Analysis
-
max time kernel
39s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 11:40
Static task
static1
Behavioral task
behavioral1
Sample
d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe
Resource
win10v2004-20241007-en
General
-
Target
d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe
-
Size
6.5MB
-
MD5
151ae5f5eb71b7ab25a9c13803a86eaa
-
SHA1
ebb0d17e6ef2186e300a4fc19b473f8a7e34cd80
-
SHA256
d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f
-
SHA512
ce73cc13059491f720535f9f65f476e0b1a9e9f67cb8666ba98f72eaea656fa52c25fa44e2c4f70aa495ad9de7650c3d40fa1f3c50ae842427f98f5c1f2298ff
-
SSDEEP
49152:fgUTQPyrmS1unws84+MguWuMa7lPlKkqfukf5dOFvmGWbqmLA8vz3OrzoqvMy4iC:5vJaBq35dUWFL33OrzoqvM
Malware Config
Extracted
C:\Users\Admin\Contacts\HOW TO BACK FILES.txt
targetcompany
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Targetcompany family
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2320 bcdedit.exe 2764 bcdedit.exe -
Renames multiple (892) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\S: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\J: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\P: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\T: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\V: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\D: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\A: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\H: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\I: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\Y: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\M: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\N: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\Q: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\W: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\B: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\G: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\K: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\L: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\X: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\O: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\R: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\U: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened (read-only) \??\Z: d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nb-no\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sv-se\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Uninstall Information\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ha-Latn-NG\View3d\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\HOW TO BACK FILES.txt d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeDebugPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe Token: SeTakeOwnershipPrivilege 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3608 wrote to memory of 4472 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe 84 PID 3608 wrote to memory of 4472 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe 84 PID 3608 wrote to memory of 4528 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe 86 PID 3608 wrote to memory of 4528 3608 d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe 86 PID 4528 wrote to memory of 2320 4528 cmd.exe 88 PID 4528 wrote to memory of 2320 4528 cmd.exe 88 PID 4472 wrote to memory of 2764 4472 cmd.exe 89 PID 4472 wrote to memory of 2764 4472 cmd.exe 89 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe"C:\Users\Admin\AppData\Local\Temp\d7fa39f2cccc49479ac18fb0d014be8e98c7b732572d3a1126ce234364fc7c9f.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3608 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2764
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2320
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50d355bdc3c68a43df7edc5fcf1ba3b0e
SHA1a6317a639e06e0dbd9ddc72fc5a90d9fcd90d6c9
SHA2566caa7fff19aa8865efe466bb70e8681c5b0145157eb0dda25e80fdb31d537baa
SHA5120f7b2796d6e65d997af4856fc54a562a7483c52f92dbbff6561d1e8be11c65067a928daaea6547b041c5af522246fbcda0ebff980476757e87fee60d20e0aa21