cerber | d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
Size

231KB
MD5

5b2c1302039d496f0f970f559b201dfe
SHA1

796d10701e5d1dc3e49119322cabc46c5619d272
SHA256

d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d
SHA512

5a685fe98463e7150dbd23cd5ad01c12ccadb03d5eab16099bc0e34d04cd524dcf5be2d2e41a0b0f525242d0539a95d9fcb93dae140291a1ee994c478768e708
SSDEEP

6144:9PIeJarlToZNDlkPNvabl9uxX0Xp85VBLc4vm+fbcn8Klh3vOCU:9QxX0Xp8lc428EJ4

Score

10^/10

cerber discovery evasion persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note

C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community #Cerber+Rans0mware. ######################################################################### !!! If you are reading this message it means the software !!! "Cerber Rans0mware" has been removed from your computer. ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17 | | 2. http://52uo5k3t73ypjije.go8hpw.top/352A-6370-B700-0073-3E17 | | 3. http://52uo5k3t73ypjije.n6kswi.top/352A-6370-B700-0073-3E17 | | 4. http://52uo5k3t73ypjije.1bipa9.top/352A-6370-B700-0073-3E17 | | 5. http://52uo5k3t73ypjije.onion.to/352A-6370-B700-0073-3E17 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/352A-6370-B700-0073-3E17 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17

http://52uo5k3t73ypjije.go8hpw.top/352A-6370-B700-0073-3E17

http://52uo5k3t73ypjije.n6kswi.top/352A-6370-B700-0073-3E17

http://52uo5k3t73ypjije.1bipa9.top/352A-6370-B700-0073-3E17

http://52uo5k3t73ypjije.onion.to/352A-6370-B700-0073-3E17

http://52uo5k3t73ypjije.onion/352A-6370-B700-0073-3E17

Extracted

Path

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .tor { padding: 10px 0; text-align: center; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. <hr> If you are reading this message it means the software "Cerber Rans0mware" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li><a href="http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17" target="_blank">http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17</a></li> <li><a href="http://52uo5k3t73ypjije.go8hpw.top/352A-6370-B700-0073-3E17" target="_blank">http://52uo5k3t73ypjije.go8hpw.top/352A-6370-B700-0073-3E17</a></li> <li><a href="http://52uo5k3t73ypjije.n6kswi.top/352A-6370-B700-0073-3E17" target="_blank">http://52uo5k3t73ypjije.n6kswi.top/352A-6370-B700-0073-3E17</a></li> <li><a href="http://52uo5k3t73ypjije.1bipa9.top/352A-6370-B700-0073-3E17" target="_blank">http://52uo5k3t73ypjije.1bipa9.top/352A-6370-B700-0073-3E17</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/352A-6370-B700-0073-3E17" target="_blank">http://52uo5k3t73ypjije.onion.to/352A-6370-B700-0073-3E17</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is <a href="http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17" target="_blank">http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <a href="http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17" target="_blank">http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is <a href="http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17" target="_blank">http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/352A-6370-B700-0073-3E17 in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> </body> </html>

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\\EhStorAuthn.exe\""	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\\EhStorAuthn.exe\""	EhStorAuthn.exe

Contacts a large (517) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
1696	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\EhStorAuthn.lnk	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\EhStorAuthn.lnk	EhStorAuthn.exe

Executes dropped EXE 1 IoCs

pid	Process
2496	EhStorAuthn.exe

Loads dropped DLL 2 IoCs

pid	Process
3004	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
2496	EhStorAuthn.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\EhStorAuthn = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\\EhStorAuthn.exe\""	EhStorAuthn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\EhStorAuthn = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\\EhStorAuthn.exe\""	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\EhStorAuthn = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\\EhStorAuthn.exe\""	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\EhStorAuthn = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\\EhStorAuthn.exe\""	EhStorAuthn.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EhStorAuthn.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8B4F.bmp"	EhStorAuthn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EhStorAuthn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1696	cmd.exe
3020	PING.EXE
2564	cmd.exe
2684	PING.EXE

Kills process with taskkill 2 IoCs

evasion

pid	Process
2612	taskkill.exe
2572	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\\EhStorAuthn.exe\""	EhStorAuthn.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\\EhStorAuthn.exe\""	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop	EhStorAuthn.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000a9f44de49e0d8869e9f0b8228de6786f1d145644a88c1477a2967486141d1a50000000000e80000000020000200000002616737f24edc07c269403e0ac88126c075da5e53c759e9115564fc0387c5dfa90000000780bbe34a9e5355f4c1d6828d8b5e58331be6f400f1c05ea0ef4e4a3df117f897c4c4097f7f645f6d0d92b2b6b616847d350f5a97fd077c06624d1367700980eb3b73b4a026ed30c1259d5e28816e70237a092dabf629eb8a795ae3c57a905917b7dabbd0f05c901abcbc50e40be9429752db2801e39aa8de6993f9b01eeaa01da3a2a642641860e53fc637969476c1340000000f59c76cb5f3fc195971e11f3a9997e144a4d29ab4f43205041a046fa6dcdd0a5abab677cacf440b04233ea0d6ffc286a143739c785657fe144812e5befaf1b6f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02b4291b4f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE0325E1-62A7-11EF-BDB6-FE3EAF6E2A14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CDF73F01-62A7-11EF-BDB6-FE3EAF6E2A14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000fd081dcc84fd4438b3d67dfd03707491b48aebc399ec9687e0d3d412f03a94f3000000000e8000000002000020000000b935e33a7687ce93c6505a295a6a1032d1c3384413eef81cb70260941f4b64832000000068b72b5677472c193f22373876c445d37a5702c051e1eeb1a059e4c6ec6eb74640000000da194b4b6427018ac488ffe8f8255fa65ce9e1cc1ee293b0af999afbf1bc35e6faaf6ebec0013a78c1616eccd068fbcc8b81b26a700c1a764cf99f2a5d2fe04b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3020	PING.EXE
2684	PING.EXE

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe
2496	EhStorAuthn.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	2496	EhStorAuthn.exe
Token: 33	1956	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1956	AUDIODG.EXE
Token: 33	1956	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1956	AUDIODG.EXE
Token: SeDebugPrivilege	2612	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2784	iexplore.exe
2784	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2496	3004	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe	30
PID 3004 wrote to memory of 2496	3004	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe	30
PID 3004 wrote to memory of 2496	3004	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe	30
PID 3004 wrote to memory of 2496	3004	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe	30
PID 3004 wrote to memory of 1696	3004	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe	31
PID 3004 wrote to memory of 1696	3004	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe	31
PID 3004 wrote to memory of 1696	3004	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe	31
PID 3004 wrote to memory of 1696	3004	d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe	31
PID 1696 wrote to memory of 2572	1696	cmd.exe	33
PID 1696 wrote to memory of 2572	1696	cmd.exe	33
PID 1696 wrote to memory of 2572	1696	cmd.exe	33
PID 1696 wrote to memory of 2572	1696	cmd.exe	33
PID 1696 wrote to memory of 3020	1696	cmd.exe	35
PID 1696 wrote to memory of 3020	1696	cmd.exe	35
PID 1696 wrote to memory of 3020	1696	cmd.exe	35
PID 1696 wrote to memory of 3020	1696	cmd.exe	35
PID 2496 wrote to memory of 2784	2496	EhStorAuthn.exe	37
PID 2496 wrote to memory of 2784	2496	EhStorAuthn.exe	37
PID 2496 wrote to memory of 2784	2496	EhStorAuthn.exe	37
PID 2496 wrote to memory of 2784	2496	EhStorAuthn.exe	37
PID 2496 wrote to memory of 1548	2496	EhStorAuthn.exe	38
PID 2496 wrote to memory of 1548	2496	EhStorAuthn.exe	38
PID 2496 wrote to memory of 1548	2496	EhStorAuthn.exe	38
PID 2496 wrote to memory of 1548	2496	EhStorAuthn.exe	38
PID 2784 wrote to memory of 2024	2784	iexplore.exe	39
PID 2784 wrote to memory of 2024	2784	iexplore.exe	39
PID 2784 wrote to memory of 2024	2784	iexplore.exe	39
PID 2784 wrote to memory of 2024	2784	iexplore.exe	39
PID 2284 wrote to memory of 1468	2284	iexplore.exe	41
PID 2284 wrote to memory of 1468	2284	iexplore.exe	41
PID 2284 wrote to memory of 1468	2284	iexplore.exe	41
PID 2284 wrote to memory of 1468	2284	iexplore.exe	41
PID 2784 wrote to memory of 2072	2784	iexplore.exe	42
PID 2784 wrote to memory of 2072	2784	iexplore.exe	42
PID 2784 wrote to memory of 2072	2784	iexplore.exe	42
PID 2784 wrote to memory of 2072	2784	iexplore.exe	42
PID 2496 wrote to memory of 1692	2496	EhStorAuthn.exe	43
PID 2496 wrote to memory of 1692	2496	EhStorAuthn.exe	43
PID 2496 wrote to memory of 1692	2496	EhStorAuthn.exe	43
PID 2496 wrote to memory of 1692	2496	EhStorAuthn.exe	43
PID 2496 wrote to memory of 2564	2496	EhStorAuthn.exe	46
PID 2496 wrote to memory of 2564	2496	EhStorAuthn.exe	46
PID 2496 wrote to memory of 2564	2496	EhStorAuthn.exe	46
PID 2496 wrote to memory of 2564	2496	EhStorAuthn.exe	46
PID 2564 wrote to memory of 2612	2564	cmd.exe	48
PID 2564 wrote to memory of 2612	2564	cmd.exe	48
PID 2564 wrote to memory of 2612	2564	cmd.exe	48
PID 2564 wrote to memory of 2684	2564	cmd.exe	49
PID 2564 wrote to memory of 2684	2564	cmd.exe	49
PID 2564 wrote to memory of 2684	2564	cmd.exe	49

C:\Users\Admin\AppData\Local\Temp\d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
"C:\Users\Admin\AppData\Local\Temp\d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe"
1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Roaming\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\EhStorAuthn.exe
  "C:\Users\Admin\AppData\Roaming\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\EhStorAuthn.exe"
  2⤵
  - Adds policy Run key to start application
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2024
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:537601 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2072
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
    3⤵
    PID:1548
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
    3⤵
    PID:1692
- - C:\Windows\system32\cmd.exe
    /d /c taskkill /t /f /im "EhStorAuthn.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\EhStorAuthn.exe" > NUL
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\system32\taskkill.exe
      taskkill /t /f /im "EhStorAuthn.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2612
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2684
- C:\Windows\SysWOW64\cmd.exe
  /d /c taskkill /t /f /im "d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe" > NUL
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /t /f /im "d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3020

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1468

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:2484

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x17c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.html

Filesize
12KB

MD5
b3e696a2aa756b9b15652745662850b6

SHA1
955af5b135a0629938790b116fdad9fe89223b05

SHA256
920ff3ab9938ef090d6fe5c07a3d93dfb03c4407dd1a1b95abc9abe15c891c2c

SHA512
a2853c41e28f235fb237b72073ba61984d533fa9afc8f783655d27c0d1dcc3dec72cf48971bb606c89438d673e24b8c385d3c16611f49f71a3bb0d18dec00f22

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
01fc4e3c18c069ead24d709da155724a

SHA1
23875b3262f6cd2c4076e6099afba0242c95ba9c

SHA256
a0fdd78d8c0835429519abebaa27c558ba9d882abd21554ef0d3cfa541f834c0

SHA512
714376a2a5c42dc113e562be1ddc239b1055e277a1fc7a8878f6470f49b0707e3dde5c77064290dd0bcdfc829d92c1cd61d9975f5fb644b9d405a749b7c3bb74

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.url

Filesize
90B

MD5
f0ec40e7c2cf6e9f5311744efcfb2bbe

SHA1
5e56bff3ef18067d80a97c602de397b759b56740

SHA256
ed362abc35add278e8d6b4b0eee21a90804bf800eabbd877d3e0a93b74ed86eb

SHA512
35f203267dbbac50c7ea2a0f3a0213f39d64ca45b4dbe9228d07d6bf068baf93fcde4612bd20e5408971bc35979729f360677479437ab3aa1377a032f5c87b01

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.vbs

Filesize
234B

MD5
6f84dbf74ef41dc3d861f5fb3e0f45ff

SHA1
3e5f17e9b9589f33ce6add7f2518a666ff2253a4

SHA256
df5f432d7e0d2bd1c4dddb1fabbf1e77bd1065b9020f71abaf1a45fbb950bbb8

SHA512
9f9ec25b815be7b20df26244d31848c9a4896b130241b63636d63511a290eaad78d289a9bb04592c0ba31492064671351b4c7359310f03469e27764132a20a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d12acbc263eaeaf98dcfb4cca793c4c

SHA1
6a5cc1529a9715f5370def3c469f7a6e25326fd0

SHA256
326f160c82ea5eeda1fac3a1debc1464152b374ce64997ddf39d8080c167a060

SHA512
ef821d0e51b10ae4a2a7dbb0bf71947a7c4219ec03e1cf7dfc8acb5a689232bb832c790602cd02c48c020ab273de9a43dfd07d2aac702a7a407195661b5f0183

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c556de43b8804c45eb26ca2e0d253c5c

SHA1
a05cd4b5ab2a5e73c3c4ca01a2a98a2349b6f3f3

SHA256
1bfe1a85fa1b4c068e56c368394e03ccc9a34e312dc0b085948cf79bdd70396b

SHA512
59c6fc2a09c793a355faa04d039a7daecbb80e1ce91f7fa46cea323fb5754512703f8095e3131930978a7f24328034736a258e4a1281affebf77b3e5642b7947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebf3925a6b6a6a342c65dc272cec050d

SHA1
289ab0f381fda7d53741840e311a0f6529100a92

SHA256
29a16ce4b3d991b5cf620914b3f0ce428f93b93786494ee297175dba9070f21c

SHA512
2aa728ffd33f24ab2d690ca354dd8fb5b70512bc9cba41bbd9de4bab345bbb1aad7ce1dc93945cbfca05a93a9428df77bea8e3ac8ecf407405187c1a6f8856e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e4d7ea7764c31d1b6f764d64fd87fd0

SHA1
e99fcb59f0a13a7d3d9ed47216e3eb3afb6dcaf4

SHA256
8bbb4b889eefee106581cc9beb7bb389d9c42921e1cca6ac9a5601c7e5c6b7b4

SHA512
4c2680628de94525444d39a2226f3782eb9354da539c61eba8c5c686911c9eac34e21b9db8408536669133cbafe1ba9a70e1ec284440d234681b2278d94c099a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cb5003ec7970f20bba96ce661fff2e6

SHA1
ff84c858808cd1428d5aac8ec6a4a463e9e34f75

SHA256
18a473ff9b66b2d7210da2342d23f7f7eeece3cf764e9c80c463dc720ce1e0c3

SHA512
4ddc741f335dc00c9951b5dc8a8c34acfbe39f587d429c306cf3fe6a5a7e2c9b91cba53b33300eb31b0b964d457d1b3efdbbde9f81774274a3a7b1f1d13e6448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58f30e50c1d439ccf0c1b4267f5308c4

SHA1
4d01ceb0239cfde5567bc19d8401d54ee34249d6

SHA256
15b4158740eb9a74128251ecc3667e2d16d0ba8e44a2d3a74fbaf837f6de7cc4

SHA512
5191be8894ca0c35f0ed35cc0a8fb7c9e617f72fdc4b8a52d4a65d3f00550998976864435ca380806fd7faa1b93d9d5e79d10df99b18e01bd913223092d20e53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07429e656024e675b37fe0b79ecc2598

SHA1
f9c9d02435e7dbc55cb8845317450107ed4a7a92

SHA256
692188b61d5c017369cd5fc91964a417fda1b92a50ae165bec643fc86150951f

SHA512
ec8c89c957813bb627bf40aeb35f3c68abd3d60e9a61826f750a7d0c7831e41f9e350d50cac371a0bdff843d4397cb62f64706ade8a2088b39654e7ce30ef4a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
626c211d035d918df554af17b9cbb88f

SHA1
a0159d752e796d78cac89a5d468cc122181b25b5

SHA256
5cf7442111cb126df958124f67d13bac25a4ee46376fc87161b1e6236aca76db

SHA512
f0ac25a009de54eb90547802c99fcd9b658fd4e7a51ffef266de16f89aaf5b418419cf2419c643fb6ad315c64be7c8f100aaee624c7432766c1e78c531ccac6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2568b983157d4f63eb3b00cf63a8481f

SHA1
0102fce4bcd1e687b16ce10efceed91e215fd700

SHA256
6a1c0418dc87ac2d01a1c4b661f162436af115cb556c6dc183d46ee467a7aec5

SHA512
782c065b1912e40778be8cd5c518d94e44161d0e7f1854384039a29df8e1b84b9c1f2b84ae918082d25cd3a646186d16af87b39373134295c4e2af0e35f679e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45a96f2f3740c279cedf797e12e261cb

SHA1
70480907b7e4742d4122ebee5c74cc2a5d578397

SHA256
8b25935e9400b8d44c113e071c01cb31a6f669b82d27793403a1d615bde7be76

SHA512
60ac836396bde86e581926aa75868c75fb31315c2519098b94d1c065199284ede05c8f3939e254d669f1389bf5d2abb149cc784866afb6af0deac914d00f2063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CDF73F01-62A7-11EF-BDB6-FE3EAF6E2A14}.dat

Filesize
5KB

MD5
d4ef87bf330ed646c4062f8b1bb19bc9

SHA1
ca82c79e7c292aea116eeb13851f71c150f72be3

SHA256
98d1dc7874f6f76ca5e609f6e721f582da8065cde99be6e2b9d347bd18810451

SHA512
2c7ba858197f549f2e0a3df6c1ed51f86cee56fbb5674c442c9f8479e7aea96a5f2badea3dfdb148a3fdb63437fc54635d81c17c56e401c940408a3b441de2e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CE0325E1-62A7-11EF-BDB6-FE3EAF6E2A14}.dat

Filesize
3KB

MD5
978741a7ef52754de6bd1c9d397794ce

SHA1
dc2049f5c4b607b0dfb38d40d09ccae1f78710ae

SHA256
1d655c41a828ae1de4f9e7b3edfd0c694921d04a2b3e1fa5d37ee94eaa5f4dd1

SHA512
8d4a34427f495ce29cd44ecec62dd1428b4c70c0eb77ed6feacf10713737a82b7a4eab0dd3643f11626457431406a30287d75badf4aa2bc8eb6c63ae2b434b40

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA49C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA53B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\EhStorAuthn.lnk

Filesize
1KB

MD5
cf2d493308d8ad324f384ce0c88c9556

SHA1
d0426feeeb68dd35bc4eb891bbc649ce4eecf51e

SHA256
783d4d7e3c00fde79e1f30f84a7d150d08a4c419fb2477deb97c84548c2ce86c

SHA512
c3e7eef8afeb7bcf1d39829a4af636fc6b22d226728c9cfa1ac616e75401c01a04b34e294e0a7ffc777cf940d3b39b8985c8724f4f1a673ea8724afcdd740197

Download Submit
\Users\Admin\AppData\Roaming\{E928710A-E979-F53C-318F-B4C7DDC4D2F4}\EhStorAuthn.exe

Filesize
231KB

MD5
5b2c1302039d496f0f970f559b201dfe

SHA1
796d10701e5d1dc3e49119322cabc46c5619d272

SHA256
d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d

SHA512
5a685fe98463e7150dbd23cd5ad01c12ccadb03d5eab16099bc0e34d04cd524dcf5be2d2e41a0b0f525242d0539a95d9fcb93dae140291a1ee994c478768e708

Download Submit
memory/2496-479-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2496-27-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2496-347-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2496-25-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2496-466-0x0000000005290000-0x0000000005292000-memory.dmp

Filesize
8KB

Download
memory/2496-26-0x00000000031A0000-0x0000000003238000-memory.dmp

Filesize
608KB

Download
memory/2496-18-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2496-17-0x00000000031A0000-0x0000000003238000-memory.dmp

Filesize
608KB

Download
memory/3004-16-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3004-15-0x0000000003110000-0x00000000031A8000-memory.dmp

Filesize
608KB

Download
memory/3004-2-0x0000000003B20000-0x0000000003B21000-memory.dmp

Filesize
4KB

Download
memory/3004-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3004-3-0x0000000003110000-0x00000000031A8000-memory.dmp

Filesize
608KB

Download
memory/3004-0-0x0000000003110000-0x00000000031A8000-memory.dmp

Filesize
608KB

Download
memory/3004-1-0x0000000003B20000-0x0000000003B21000-memory.dmp

Filesize
4KB

Download