Overview
overview
10Static
static
50442cfabb3...ab.exe
windows7-x64
8c0cf40b883...3a.exe
windows7-x64
8cry1.exe
windows7-x64
8cry2.exe
windows7-x64
8cry3.exe
windows7-x64
10cry4.exe
windows7-x64
10cry5.exe
windows7-x64
8cry6.exe
windows7-x64
10e49778d20a...73.exe
windows7-x64
8inquiry.scr
windows7-x64
9Накла...15.scr
windows7-x64
3ПРЕТЕ...Я.scr
windows7-x64
5Счет �...08.scr
windows7-x64
3карто...я.scr
windows7-x64
5Analysis
-
max time kernel
361s -
max time network
362s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-11-2024 11:10
Behavioral task
behavioral1
Sample
0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral2
Sample
c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral3
Sample
cry1.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral4
Sample
cry2.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral5
Sample
cry3.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral6
Sample
cry4.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral7
Sample
cry5.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral8
Sample
cry6.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral9
Sample
e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral10
Sample
inquiry.scr
Resource
win7-20241010-en
windows7-x64
17 signatures
600 seconds
Behavioral task
behavioral11
Sample
Накладная для 1736 от 26.08.2015.scr
Resource
win7-20241010-en
windows7-x64
1 signatures
600 seconds
Behavioral task
behavioral12
Sample
ПРЕТЕНЗИЯ.scr
Resource
win7-20240903-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral13
Sample
Счет на оплату от 26-08.scr
Resource
win7-20240708-en
windows7-x64
1 signatures
600 seconds
General
-
Target
cry5.exe
-
Size
329KB
-
MD5
adb5c262ca4f95fee36ae4b9b5d41d45
-
SHA1
cdbe420609fec04ddf3d74297fc2320b6a8a898e
-
SHA256
e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573
-
SHA512
dad3541217a7f1fde669441a3f987794ee58ae44e7899d7ed5ebdf59e8174e2924441ea8474701908071df74479a4f928b673c2d9086c67078a2a861b61ba754
-
SSDEEP
6144:TRzMgpY8bXFHW1FbwwEHidUoagoW2C9cuqBGI4Zq6mYN8+N6MSiF0Q5XNN:pDRbXFHW1+K2UWBGIymYG+zn
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt cry5.exe -
Deletes itself 1 IoCs
pid Process 1948 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\cry5.exe" cry5.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseE\license.rtf cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpah470t.xml cry5.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasicE\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_providers.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_type_operators.help.txt cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpf2100t.xml cry5.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremium\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\UltimateN\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Comment_Based_Help.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_locations.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\Microsoft.PowerShell.ConsoleHost.dll-Help.xml cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpk5300t.xml cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_arrays.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\eval\EnterpriseN\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions_advanced_methods.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Ref.help.txt cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO0410T.XML cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa430t.xml cry5.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\Starter\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\Ultimate\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_debuggers.help.txt cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\hpmcpbp6.xml cry5.exe File opened for modification C:\Windows\SysWOW64\lcphrase.tbl cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_wildcards.help.txt cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpl7600t.xml cry5.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\Starter\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Enterprise\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_profiles.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_troubleshooting.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\Microsoft.PowerShell.Commands.Management.dll-Help.xml cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Assignment_Operators.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Line_Editing.help.txt cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO6300T.XML cry5.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\Enterprise\license.rtf cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc8100t.xml cry5.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\EnterpriseE\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Return.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_WS-Management_Cmdlets.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasic\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomePremiumN\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\StarterE\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_pipelines.help.txt cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj4660t.xml cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa620t.xml cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced_methods.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\HomeBasicE\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\it-IT\lpeula.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremium\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_History.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Windows_PowerShell_ISE.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Windows_PowerShell_ISE.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Enterprise\license.rtf cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc350u.xml cry5.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\UltimateE\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\icsxml\cmnicfg.xml cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_trap.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_jobs.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\Microsoft.PowerShell.ConsoleHost.dll-Help.xml cry5.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasicN\license.rtf cry5.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\StarterE\license.rtf cry5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpl7300t.xml cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_providers.help.txt cry5.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_parameters.help.txt cry5.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\desk.bmp" cry5.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml cry5.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml cry5.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml cry5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\gadget.xml cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg cry5.exe File opened for modification C:\Program Files\ConfirmGroup.odp cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml cry5.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt cry5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\gadget.xml cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml cry5.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml cry5.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt cry5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\gadget.xml cry5.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml cry5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml cry5.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml cry5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml cry5.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml cry5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\gadget.xml cry5.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt cry5.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml cry5.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml cry5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg cry5.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml cry5.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml cry5.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt cry5.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt cry5.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml cry5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml cry5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml cry5.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1032\eula.rtf cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_debuggers.help.txt cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_jobs.help.txt cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\Microsoft.PowerShell.Commands.Management.dll-Help.xml cry5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_9a7206c9fd273385\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-n..diagnostics-package_31bf3856ad364e35_6.1.7601.17514_none_1bde017f5d8d7006\NetworkDiagnostics_4_NetworkAdapter.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\GlobalInstallOrder.xml cry5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_es-es_02b53e1d98470ee8\erofflps.txt cry5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_565b1bc9c3075dac\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_it-it_1e4d6c8ff7baeac6\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..putername.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5f7fc29722da787f\OOBE_HELP_Change_Computer_Name.rtf cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_en-us_d5fe5d00fb97ccd1\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_4f8483af7079fc18\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\Microsoft.PowerShell.Commands.Management.dll-Help.xml cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Continue.help.txt cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_WS-Management_Cmdlets.help.txt cry5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_20ddd8fbf0c66814\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_afb6b99ecfc04975\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c99bfc6ddd1bf1d2\gadget.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f86c44a49a61f132\gadget.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_6a8fc4b7a7c6fdc9\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_es-es_85e40f599e065800\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Session_Configurations.help.txt cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\oskpred.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_prnhp005.inf_31bf3856ad364e35_6.1.7600.16385_none_30e9a6119eda44e5\Amd64\hpd2600t.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dot3svc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_91dde3f80ea85a5a\Rules.System.NetDiagFramework.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a9893e83c110fe46\gadget.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_11b07c1bb446e787\Rules.System.Configuration.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..svc-extra.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_71715b0ed4b9200e\Report.System.Wireless.xml cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_functions_cmdletbindingattribute.help.txt cry5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_2d5fd4d75f62fb5e\lpeula.rtf cry5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_f72e2c32f7e542ef\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_it-it_0d913a91dca5379a\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_Windows_PowerShell_2.0.help.txt cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-r..bilityanalysisrules_31bf3856ad364e35_6.1.7601.17514_none_85194071b6440c78\RacRules.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\base_kor.xml cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_jobs.help.txt cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Windows_PowerShell_ISE.help.txt cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_operators.help.txt cry5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_7fb35d7f8269823b\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..eady_eula.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_38563db42d064525\playready_eula.txt cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-epgtos.resources_31bf3856ad364e35_6.1.7600.16385_en-us_29b70e81faa66c43\epgtos.txt cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\Microsoft.PowerShell.Security.dll-Help.xml cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_try_catch_finally.help.txt cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_de-de_424b857064f5bf26\about_BITS_Cmdlets.help.txt cry5.exe File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Wireless.xml cry5.exe File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Diagnostics.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_prnhp003.inf_31bf3856ad364e35_6.1.7600.16385_none_2fd781a76c9dcc13\Amd64\hpb8300t.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_prnhp005.inf_31bf3856ad364e35_6.1.7600.16385_none_30e9a6119eda44e5\Amd64\hpc309at.xml cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_remote_output.help.txt cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_trap.help.txt cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_remote.help.txt cry5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7601.17514_es-es_a122fae633f5ab58\license.rtf cry5.exe File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Summary.xml cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_pssessions.help.txt cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img14.jpg cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_properties.help.txt cry5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_eee4e052cd1adbab\license.rtf cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Language_Keywords.help.txt cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_escape_characters.help.txt cry5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_Break.help.txt cry5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\2052\LocalizedData.xml cry5.exe File opened for modification C:\Windows\Panther\diagerr.xml cry5.exe File opened for modification C:\Windows\PLA\Rules\Rules.System.NetTrace.xml cry5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cry5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop cry5.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ cry5.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\TileWallpaper = "0" cry5.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 276 cry5.exe 276 cry5.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 276 wrote to memory of 1948 276 cry5.exe 33 PID 276 wrote to memory of 1948 276 cry5.exe 33 PID 276 wrote to memory of 1948 276 cry5.exe 33 PID 276 wrote to memory of 1948 276 cry5.exe 33 PID 1948 wrote to memory of 2252 1948 cmd.exe 35 PID 1948 wrote to memory of 2252 1948 cmd.exe 35 PID 1948 wrote to memory of 2252 1948 cmd.exe 35 PID 1948 wrote to memory of 2252 1948 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\cry5.exe"C:\Users\Admin\AppData\Local\Temp\cry5.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\SQNLI.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
- System Location Discovery: System Language Discovery
PID:2252
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189B
MD5b708814ebbda5252a78fc5c81e3c3a2c
SHA1e84a1cfdd22b4133343619e2f1f90fe7cb6f692f
SHA2567c6335dc825aac3889dd521c6e54f8f2eeb3d60ca9251f0885fa64e8983efa31
SHA512ff2c28552a1ac7a70689e5eecb977b9c5766853fe03ca755913c54d90b42648b93965cea42593f5c1a734a7ef6f01729898b0d869d29f8513bf0f382a3cf6793