Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30-10-2024 19:33
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
2.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
3.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
4.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
4.exe
Resource
win10v2004-20241007-en
General
-
Target
4.exe
-
Size
2.5MB
-
MD5
079610302f0c449bb454fbd348326fa3
-
SHA1
35355d776ed07c193243e6eb24d45718a021b835
-
SHA256
e4249546f902dfcf2a13540b5e843f33e622937d89b081b9959257642bc9e661
-
SHA512
d9b0bf9bae684a18ced71feaa1ae6019eeab2f7af7008b5f040b730ef44d80e1e6d6b4aed03d75129e9f044b0a8e37bbc7861f4352052888e1836c443d5064e2
-
SSDEEP
49152:QgwR+ifu1DBgutBPN2q1dNnzbpz7Mwulf+qV8L77hpe3D04dtaa7X:QgwR+vguPP/7NzRMwulF8L/hpe3YM
Malware Config
Extracted
C:\Users\Admin\AppData\Local\IMPORTANT_NOTICE.txt
Signatures
-
Detects Mimic ransomware 2 IoCs
resource yara_rule behavioral7/files/0x00050000000195c3-31.dat family_mimic behavioral7/files/0x00050000000195c1-42.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Mimic family
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "3" DC.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BLUE.exe -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2956 bcdedit.exe 2284 bcdedit.exe -
Renames multiple (3360) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2076 wbadmin.exe -
pid Process 816 wbadmin.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" BLUE.exe -
Deletes itself 1 IoCs
pid Process 2256 cmd.exe -
Executes dropped EXE 10 IoCs
pid Process 3000 7za.exe 2740 7za.exe 2744 TEQ2.exe 1036 BLUE.exe 1248 DC.exe 1808 BLUE.exe 2772 BLUE.exe 2820 BLUE.exe 2296 Everything.exe 1820 Everything.exe -
Loads dropped DLL 15 IoCs
pid Process 2376 4.exe 2376 4.exe 2376 4.exe 2744 TEQ2.exe 2744 TEQ2.exe 1036 BLUE.exe 2308 cmd.exe 1808 BLUE.exe 2772 BLUE.exe 2820 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" TEQ2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command TEQ2.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell TEQ2.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell\open TEQ2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" TEQ2.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command BLUE.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell\open\command BLUE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell\open\command TEQ2.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection DC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BLUE = "\"C:\\Users\\Admin\\AppData\\Local\\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\\BLUE.exe\" " TEQ2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BLUE.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\B: BLUE.exe File opened (read-only) \??\E: BLUE.exe File opened (read-only) \??\W: BLUE.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\O: BLUE.exe File opened (read-only) \??\P: BLUE.exe File opened (read-only) \??\Q: BLUE.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\G: BLUE.exe File opened (read-only) \??\X: BLUE.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\T: BLUE.exe File opened (read-only) \??\V: BLUE.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\M: BLUE.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\H: BLUE.exe File opened (read-only) \??\L: BLUE.exe File opened (read-only) \??\U: BLUE.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\J: BLUE.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\K: BLUE.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\N: BLUE.exe File opened (read-only) \??\Z: BLUE.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\Y: BLUE.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\R: BLUE.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\A: BLUE.exe File opened (read-only) \??\S: BLUE.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\I: BLUE.exe -
Power Settings 1 TTPs 15 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2684 powercfg.exe 2380 powercfg.exe 1904 powercfg.exe 1512 powercfg.exe 1480 powercfg.exe 2708 powercfg.exe 936 powercfg.exe 1280 powercfg.exe 472 powercfg.exe 2516 powercfg.exe 2340 powercfg.exe 108 powercfg.exe 1360 powercfg.exe 1516 powercfg.exe 1856 powercfg.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol DC.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini DC.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\[email protected] BLUE.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full_partly-cloudy.png.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\[email protected] BLUE.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\[email protected] BLUE.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\[email protected] BLUE.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.datenklause0@gmail.com.blue BLUE.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] BLUE.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\[email protected] BLUE.exe File opened for modification C:\Program Files\7-Zip\Lang\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\[email protected] BLUE.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\[email protected] BLUE.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] BLUE.exe File opened for modification C:\Program Files\Java\jre7\lib\[email protected] BLUE.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\[email protected] BLUE.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected] BLUE.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe -
pid Process 2664 powershell.exe 2224 powershell.exe 864 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEQ2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLUE.exe -
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\IMPORTANT_NOTICE.txt\"" BLUE.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell\open TEQ2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" TEQ2.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command BLUE.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell\open\command BLUE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open BLUE.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell TEQ2.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command BLUE.exe Key created \REGISTRY\MACHINE\Software\Classes\.blue BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.blue\ = "mimicfile" BLUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" TEQ2.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile\shell\open\command TEQ2.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\exefile TEQ2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell BLUE.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command TEQ2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" BLUE.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 1248 DC.exe 1248 DC.exe 1248 DC.exe 1248 DC.exe 2772 BLUE.exe 2820 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 1036 BLUE.exe 2224 powershell.exe 2664 powershell.exe 864 powershell.exe 1036 BLUE.exe 1036 BLUE.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3000 7za.exe Token: 35 3000 7za.exe Token: SeRestorePrivilege 2740 7za.exe Token: 35 2740 7za.exe Token: SeSecurityPrivilege 2740 7za.exe Token: SeSecurityPrivilege 2740 7za.exe Token: SeIncreaseQuotaPrivilege 2744 TEQ2.exe Token: SeSecurityPrivilege 2744 TEQ2.exe Token: SeTakeOwnershipPrivilege 2744 TEQ2.exe Token: SeLoadDriverPrivilege 2744 TEQ2.exe Token: SeSystemProfilePrivilege 2744 TEQ2.exe Token: SeSystemtimePrivilege 2744 TEQ2.exe Token: SeProfSingleProcessPrivilege 2744 TEQ2.exe Token: SeIncBasePriorityPrivilege 2744 TEQ2.exe Token: SeCreatePagefilePrivilege 2744 TEQ2.exe Token: SeBackupPrivilege 2744 TEQ2.exe Token: SeRestorePrivilege 2744 TEQ2.exe Token: SeShutdownPrivilege 2744 TEQ2.exe Token: SeDebugPrivilege 2744 TEQ2.exe Token: SeSystemEnvironmentPrivilege 2744 TEQ2.exe Token: SeChangeNotifyPrivilege 2744 TEQ2.exe Token: SeRemoteShutdownPrivilege 2744 TEQ2.exe Token: SeUndockPrivilege 2744 TEQ2.exe Token: SeManageVolumePrivilege 2744 TEQ2.exe Token: SeImpersonatePrivilege 2744 TEQ2.exe Token: SeCreateGlobalPrivilege 2744 TEQ2.exe Token: 33 2744 TEQ2.exe Token: 34 2744 TEQ2.exe Token: 35 2744 TEQ2.exe Token: SeIncreaseQuotaPrivilege 1036 BLUE.exe Token: SeSecurityPrivilege 1036 BLUE.exe Token: SeTakeOwnershipPrivilege 1036 BLUE.exe Token: SeLoadDriverPrivilege 1036 BLUE.exe Token: SeSystemProfilePrivilege 1036 BLUE.exe Token: SeSystemtimePrivilege 1036 BLUE.exe Token: SeProfSingleProcessPrivilege 1036 BLUE.exe Token: SeIncBasePriorityPrivilege 1036 BLUE.exe Token: SeCreatePagefilePrivilege 1036 BLUE.exe Token: SeBackupPrivilege 1036 BLUE.exe Token: SeRestorePrivilege 1036 BLUE.exe Token: SeShutdownPrivilege 1036 BLUE.exe Token: SeDebugPrivilege 1036 BLUE.exe Token: SeSystemEnvironmentPrivilege 1036 BLUE.exe Token: SeChangeNotifyPrivilege 1036 BLUE.exe Token: SeRemoteShutdownPrivilege 1036 BLUE.exe Token: SeUndockPrivilege 1036 BLUE.exe Token: SeManageVolumePrivilege 1036 BLUE.exe Token: SeImpersonatePrivilege 1036 BLUE.exe Token: SeCreateGlobalPrivilege 1036 BLUE.exe Token: 33 1036 BLUE.exe Token: 34 1036 BLUE.exe Token: 35 1036 BLUE.exe Token: SeDebugPrivilege 1248 DC.exe Token: SeAssignPrimaryTokenPrivilege 1248 DC.exe Token: SeIncreaseQuotaPrivilege 1808 BLUE.exe Token: SeSecurityPrivilege 1808 BLUE.exe Token: SeTakeOwnershipPrivilege 1808 BLUE.exe Token: SeLoadDriverPrivilege 1808 BLUE.exe Token: SeSystemProfilePrivilege 1808 BLUE.exe Token: SeSystemtimePrivilege 1808 BLUE.exe Token: SeProfSingleProcessPrivilege 1808 BLUE.exe Token: SeIncBasePriorityPrivilege 1808 BLUE.exe Token: SeCreatePagefilePrivilege 1808 BLUE.exe Token: SeBackupPrivilege 1808 BLUE.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2296 Everything.exe 1820 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 3000 2376 4.exe 29 PID 2376 wrote to memory of 3000 2376 4.exe 29 PID 2376 wrote to memory of 3000 2376 4.exe 29 PID 2376 wrote to memory of 3000 2376 4.exe 29 PID 2376 wrote to memory of 2740 2376 4.exe 31 PID 2376 wrote to memory of 2740 2376 4.exe 31 PID 2376 wrote to memory of 2740 2376 4.exe 31 PID 2376 wrote to memory of 2740 2376 4.exe 31 PID 2376 wrote to memory of 2744 2376 4.exe 33 PID 2376 wrote to memory of 2744 2376 4.exe 33 PID 2376 wrote to memory of 2744 2376 4.exe 33 PID 2376 wrote to memory of 2744 2376 4.exe 33 PID 2744 wrote to memory of 1036 2744 TEQ2.exe 34 PID 2744 wrote to memory of 1036 2744 TEQ2.exe 34 PID 2744 wrote to memory of 1036 2744 TEQ2.exe 34 PID 2744 wrote to memory of 1036 2744 TEQ2.exe 34 PID 1036 wrote to memory of 2308 1036 BLUE.exe 35 PID 1036 wrote to memory of 2308 1036 BLUE.exe 35 PID 1036 wrote to memory of 2308 1036 BLUE.exe 35 PID 1036 wrote to memory of 2308 1036 BLUE.exe 35 PID 2308 wrote to memory of 1248 2308 cmd.exe 37 PID 2308 wrote to memory of 1248 2308 cmd.exe 37 PID 2308 wrote to memory of 1248 2308 cmd.exe 37 PID 2308 wrote to memory of 1248 2308 cmd.exe 37 PID 1036 wrote to memory of 1808 1036 BLUE.exe 38 PID 1036 wrote to memory of 1808 1036 BLUE.exe 38 PID 1036 wrote to memory of 1808 1036 BLUE.exe 38 PID 1036 wrote to memory of 1808 1036 BLUE.exe 38 PID 1036 wrote to memory of 2772 1036 BLUE.exe 39 PID 1036 wrote to memory of 2772 1036 BLUE.exe 39 PID 1036 wrote to memory of 2772 1036 BLUE.exe 39 PID 1036 wrote to memory of 2772 1036 BLUE.exe 39 PID 1036 wrote to memory of 2820 1036 BLUE.exe 40 PID 1036 wrote to memory of 2820 1036 BLUE.exe 40 PID 1036 wrote to memory of 2820 1036 BLUE.exe 40 PID 1036 wrote to memory of 2820 1036 BLUE.exe 40 PID 2376 wrote to memory of 2256 2376 4.exe 42 PID 2376 wrote to memory of 2256 2376 4.exe 42 PID 2376 wrote to memory of 2256 2376 4.exe 42 PID 2376 wrote to memory of 2256 2376 4.exe 42 PID 1036 wrote to memory of 2296 1036 BLUE.exe 44 PID 1036 wrote to memory of 2296 1036 BLUE.exe 44 PID 1036 wrote to memory of 2296 1036 BLUE.exe 44 PID 1036 wrote to memory of 2296 1036 BLUE.exe 44 PID 1036 wrote to memory of 2516 1036 BLUE.exe 45 PID 1036 wrote to memory of 2516 1036 BLUE.exe 45 PID 1036 wrote to memory of 2516 1036 BLUE.exe 45 PID 1036 wrote to memory of 2516 1036 BLUE.exe 45 PID 1036 wrote to memory of 2340 1036 BLUE.exe 46 PID 1036 wrote to memory of 2340 1036 BLUE.exe 46 PID 1036 wrote to memory of 2340 1036 BLUE.exe 46 PID 1036 wrote to memory of 2340 1036 BLUE.exe 46 PID 1036 wrote to memory of 2684 1036 BLUE.exe 48 PID 1036 wrote to memory of 2684 1036 BLUE.exe 48 PID 1036 wrote to memory of 2684 1036 BLUE.exe 48 PID 1036 wrote to memory of 2684 1036 BLUE.exe 48 PID 1036 wrote to memory of 2380 1036 BLUE.exe 50 PID 1036 wrote to memory of 2380 1036 BLUE.exe 50 PID 1036 wrote to memory of 2380 1036 BLUE.exe 50 PID 1036 wrote to memory of 2380 1036 BLUE.exe 50 PID 1036 wrote to memory of 2708 1036 BLUE.exe 51 PID 1036 wrote to memory of 2708 1036 BLUE.exe 51 PID 1036 wrote to memory of 2708 1036 BLUE.exe 51 PID 1036 wrote to memory of 2708 1036 BLUE.exe 51 -
System policy modification 1 TTPs 11 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" BLUE.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System BLUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" BLUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BLUE.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p3168920970217226645 Everything64.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ2.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe"3⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1036 -
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\DC.exeDC.exe /D5⤵
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe" -e watch -pid 1036 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2772
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\BLUE.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2820
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2296
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -H off4⤵
- Power Settings
PID:2516
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:2340
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:2684
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:2380
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:2708
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:1480
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:936
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:1516
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:1360
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:1904
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:1856
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:108
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:1280
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵
- Power Settings
PID:472
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵
- Power Settings
PID:1512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2664
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2956
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2284
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:2076
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:816
-
-
C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe"C:\Users\Admin\AppData\Local\{C7E769E6-46F6-1F55-9F80-C85F233BE281}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1820
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2256
-
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:1896
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2204
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:1944
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2148
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:620
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
2File Deletion
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
798B
MD5c7a8079febd7b8a6040d217d659a4b09
SHA1a602c223f63553795c24f8cc5d8722acc338a6a4
SHA256d7606476e2d903b662a9011fc7488466a6dac6433a04643f1e02a3827a25fea8
SHA5125b33ffb02ec2bb9e52ea4a1090a281e941b72b88138425007549149e220525fc75af9a57ee3d5e36e1af7a1d6c392f0869a98cb99c1fa45a1c7511ef0df4bb16
-
Filesize
174B
MD5a47416ca5a8f258d1f877e6a3ebcaa73
SHA171975bc6ce2c8fa23a12e54ac1fbb7e1f51fb311
SHA25665d3ebd86e4dc774cf73c093d11c857d62b204c705c0ce1fe504deb6183a5672
SHA51227eff3b6ff4f5de4eb0247287399a6bec7713c22e875695c785dedb09270c9ad7a9cc2f88bf6cacd3a78f98adc839771b24dfbd2983e8531d28c859a27b29c8c
-
Filesize
802KB
MD5ac34ba84a5054cd701efad5dd14645c9
SHA1dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
SHA256c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
SHA512df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
1.5MB
MD5fc8231d24af5721342e70a9c5bb770c4
SHA1a6fea2adbd6022e230755b259cbf3f09c942d01c
SHA25622cb66ff8946f7e353f1c23b2e17af95fc7a98f87a1ee941ec36b83b7880653e
SHA512d327552bab810596c9d54c1d0ac2e1bf446164fdff0f79cfdd48cfc455a9e86c88bc24aa2e43f890763332a3150bb939354e87d57ef81bd285159977e06ce3ef
-
Filesize
2.0MB
MD5b04b206674bab7a4229f34b6ac511903
SHA1064ab6347a40cba3bbe594f226baff3772212d61
SHA2562aafc4ee5edb0dd956cbdfbd9c11a23e2e61102986b6428e3e27eeb09e0fba74
SHA5123584df640cf090820fa818073b5299ad0d979eb87d920140697b550d29fa692cbc7d61742e61ce935347c5a3428db4f3ac8d4159c7053fafabf1051b5587420d
-
Filesize
2.1MB
MD57ca770cc5f649256a18623245348f39f
SHA181398374ba4751a61a0d9949cc1fe75f18960741
SHA25607631e96b95b1f01bdc591699ae6bc2e6787387cbe865bc11004bd34c0f9c3a4
SHA512bd70b65f1ef54f1eed3e48013c0332d82370caacd67304e20497c5c8f6d6fd5ef2d838ecc9c4e80dca4e4a107676942495cce4c2526281b32fcad2ee12b33cdc
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
Filesize
9.2MB
MD50efbf5145ba4686aac35cceaacbc94bf
SHA11a5b92a6c9bce5a2af1829526a9c3b69a93fdc9b
SHA256dc096dfce1cb6d2d320b7256c4d1846641f573c7c1639032f4f79e6c55405bee
SHA512ea3c1f5654d34f62e3beca98c1d1f176cb7afa99d130b342ebcaf4470df464d55b5558de506c89cd06e06ddc9d960e9838c90502138059229d2a08b7a29b2514
-
Filesize
20KB
MD5f2ad96ba0f6db08f8840c2e556d05bcc
SHA136a3157534860d7bdabe71294d54033affc228fa
SHA256e9eeb154859475da56edde0fbf8e0df5bec6e6b2ae10f5d426d621c06ea3ca33
SHA5125c956872935230c85a79ac55aeb20e34df7faafdb266ea189ed820a72f93841588ab8a7af794048d87c6d7eb122fdaa680f3151ecedeb139cd4b9c4a8b7cc327
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MOH6MI4AHJ47NQOR6IL9.temp
Filesize7KB
MD5413dd3fbcfc27f9983fd9b30360fab65
SHA1a30fb46653b7238e77862959389258ae62c4961a
SHA25666e3facf324fd9cfbf16bd1ee5404b4b09bb8e20ab4d800ca9582ced5872812d
SHA512abbdece83d0efd764d78a12da4dfe645bb43f8dca076eb4fd77be15327804516260c4733d95ad0b20f9ca8fa37eb5bf97b18482cb40911ab0456026d16614a8f
-
Filesize
233B
MD5cd4326a6fd01cd3ca77cfd8d0f53821b
SHA1a1030414d1f8e5d5a6e89d5a309921b8920856f9
SHA2561c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c
SHA51229ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67
-
Filesize
6KB
MD5680c145e4aa0ca70275756d6c93636ba
SHA1ab0c3a971de7029eb356add472b467bb76ba6c47
SHA256e7d9957d9c32738a5c2d7ca2346f74942feb509a7314960c02af1f47a343df0a
SHA512a5bcd273edd23d0677f14c7ec7c45ed19a103d1fc817f010bafd1487e920d2b0e8c6ca7d8dc8273303f304fc63e09b15edb909ab75d22732ac541b24fa0d4afd
-
Filesize
32B
MD57556b827fec4e78503af35eb10d26998
SHA1fd5fe00ccfb62c30a94114b4db7e40777192b719
SHA256ec487d5aafcb9f0cf75c5fc2440e308f9b6ae385f10cfc072e52c2e7f7f9314c
SHA512fdf3ded23bfb5f87bc0fdb2c8d5dc14118144fae59b24b03443d156ace9520abebffd0827cc7d2040edecd1f83812fcd8aa6cdaf2d0ae8f47c093e455beec14b
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62