Overview
overview
10Static
static
50442cfabb3...ab.exe
windows7-x64
8c0cf40b883...3a.exe
windows7-x64
8cry1.exe
windows7-x64
8cry2.exe
windows7-x64
8cry3.exe
windows7-x64
10cry4.exe
windows7-x64
10cry5.exe
windows7-x64
8cry6.exe
windows7-x64
10e49778d20a...73.exe
windows7-x64
8inquiry.scr
windows7-x64
9Накла...15.scr
windows7-x64
3ПРЕТЕ...Я.scr
windows7-x64
5Счет �...08.scr
windows7-x64
3карто...я.scr
windows7-x64
5Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-11-2024 11:10
Behavioral task
behavioral1
Sample
0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral2
Sample
c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral3
Sample
cry1.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral4
Sample
cry2.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral5
Sample
cry3.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral6
Sample
cry4.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral7
Sample
cry5.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral8
Sample
cry6.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral9
Sample
e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral10
Sample
inquiry.scr
Resource
win7-20241010-en
windows7-x64
17 signatures
600 seconds
Behavioral task
behavioral11
Sample
Накладная для 1736 от 26.08.2015.scr
Resource
win7-20241010-en
windows7-x64
1 signatures
600 seconds
Behavioral task
behavioral12
Sample
ПРЕТЕНЗИЯ.scr
Resource
win7-20240903-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral13
Sample
Счет на оплату от 26-08.scr
Resource
win7-20240708-en
windows7-x64
1 signatures
600 seconds
General
-
Target
cry2.exe
-
Size
370KB
-
MD5
a890e2f924dea3cb3e46a95431ffae39
-
SHA1
35719ee58a5771156bc956bcf1b5c54ac3391593
-
SHA256
c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a
-
SHA512
664fb8075712912be30185d17d912dae148e778627e852affe1b1080bb9c8d5917e7b3c1d194e62ac6919c16235754f776523ba7ce95af38be86b61cc3e3d162
-
SSDEEP
6144:KRzMgpY8bXFHW1FbwwEHidUoagoW2C9cuqBGI4Zq6mYN8+G5l9PAzJdVeO2Ui:sDRbXFHW1+K2UWBGIymYG+i9A+ONi
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt cry2.exe -
Deletes itself 1 IoCs
pid Process 568 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\cry2.exe" cry2.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\Microsoft.Wsman.Management.dll-Help.xml cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPF4BK3L.XML cry2.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\StarterN\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\data\HardwareVendors.xml cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Redirection.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\Ultimate\license.rtf cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW1RC3L.XML cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\System.Management.Automation.dll-Help.xml cry2.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseN\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremium\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomeBasicN\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_debuggers.help.txt cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smf6x4u.xml cry2.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\UltimateE\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\Microsoft.PowerShell.Security.dll-Help.xml cry2.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremium\license.rtf cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd2360t.xml cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj4660t.xml cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc610u.xml cry2.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\UltimateN\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Break.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_locations.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced_parameters.help.txt cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBJ3310.TBL cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\Amd64\CNBJ3340.TBL cry2.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomeBasic\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_scripts.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_pssessions.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Windows_PowerShell_ISE.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_command_precedence.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\es-ES\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll-Help.xml cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\Microsoft.PowerShell.Commands.Utility.dll-Help.xml cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj3600t.xml cry2.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasicE\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Enterprise\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_logical_operators.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasicN\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\icsxml\cmnicfg.xml cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Line_Editing.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_jobs.help.txt cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO5H83L.XML cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa320t.xml cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_advanced_parameters.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_profiles.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_FAQ.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomePremiumE\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\Starter\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\Recovery\ReAgent.xml cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Language_Keywords.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WCN\es-ES\Add_a_device_or_computer_to_a_network_usb.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\Starter\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\Ultimate\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseE\license.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\RacRules.xml cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_do.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Language_Keywords.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WCN\de-DE\Add_a_device_or_computer_to_a_network_usb.rtf cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Automatic_Variables.help.txt cry2.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Assignment_Operators.help.txt cry2.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpk5300t.xml cry2.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\UltimateE\license.rtf cry2.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\desk.bmp" cry2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml cry2.exe File opened for modification C:\Program Files\ResetPing.csv cry2.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml cry2.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt cry2.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt cry2.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml cry2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml cry2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml cry2.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml cry2.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml cry2.exe File created C:\Program Files (x86)\LYYPWDJWKA.XLG cry2.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml cry2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml cry2.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg cry2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml cry2.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg cry2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\gadget.xml cry2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml cry2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\gadget.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml cry2.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg cry2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\gadget.xml cry2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\gadget.xml cry2.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt cry2.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml cry2.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt cry2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml cry2.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt cry2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml cry2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml cry2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml cry2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml cry2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml cry2.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml cry2.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml cry2.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt cry2.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..eady_eula.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_38563db42d064525\playready_eula.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_48d81d1152734c62\license.rtf cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_it-it_16b2136334d4d376\license.rtf cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_11b07c1bb446e787\Rules.System.Configuration.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\default.help.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_type_operators.help.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_History.help.txt cry2.exe File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Wireless.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_de-de_37f6db1e3094fd2b\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ipsdan.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..indetails.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5a6758686ecd5550\OOBE_HELP_Opt_in_Details.rtf cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_a462b98a69d9fae6\license.rtf cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_it-it_b12748a9bd27a24a\license.rtf cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote_jobs.help.txt cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_jobs.help.txt cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_script_blocks.help.txt cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Variables.help.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dot3svc_31bf3856ad364e35_6.1.7601.17514_none_c99214378a23d63b\Rules.System.NetDiagFramework.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_script_blocks.help.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Reserved_Words.help.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..ar-wizard.resources_31bf3856ad364e35_6.1.7600.16385_es-es_3fc6a921cb2e7ab2\Add_a_device_or_computer_to_a_network_usb.rtf cry2.exe File opened for modification C:\Windows\winsxs\amd64_prnhp005.inf_31bf3856ad364e35_6.1.7600.16385_none_30e9a6119eda44e5\Amd64\hp6000at.xml cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_Line_Editing.help.txt cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Throw.help.txt cry2.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b7c696a7f6d113c3\license.rtf cry2.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\NetFx40_IIS_schema_update.xml cry2.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_it-it_40de2380e46761c3\license.rtf cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dot3svc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_05906ea4445b6301\Report.System.Wired.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dot3svc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_91dde3f80ea85a5a\Report.System.NetDiagFramework.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_es-es_85e40f599e065800\license.rtf cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\DMR_120.jpg cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_types.ps1xml.help.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_remote_requirements.help.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sonic-symphonyntsc_31bf3856ad364e35_6.1.7600.16385_none_d75d6085d60aa50d\Symphony.psd cry2.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_remote_output.help.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9e5b45457e71d50c\Report.System.Diagnostics.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Signing.help.txt cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Comment_Based_Help.help.txt cry2.exe File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Common.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-editions-client_31bf3856ad364e35_6.1.7600.16385_none_bc037fbe81d7b074\HomePremiumEdition.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1a7b58bf239bbd92\license.rtf cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Windows_PowerShell_2.0.help.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_methods.help.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Pretty_Peacock.jpg cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\ko-kr.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..svc-extra.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_fdbed0629f061767\Report.System.Wireless.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ebb345e71aa87bfe\erofflps.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_de-de_90c392ae5a3a7d2d\gadget.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..ctivation.resources_31bf3856ad364e35_6.1.7600.16385_de-de_af2e6e6bf7599701\HELP_What_is_Activation.rtf cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_08a7cc7c72229ede\license.rtf cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Core_Commands.help.txt cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Language_Keywords.help.txt cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_modules.help.txt cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_parameters.help.txt cry2.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1053\eula.rtf cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_remote.help.txt cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_remote_output.help.txt cry2.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\Microsoft.Wsman.Management.dll-Help.xml cry2.exe File opened for modification C:\Windows\winsxs\amd64_wiaca00i.inf_31bf3856ad364e35_6.1.7600.16385_none_9dff40bd2f903760\CNC1730D.TBL cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_remote_requirements.help.txt cry2.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_remote_troubleshooting.help.txt cry2.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1eef89e6f9091c8b\license.rtf cry2.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7601.17514_en-us_f7ef33e70a2e2b7e\license.rtf cry2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cry2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop cry2.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\ cry2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\TileWallpaper = "0" cry2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2736 cry2.exe 2736 cry2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2736 wrote to memory of 568 2736 cry2.exe 33 PID 2736 wrote to memory of 568 2736 cry2.exe 33 PID 2736 wrote to memory of 568 2736 cry2.exe 33 PID 2736 wrote to memory of 568 2736 cry2.exe 33 PID 568 wrote to memory of 2616 568 cmd.exe 35 PID 568 wrote to memory of 2616 568 cmd.exe 35 PID 568 wrote to memory of 2616 568 cmd.exe 35 PID 568 wrote to memory of 2616 568 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\cry2.exe"C:\Users\Admin\AppData\Local\Temp\cry2.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\UUKAX.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
- System Location Discovery: System Language Discovery
PID:2616
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189B
MD5d26ca83ebbdf25ca3687a88b327db23e
SHA195ba3c3293751c937d8e1fdc12bcb6091620281c
SHA256bfc2cc5f86714dbc55910d3a5a99c7ddc9d1c48b8027d33d9cffac959f209e6a
SHA5120a55144333234dfc16c66e65be60ecc999019b143ccddc7824e87b07a74bf05790bcf4a8e32149900b91d422e423575a482fcf16071469adcef5032417a1e802