.exe Token: SeLoadDriverPrivilege 4204 wmic.exe Token: SeSystemProfilePrivilege 4204 wmic.exe Token: SeSystemtimePrivilege 4204 wmic.exe Token: SeProfSingleProcessPrivilege 4204 wmic.exe Token: SeIncBasePriorityPrivilege 4204 wmic.exe Token: SeCreatePagefilePrivilege 4204 wmic.exe Token: SeBackupPrivilege 4204 wmic.exe Token: SeRestorePrivilege 4204 wmic.exe Token: SeShutdownPrivilege 4204 wmic.exe Token: SeDebugPrivilege 4204 wmic.exe Token: SeSystemEnvironmentPrivilege 4204 wmic.exe Token: SeRemoteShutdownPrivilege 4204 wmic.exe Token: SeUndockPrivilege 4204 wmic.exe Token: SeManageVolumePrivilege 4204 wmic.exe Token: 33 4204 wmic.exe Token: 34 4204 wmic.exe Token: 35 4204 wmic.exe Token: 36 4204 wmic.exe Token: SeBackupPrivilege 3116 vssvc.exe Token: SeRestorePrivilege 3116 vssvc.exe Token: SeAuditPrivilege 3116 vssvc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe 4920 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4496 wrote to memory of 4204 4496 test.exe 73 PID 4496 wrote to memory of 4204 4496 test.exe 73 PID 4496 wrote to memory of 4204 4496 test.exe 73 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4920
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3116
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD50d50d2a7539a2b7e57fe357f03a575ca
SHA1322ef86d61a42765ce24a97b31bbc7272f78dea1
SHA2560317b936ffae0dd78cd95f88cba3bf02b4017625e742978623af37362b6c3960
SHA51279e905c5685535ad903adbeea6b5339d8fc73ec8d51370ad406fd7822e12bfec4c612f15a5cc10f67ba9c91f5ee91a49cc3a9738ba8652e3fcd11b9a20b0e132