Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/11/2024, 15:57
Static task
static1
Behavioral task
behavioral1
Sample
03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe
Resource
win10v2004-20241007-en
General
-
Target
03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe
-
Size
2.2MB
-
MD5
12f17105c90b282cdae943ddef88f631
-
SHA1
446536c70f55d1e9f15b7e2d8809e9074fed0391
-
SHA256
03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187
-
SHA512
009f3e8b66b9629e5f5466440d8c669ff28e9f1a2a7eb38ed26a2bbf6e4471073c94deb605172d6182ebd64aafbd768d7e6377f0eb1f69f54ad671ddcaf528f6
-
SSDEEP
49152:wgwRwifu1DBgutBPNcpwcjVpNMkCZZpsYpmwZ3hQ8cTEo8:wgwRwvguPP4wc3NMkCGGmugTEt
Malware Config
Extracted
C:\Users\Admin\AppData\Local\README.txt
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral1/files/0x0008000000016d3f-27.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Mimic family
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1656 bcdedit.exe 1928 bcdedit.exe -
Renames multiple (9292) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2120 wbadmin.exe -
pid Process 764 wbadmin.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe -
Executes dropped EXE 11 IoCs
pid Process 2380 7za.exe 2668 7za.exe 2840 [email protected] 2580 PIDAR.exe 2980 Everything.exe 1020 PIDAR.exe 848 PIDAR.exe 1948 PIDAR.exe 1280 Everything.exe 3024 xdel.exe 3008 xdel.exe -
Loads dropped DLL 17 IoCs
pid Process 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 2840 [email protected] 2840 [email protected] 2580 PIDAR.exe 2580 PIDAR.exe 1020 PIDAR.exe 848 PIDAR.exe 1948 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell\open\command [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" [email protected] Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell [email protected] Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell\open [email protected] Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell\open\command PIDAR.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PIDAR = "\"C:\\Users\\Admin\\AppData\\Local\\3F4FFA8F-24F8-6F78-A0DA-370314484853\\PIDAR.exe\" " [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PIDAR.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\README.txt\"" PIDAR.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\G: Everything.exe -
Power Settings 1 TTPs 15 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2120 powercfg.exe 1952 powercfg.exe 1560 powercfg.exe 1040 powercfg.exe 1352 powercfg.exe 1428 powercfg.exe 1928 powercfg.exe 840 powercfg.exe 2224 powercfg.exe 2876 powercfg.exe 856 powercfg.exe 1648 powercfg.exe 1728 powercfg.exe 1216 powercfg.exe 1176 powercfg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\[email protected] PIDAR.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\[email protected] PIDAR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.Demetro9990@cock.li PIDAR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\[email protected] PIDAR.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.Demetro9990@cock.li PIDAR.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\[email protected] PIDAR.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\[email protected] PIDAR.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jre7\lib\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\[email protected] PIDAR.exe -
pid Process 2152 powershell.exe 2172 powershell.exe 2952 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe -
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\README.txt\"" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" [email protected] Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell\open\command PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell PIDAR.exe Key created \REGISTRY\MACHINE\Software\Classes\.li PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.li\ = "mimicfile" PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell\open\command [email protected] Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile [email protected] Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\exefile\shell\open [email protected] Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command PIDAR.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1412 notepad.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2580 PIDAR.exe 2172 powershell.exe 2152 powershell.exe 848 PIDAR.exe 1948 PIDAR.exe 2952 powershell.exe 2580 PIDAR.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2380 7za.exe Token: 35 2380 7za.exe Token: SeRestorePrivilege 2668 7za.exe Token: 35 2668 7za.exe Token: SeSecurityPrivilege 2668 7za.exe Token: SeSecurityPrivilege 2668 7za.exe Token: SeIncreaseQuotaPrivilege 2840 [email protected] Token: SeSecurityPrivilege 2840 [email protected] Token: SeTakeOwnershipPrivilege 2840 [email protected] Token: SeLoadDriverPrivilege 2840 [email protected] Token: SeSystemProfilePrivilege 2840 [email protected] Token: SeSystemtimePrivilege 2840 [email protected] Token: SeProfSingleProcessPrivilege 2840 [email protected] Token: SeIncBasePriorityPrivilege 2840 [email protected] Token: SeCreatePagefilePrivilege 2840 [email protected] Token: SeBackupPrivilege 2840 [email protected] Token: SeRestorePrivilege 2840 [email protected] Token: SeShutdownPrivilege 2840 [email protected] Token: SeDebugPrivilege 2840 [email protected] Token: SeSystemEnvironmentPrivilege 2840 [email protected] Token: SeChangeNotifyPrivilege 2840 [email protected] Token: SeRemoteShutdownPrivilege 2840 [email protected] Token: SeUndockPrivilege 2840 [email protected] Token: SeManageVolumePrivilege 2840 [email protected] Token: SeImpersonatePrivilege 2840 [email protected] Token: SeCreateGlobalPrivilege 2840 [email protected] Token: 33 2840 [email protected] Token: 34 2840 [email protected] Token: 35 2840 [email protected] Token: SeIncreaseQuotaPrivilege 2580 PIDAR.exe Token: SeSecurityPrivilege 2580 PIDAR.exe Token: SeTakeOwnershipPrivilege 2580 PIDAR.exe Token: SeLoadDriverPrivilege 2580 PIDAR.exe Token: SeSystemProfilePrivilege 2580 PIDAR.exe Token: SeSystemtimePrivilege 2580 PIDAR.exe Token: SeProfSingleProcessPrivilege 2580 PIDAR.exe Token: SeIncBasePriorityPrivilege 2580 PIDAR.exe Token: SeCreatePagefilePrivilege 2580 PIDAR.exe Token: SeBackupPrivilege 2580 PIDAR.exe Token: SeRestorePrivilege 2580 PIDAR.exe Token: SeShutdownPrivilege 2580 PIDAR.exe Token: SeDebugPrivilege 2580 PIDAR.exe Token: SeSystemEnvironmentPrivilege 2580 PIDAR.exe Token: SeChangeNotifyPrivilege 2580 PIDAR.exe Token: SeRemoteShutdownPrivilege 2580 PIDAR.exe Token: SeUndockPrivilege 2580 PIDAR.exe Token: SeManageVolumePrivilege 2580 PIDAR.exe Token: SeImpersonatePrivilege 2580 PIDAR.exe Token: SeCreateGlobalPrivilege 2580 PIDAR.exe Token: 33 2580 PIDAR.exe Token: 34 2580 PIDAR.exe Token: 35 2580 PIDAR.exe Token: SeIncreaseQuotaPrivilege 1948 PIDAR.exe Token: SeSecurityPrivilege 1948 PIDAR.exe Token: SeTakeOwnershipPrivilege 1948 PIDAR.exe Token: SeLoadDriverPrivilege 1948 PIDAR.exe Token: SeSystemProfilePrivilege 1948 PIDAR.exe Token: SeSystemtimePrivilege 1948 PIDAR.exe Token: SeProfSingleProcessPrivilege 1948 PIDAR.exe Token: SeIncBasePriorityPrivilege 1948 PIDAR.exe Token: SeCreatePagefilePrivilege 1948 PIDAR.exe Token: SeBackupPrivilege 1948 PIDAR.exe Token: SeRestorePrivilege 1948 PIDAR.exe Token: SeShutdownPrivilege 1948 PIDAR.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2980 Everything.exe 1280 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2380 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 30 PID 2496 wrote to memory of 2380 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 30 PID 2496 wrote to memory of 2380 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 30 PID 2496 wrote to memory of 2380 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 30 PID 2496 wrote to memory of 2668 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 32 PID 2496 wrote to memory of 2668 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 32 PID 2496 wrote to memory of 2668 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 32 PID 2496 wrote to memory of 2668 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 32 PID 2496 wrote to memory of 2840 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 34 PID 2496 wrote to memory of 2840 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 34 PID 2496 wrote to memory of 2840 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 34 PID 2496 wrote to memory of 2840 2496 03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe 34 PID 2840 wrote to memory of 2580 2840 [email protected] 35 PID 2840 wrote to memory of 2580 2840 [email protected] 35 PID 2840 wrote to memory of 2580 2840 [email protected] 35 PID 2840 wrote to memory of 2580 2840 [email protected] 35 PID 2580 wrote to memory of 1020 2580 PIDAR.exe 36 PID 2580 wrote to memory of 1020 2580 PIDAR.exe 36 PID 2580 wrote to memory of 1020 2580 PIDAR.exe 36 PID 2580 wrote to memory of 1020 2580 PIDAR.exe 36 PID 2580 wrote to memory of 2980 2580 PIDAR.exe 37 PID 2580 wrote to memory of 2980 2580 PIDAR.exe 37 PID 2580 wrote to memory of 2980 2580 PIDAR.exe 37 PID 2580 wrote to memory of 2980 2580 PIDAR.exe 37 PID 2580 wrote to memory of 848 2580 PIDAR.exe 38 PID 2580 wrote to memory of 848 2580 PIDAR.exe 38 PID 2580 wrote to memory of 848 2580 PIDAR.exe 38 PID 2580 wrote to memory of 848 2580 PIDAR.exe 38 PID 2580 wrote to memory of 1948 2580 PIDAR.exe 39 PID 2580 wrote to memory of 1948 2580 PIDAR.exe 39 PID 2580 wrote to memory of 1948 2580 PIDAR.exe 39 PID 2580 wrote to memory of 1948 2580 PIDAR.exe 39 PID 2580 wrote to memory of 1648 2580 PIDAR.exe 40 PID 2580 wrote to memory of 1648 2580 PIDAR.exe 40 PID 2580 wrote to memory of 1648 2580 PIDAR.exe 40 PID 2580 wrote to memory of 1648 2580 PIDAR.exe 40 PID 2580 wrote to memory of 1928 2580 PIDAR.exe 41 PID 2580 wrote to memory of 1928 2580 PIDAR.exe 41 PID 2580 wrote to memory of 1928 2580 PIDAR.exe 41 PID 2580 wrote to memory of 1928 2580 PIDAR.exe 41 PID 2580 wrote to memory of 1216 2580 PIDAR.exe 42 PID 2580 wrote to memory of 1216 2580 PIDAR.exe 42 PID 2580 wrote to memory of 1216 2580 PIDAR.exe 42 PID 2580 wrote to memory of 1216 2580 PIDAR.exe 42 PID 2580 wrote to memory of 1560 2580 PIDAR.exe 44 PID 2580 wrote to memory of 1560 2580 PIDAR.exe 44 PID 2580 wrote to memory of 1560 2580 PIDAR.exe 44 PID 2580 wrote to memory of 1560 2580 PIDAR.exe 44 PID 2580 wrote to memory of 1428 2580 PIDAR.exe 45 PID 2580 wrote to memory of 1428 2580 PIDAR.exe 45 PID 2580 wrote to memory of 1428 2580 PIDAR.exe 45 PID 2580 wrote to memory of 1428 2580 PIDAR.exe 45 PID 2580 wrote to memory of 1728 2580 PIDAR.exe 46 PID 2580 wrote to memory of 1728 2580 PIDAR.exe 46 PID 2580 wrote to memory of 1728 2580 PIDAR.exe 46 PID 2580 wrote to memory of 1728 2580 PIDAR.exe 46 PID 2580 wrote to memory of 2120 2580 PIDAR.exe 48 PID 2580 wrote to memory of 2120 2580 PIDAR.exe 48 PID 2580 wrote to memory of 2120 2580 PIDAR.exe 48 PID 2580 wrote to memory of 2120 2580 PIDAR.exe 48 PID 2580 wrote to memory of 1952 2580 PIDAR.exe 50 PID 2580 wrote to memory of 1952 2580 PIDAR.exe 50 PID 2580 wrote to memory of 1952 2580 PIDAR.exe 50 PID 2580 wrote to memory of 1952 2580 PIDAR.exe 50 -
System policy modification 1 TTPs 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer PIDAR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System PIDAR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Hello my dear friend (Do not scan the files with antivirus in any case. In case of data loss, the consequences are yours)\nYour data is encrypted\nYour personal ID: o0mhxWvRLOq60cIyOI-lBGRmqd6CMR6059RVv1Be2zE*[email protected] \nUnfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\nWrite to our mail - [email protected]\nIn case of no answer in 24 hours write us to this backup e-mail: [email protected]\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\nContact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly.\n\nAttention!\n\nDo not rename encrypted files. \nDo not try to decrypt your data using third party software - it may cause permanent data loss. \nWe are always ready to cooperate and find the best way to solve your problem. \nThe faster you write - the more favorable conditions will be for you. \nOur company values its reputation. We give all guarantees of your files decryption.\n\nWhat are your recommendations?\n- Never change the name of the files, if you want to manipulate the files, be sure to back them up. If there are any problems with the files, we are not responsible for them.\n- Never work with intermediary companies because they charge you more money.Don't be afraid of us, just email us. \n\n\nSensitive data on your system was DOWNLOADED.\nIf you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly.\n\nData includes:\n- Employees personal data, CVs, DL, SSN.\n- Complete network map including credentials for local and remote services.\n- Private financial information including: clients data, bills, budgets, annual reports, bank statements.\n- Manufacturing documents including: datagrams, schemas, drawings in solidworks format\n- And more...\n\nWhat are the dangers of leaking your company's data.\nFirst of all, you will receive fines from the government such as the GDRP and many others, you can be sued by customers of your firm for leaking information that was confidential. Your leaked data will be used by all the hackers on the planet for various unpleasant things. For example, social engineering, your employees' personal data can be used to re-infiltrate your company. Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered. On another vacation trip, you will have to explain to the FBI where you got millions of dollars worth of stolen cryptocurrency transferred through your accounts on cryptocurrency exchanges. Your personal information could be used to make loans or buy appliances. You would later have to prove in court that it wasn't you who took out the loan and pay off someone else's loan. Your competitors may use the stolen information to steal technology or to improve their processes, your working methods, suppliers, investors, sponsors, employees, it will all be in the public domain. You won't be happy if your competitors lure your employees to other firms offering better wages, will you? Your competitors will use your information against you. For example, look for tax violations in the financial documents or any other violations, so you have to close your firm. According to statistics, two thirds of small and medium-sized companies close within half a year after a data breach. You will have to find and fix the vulnerabilities in your network, work with the customers affected by data leaks. All of these are very costly procedures that can exceed the cost of a ransomware buyout by a factor of hundreds. It's much easier, cheaper and faster to pay us the ransom. Well and most importantly, you will suffer a reputational loss, you have been building your company for many years, and now your reputation will be destroyed.\n\nDo not go to the police or FBI for help and do not tell anyone that we attacked you. \nThey won't help and will only make your situation worse. In 7 years not a single member of our group has been caught by the police, we are top-notch hackers and never leave a trace of crime. The police will try to stop you from paying the ransom in any way they can. The first thing they will tell you is that there is no guarantee to decrypt your files and delete the stolen files, this is not true, we can do a test decryption before payment and your data will be guaranteed to be deleted because it is a matter of our reputation, we make hundreds of millions of dollars and we are not going to lose income because of your files. It is very beneficial for the police and the FBI to let everyone on the planet know about the leak of your data, because then your state will receive fines under GDPR and other similar laws. The fines will go to fund the police and FBI. The police and FBI will not be able to stop lawsuits from your customers for leaking personal and private information. The police and FBI will not protect you from repeat attacks. Paying us a ransom is much cheaper and more profitable than paying fines and legal fees.\n\nIf you do not pay the ransom, we will attack your company again in the future.\n\n " PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection PIDAR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " " PIDAR.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe"C:\Users\Admin\AppData\Local\Temp\03bf06b5e880b07c757f2c31ee884f9e87f77997c75bcc5ba5b31dc7bf662187.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p89905472210203597 Everything64.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\[email protected]"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\[email protected]"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2580 -
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe" -e watch -pid 2580 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1020
-
-
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\Everything.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2980
-
-
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:848
-
-
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -H off4⤵
- Power Settings
PID:1648
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:1928
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:1216
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:1560
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:1428
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:1728
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:2120
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:1952
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:856
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:2876
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:1040
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:1352
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:840
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵
- Power Settings
PID:1176
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵
- Power Settings
PID:2224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2152
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2952
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1656
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1928
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
PID:2120
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:764
-
-
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\Everything.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1280
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AllowMultipleTSSessions" /t REG_DWORD /d 0x1 /f4⤵
- System Location Discovery: System Language Discovery
PID:1996
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fSingleSessionPerUser" /t REG_DWORD /d 0x0 /f4⤵
- System Location Discovery: System Language Discovery
PID:1868
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe "C:\Users\Admin\AppData\Local\README.txt"4⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:1412
-
-
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\xdel.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\xdel.exe" -accepteula -p 1 -c C:\4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3024
-
-
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\xdel.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\xdel.exe" -accepteula -p 1 -c F:\4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3008
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2640
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:280
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1952
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:952
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.2MB
MD54d3791a06ff8f4d0bb8a6bcd66c30c27
SHA1940157350cfdc3310c754a1b2ed4a39155494e1a
SHA256bc1c3cd21bb0256d4dd674d1871fb44052a84dcf34219c0ab707c128ef0c92f6
SHA5126291fd2d6f3774217dc78b97de657fa37565c45d1a4edd2fa0e0661f26c0ba9547db734ceeef0f8ee3a796d07111f7a2739ac5ce5c4a1b1a2d3c17d22f646917
-
Filesize
20KB
MD5db98f0e192b766b95eaa502f42e0ddbe
SHA1e74d5aca32be278a04d0c0221e66717534c9f5c8
SHA25683b1eae589093c25a7ce6b78c9d829d8b9421be2617e5ef08d3b68b70758e803
SHA512c33d7a4cdd9d49bd7020758e73b2ade31e6b3dd5ea5442cd4df0942b1c57417763ed6f99911775aeb29f5011e915fc25ece80a73b41e2e3bf6de0ecfaf6a96fb
-
Filesize
5KB
MD59c1a466508c6176b7b061ea41aba0288
SHA1a203d8cb85b26e0883cbe7740116a6a7f32f95e9
SHA2563eaef125cf46e43ffdac927f883c44d8af6203de7fde6ca71e392a4b3c20fc35
SHA5125bfcaceda4321e718d731be22027c931aa362250411818f0a1aa203e9290a6786681906f435781bf955a8d484ce2985e43461bc0cb60ba12f02f3faf7fabcd9b
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\[email protected]
Filesize2.3MB
MD56775b0b2cdd7cd537f132f77b73144b0
SHA1a1bfc2ea21424a20431d0ac527916c7463eabb65
SHA2564d5a5a19280efcff80150219ab749ca08c692e876b3a9f6a71c1af63b971f47f
SHA512b1bea613fdb9c3d049243f82cb7370ac0c62eed38e6eec3d3312ca3f7e4cfc12283f244ea1eafafa123927b41cc9667603a55058991e8a23e8a4df151de65749
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
1.2MB
MD53983d31b7a906d3351ef223ab4ffaa0a
SHA165b317231fbe779516558261b4b0f3e839e7e946
SHA256db3ba29eb00805d400c41be842b176a24c2a14efffb9a78ed34e630749bf31c1
SHA5125231b5b31aa9702aef52fcde8ce384477ff4ff1a7cc9f9a634035aaa2d328e0eaf991228b71b5e0c51ecf737b95c6a6a937808d22a4ca64432a2c74fbd9f4595
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD56081b1cf73d6372a09af0417ffb6ee22
SHA1f0ad200eda0ccb11c9c01a6e9046298abf3a049f
SHA2562f4cc02f64b73fb6701833973bb3907f3bae472f30c6ad4f1baa68394624fa03
SHA5124629c4ebc78945b3327e9a41b9536ff4287a1cc960f04001fb8af51e7580dc0242964d7657b4979e207ebfb1187b82b806f03d61befc0554fd5e56abb242241f
-
Filesize
32B
MD57bb562aef9124339f46545c0ff9f17a3
SHA13d10671e767078c745aff3984a51ab04a74b7b5c
SHA2565b55be579a780e3d2ebf877785ea77fe33d75918776b3656389f638aacfe26b9
SHA512c20ebf7117866430c04a6b735ac99d690368de487ba41b9f134803f299f3557fc5060456a3566a66cb900cb2adf8f11f02ffa3901fa2bcdc29b6c24c83016627
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62