Analysis
-
max time kernel
143s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 16:51
General
-
Target
RNSM00279.7z
-
Size
5.4MB
-
MD5
acba2209edbb1f7e0bee57da387ca965
-
SHA1
6b0333d14fe7a7421cf59357843edb6b796f0e84
-
SHA256
a15b04019cc88bc0035e8808c951ad06177d55fa11488131caac90ce1346b6b6
-
SHA512
2888aaaebe2e25f441349ada813fa291b6de0ed09957ebb8b7728ed0ff7f9d85f5e17e9fc01061111c2540100a0562af3c1f79be6b138237f9763d4c59738cbb
-
SSDEEP
98304:legqLR4xsY1BV9z3TKtFUcAVHZh7QDzJJ/4TLLLCMw8mUuN3abv8wxJv:legWY1BV9z3XHP0PjQPubhN3A0OF
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\@[email protected]
http://4kqd3hmqgptupi3p.w3r6a4.bid/F843-3FC2-E5D0-0446-8012
http://4kqd3hmqgptupi3p.wl52rt.bid/F843-3FC2-E5D0-0446-8012
http://4kqd3hmqgptupi3p.b4by4c.bid/F843-3FC2-E5D0-0446-8012
http://4kqd3hmqgptupi3p.fw1bwy.bid/F843-3FC2-E5D0-0446-8012
http://4kqd3hmqgptupi3p.onion.to/F843-3FC2-E5D0-0446-8012
http://4kqd3hmqgptupi3p.onion/F843-3FC2-E5D0-0446-8012
Extracted
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\@[email protected]
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
-
Locky family
-
Locky_osiris family
-
Luminosity 2 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Luminosity family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Contacts a large (522) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 22 IoCs
-
Loads dropped DLL 64 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 9 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 5 IoCs
-
Drops file in Program Files directory 12 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
NSIS installer 4 IoCs
-
Kills process with taskkill 1 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 64 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious behavior: MapViewOfSection 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 52 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 19 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00279.7z"1⤵
- Luminosity
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00279\HEUR-Trojan-Ransom.Win32.Agent.gen-14f9231bd987060133bc1e2908a9a5691e829d6f2cc43010f943e4070b0102cf.exeHEUR-Trojan-Ransom.Win32.Agent.gen-14f9231bd987060133bc1e2908a9a5691e829d6f2cc43010f943e4070b0102cf.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00279\HEUR-Trojan-Ransom.Win32.Agent.gen-14f9231bd987060133bc1e2908a9a5691e829d6f2cc43010f943e4070b0102cf.exeHEUR-Trojan-Ransom.Win32.Agent.gen-14f9231bd987060133bc1e2908a9a5691e829d6f2cc43010f943e4070b0102cf.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 2884⤵
- Program crash
-
-
-
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.NSIS.Xamyh.iop-154fefcc43ac75f06c1a0b35a292531e41e5977d38b8b23feda15f6ac7410b01.exeTrojan-Ransom.NSIS.Xamyh.iop-154fefcc43ac75f06c1a0b35a292531e41e5977d38b8b23feda15f6ac7410b01.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\nsz73DC.tmp\basicserve.exe"C:\Users\Admin\AppData\Local\Temp\nsz73DC.tmp\basicserve.exe" "C:\Users\Admin\AppData\Local\Temp\nsz73DC.tmp\basicserve.dll" "dejumifit" " -p bscsrvgup -i b2a7fcfc9e7e4b7bb1489aec1ad94faa" "mifitiwiqiy"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.Bitman.jyv-63cc0459c04c6da01fea3e947ae7356ed23469ff4fc082705a6547b7b0c9a157.exeTrojan-Ransom.Win32.Bitman.jyv-63cc0459c04c6da01fea3e947ae7356ed23469ff4fc082705a6547b7b0c9a157.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.Bitman.jyv-63cc0459c04c6da01fea3e947ae7356ed23469ff4fc082705a6547b7b0c9a157.exeTrojan-Ransom.Win32.Bitman.jyv-63cc0459c04c6da01fea3e947ae7356ed23469ff4fc082705a6547b7b0c9a157.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\iadpmsccojgu.exeC:\Windows\iadpmsccojgu.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 3245⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\Desktop\00279\TROJAN~2.EXE4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.Blocker.dvjn-8c561bd369af161f42dc9e98346ee039fced680e82666887f6dcd7ffaf84ab75.exeTrojan-Ransom.Win32.Blocker.dvjn-8c561bd369af161f42dc9e98346ee039fced680e82666887f6dcd7ffaf84ab75.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:644⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /NP /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f4⤵
- Luminosity
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:644⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:644⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:644⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:644⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:644⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:644⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:644⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:644⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\tskmgr.exe.lnk " /f4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\notepad.exe"C:\Users\Admin\AppData\Local\Temp\notepad.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.Foreign.gxrd-811539a46838f499beaebb935d3c771e4e31201530fd455cba97da656e16cc24.exeTrojan-Ransom.Win32.Foreign.gxrd-811539a46838f499beaebb935d3c771e4e31201530fd455cba97da656e16cc24.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.GenericCryptor.iax-f274c20ab5d564b45c6fd923728fb109c1eff9b6522504f3540e2232b1c4fb51.exeTrojan-Ransom.Win32.GenericCryptor.iax-f274c20ab5d564b45c6fd923728fb109c1eff9b6522504f3540e2232b1c4fb51.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.GenericCryptor.iax-f274c20ab5d564b45c6fd923728fb109c1eff9b6522504f3540e2232b1c4fb51.exeTrojan-Ransom.Win32.GenericCryptor.iax-f274c20ab5d564b45c6fd923728fb109c1eff9b6522504f3540e2232b1c4fb51.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.Locky.bil-2cdd1b0c3cc727315663a07761e2919c4a114f79c3cd9db6e541c44e5afa1453.exeTrojan-Ransom.Win32.Locky.bil-2cdd1b0c3cc727315663a07761e2919c4a114f79c3cd9db6e541c44e5afa1453.exe2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.Locky.cio-284fc767e7ee38c1c0c01c56be0448fb83cdcf4b32098429735ff04ff08b4355.exeTrojan-Ransom.Win32.Locky.cio-284fc767e7ee38c1c0c01c56be0448fb83cdcf4b32098429735ff04ff08b4355.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.Locky.cio-284fc767e7ee38c1c0c01c56be0448fb83cdcf4b32098429735ff04ff08b4355.exeTrojan-Ransom.Win32.Locky.cio-284fc767e7ee38c1c0c01c56be0448fb83cdcf4b32098429735ff04ff08b4355.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.Locky.dma-f22703a8d709be91614e6f71a0bfc683f13b44b8dcb8c5b6cabff70b59fda39e.exeTrojan-Ransom.Win32.Locky.dma-f22703a8d709be91614e6f71a0bfc683f13b44b8dcb8c5b6cabff70b59fda39e.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
- Drops file in System32 directory
-
-
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.Locky.xgw-49ffc90ff02fb02e0d9401bcee07583533aef33f84eb028a8ff0e996f1a1e1a6.exeTrojan-Ransom.Win32.Locky.xgw-49ffc90ff02fb02e0d9401bcee07583533aef33f84eb028a8ff0e996f1a1e1a6.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sysCC73.tmp"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.Locky.xhg-47f9ce6bbefff2abe7311f6d02196722c95ae080cfb352aea478600a144204e0.exeTrojan-Ransom.Win32.Locky.xhg-47f9ce6bbefff2abe7311f6d02196722c95ae080cfb352aea478600a144204e0.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\DesktopOSIRIS.htm3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3912 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3912 CREDAT:406536 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sysC33F.tmp"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00279\Trojan-Ransom.Win32.Zerber.ohr-612a87e3d0a3009decaea23c246d86fa6f6f9fc116595ea09636be24728362de.exeTrojan-Ransom.Win32.Zerber.ohr-612a87e3d0a3009decaea23c246d86fa6f6f9fc116595ea09636be24728362de.exe2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\@[email protected]3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3132 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im "Trojan-Ransom.Win32.Zerber.ohr-612a87e3d0a3009decaea23c246d86fa6f6f9fc116595ea09636be24728362de.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BasicServe\basicserve.exe"C:\Program Files (x86)\BasicServe\basicserve.exe" "C:\Program Files (x86)\BasicServe\basicserve.dll" uzowesoweh zowanude1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\BasicServe\basicserve.exe"C:\Program Files (x86)\BasicServe\basicserve.exe" "C:\Program Files (x86)\BasicServe\basicserve.dll" cinatayoh apohonecin2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 3362⤵
- Program crash
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 3602⤵
- Program crash
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Network Service Discovery
1Peripheral Device Discovery
1Query Registry
2Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD50159493b49b920c1a2c92b6649df6d33
SHA118c312701414914005d7f7866d5ea9a194841daf
SHA25681cd42c8ae46602849c543457e3ac282dd5c4fb3000d09f265e1a4f19829e40a
SHA512acf2d454251fa4c1ff73e4f5ed6e6f1b5e4d74a0c69ac5c40400c4b102357c17927de88e25d43d2d23b9c59e1b65d3db08e07741bb3b3bac813057760a487124
-
Filesize
8KB
MD571bab7344150d3686aa13c969c34475e
SHA1361373b35d3f971eb410dc5956b854e920dc84e4
SHA2565e6331ade91b98726127c67e8c229ef3f0d93c507900847d2b2738223b41896a
SHA512c8ab8e9591d60ff2bfb561e5cc0b550fc5ba5dff96e91eacd96e205ec359e98d3c0f581dd02e4a447765a9dc9674c2c501f113b6f337f543916e31f5a7b84805
-
Filesize
342B
MD564b4c98bf4cc873ca590f43c6f49afb5
SHA113f1adee31d56dbf7bdb0554964d364729409d61
SHA256fcb01b05c74b7553ceae54583b51aace81d9ad415d88ee584c0bf752fa2457b7
SHA5125af85f6ded4ce077e83f812880e1b11bc19b693b5505d065afc9d4a7a4d56c55cd84e5dad108f4eaf5fd4cf317fe3915ce20cf84eebb1b1c8db9cabec1e4c7e5
-
Filesize
342B
MD5625a85f01081e5216362d60d5f815327
SHA1df7d47abaaa31ac949f4b6962e7af965a15e0d33
SHA256bb5b0dd9c0df904ea12af3dcf56b4e41d765a5e575e5eb092d7bc2a153dd5ef7
SHA512f45479693c43929bddcbdc156303e55641413807b5aed717603f20465fa38e971446194eb552ec886174ee42736b7a95fa36eea73e1752241298b4e8508cd47d
-
Filesize
342B
MD5a6d1b2c3276117e1ee0faa3446a58840
SHA1f6d4fef2858a222575dcc4b9b0dad62650a9d22a
SHA256754c804091438e082801c1d29bfb4dd8fa97ef636bf7ceb30d345b2fdd5ad2f5
SHA512998b902137fe6df4ad02dd384084dd0d5935735cfb9254dd8e0ee654fe5974fe430c029e854b816d4afee825c1944a681753a84e8c93c4f88f48222b451e7870
-
Filesize
342B
MD5376d88b7657129784c083079c040688b
SHA16c725bf66e637e36a6658ce413d9a07e0a514f4f
SHA256175e5a21a61df4e543893fef92979240e7691e95c4ca6a46da2b6050f8215139
SHA512930980a50efebc0c9a32594bd1b8fb6bceb825c6a751b9ced1f997ff00f71d9fd7dca3ea8c220126227957d4aff4760768e4c6f19469b33f71882c96fc8537b5
-
Filesize
342B
MD5e64e4154850bf9753e0861f05010c1ff
SHA12e34846cd94b826cb99d1908b03b6a37ecb4f296
SHA256771fb07fdb50d42f1a102d51646cefcd47c9e5137d918629ac49bab19c5b3b2c
SHA512a147fc94df893c3e18cebe8fcd9d130ee00a6630ac2b8c4272d3ad19d30f7e4bc5cdab56f853bd9e0a1835aa176c0a638f4483e1dce44bd773bb05bf91e1e7ad
-
Filesize
342B
MD53e006aa40d0b9c745b799a07ff004ed4
SHA1df216246b54a8957e2014ccb325eb53b27b5b967
SHA256b47be15909c4389d762e85d0ea0d88ea5ea74c85bdc0d6bdbe48eb7e32919a60
SHA5120189b288bea9259e16a40e04b40f963da24075d4db4bc90c57538b02454d81261d8d7a57ce5e1c93db19e71392c05fbbe10eb5dbb5eaf41390956922f2b972b7
-
Filesize
342B
MD5d9ecc31a42705fffa4d3ff701cf997da
SHA1432e9548fa4d70d68dc12f69b40e0661eafeca19
SHA25635a2329e7c236f68e6cb84543a670f31acfe3b4148c42003f36a34fa9175bd04
SHA512c2a41318fb4ea179abfa079e27bc1e24e009daff8549cdbf3033f1d3beb3cb676f289a52f897793d2b9747cb33a1ebec2b490b6d550b7d1d84b59aca80bf7e30
-
Filesize
342B
MD52ceea0a10c21eb6aa6a981e875052830
SHA1c82982299a262404a93447202afaa35e53cd1a85
SHA256bb5c2ff806af619ddf91121f9ad45988b60bc171328e61ea97ea13438ae7a3f0
SHA51257452dcf6965c67d09d72781866ab3ea16f0a805aeed03a87d2e6658132f572d9dc8caff6b544f849a81880f6d50b612919caf4ae5d0e52186d7b727762e5daa
-
Filesize
342B
MD57d8221213925416d5dec5f6cb6d181a8
SHA1c6271ca21c43d09ca646b6403a629d62dde93af6
SHA256bb9b79b042d890c1dcccc9d36820b448723cc593ba30041f4e61854b6ff6e93c
SHA5121bbff8b63700adf78daf32e4828b51050c9c9a270cfff41fea8d9f303882284bac026d3eb484c0abb2d17d53feb6b60953b9c1550e111bfe221583fe26f43ad2
-
Filesize
342B
MD5d6bbd49f3752c7856cf9bab52f44224a
SHA1aa74824543bf9a455605ed848dc97e11c52ace71
SHA2566486dd0d6f9be0e116dfc4ce08b22e5eec090dd7d67ba0feb8f59c02f650f996
SHA512e5ff280293a25f55d064782ed1bc7756fcad37939306bbdc3ff07bc205f09a210e3aff6a3397b6a57727d66a1e220cb2a993429b4d12387b0bee1590978719a6
-
Filesize
342B
MD518146d8b3c72522e3be208cad8a13116
SHA175f4fd34d08ac33915b342de6c9eb937e28c70d3
SHA2567ae034ed0f284b8a3a0920be67aa826f0eef4236cb22fde92652dbc63fcd013b
SHA512c30cdcaa86c826cca8ba40047450df4f71d1484d37e027d5be43cc00b04cc4c981ac6bb5df5aea65faca337839b53ae8f5b3418296bc6c64a9433bedade71479
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
857KB
MD5bc6529f2a93dd5eb328963e0b41a855a
SHA10d3fe448baa8a886fd33541f17e893a8a550640f
SHA256b98c711a375f39574672d49fdb798e70dab73b56c5a605c2cfd55a82d8d1b528
SHA5124b50bc0de71bdbdbe76622d498d70b940e11a5c34b6d58b43765eacb2447d3106da3ac80f3a20e7eed67598bf9875cda9646694724b8fae6d91a7ed97b0bad73
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
22KB
MD574a5404b477ff0328829aa9d8889c3a3
SHA1dad102f34d74e614668f91c2de287cf4f63b1aac
SHA25649c095451a1203a82004c294fcd418621fd0649ec3eaa6f8a6a96c193cd4e270
SHA512f953401617e0c5560297d72f3bba24c74d6c5d1ec500226e198799c56fb0aa38642246e0cb0d111dee9be31b7c771d13e59e16b590c98d290eb230fd4d5559d8
-
Filesize
78KB
MD52e1c0769beff93993d98eaa6c537acdf
SHA1459f3a41027bb6d74023d4f4f094a7165301e4a6
SHA256f3479f5877dec3810598bb3b707660bfcd0cbe4791cee939a305b8261ba972ac
SHA5126d61a5286964874b8e36ef713808bfc363d7d05560270a3d1616b15c547755e87f5e174ee1dca8a1248c89a58667221a5bf22ba91b6e2614c6b29b0926931295
-
Filesize
16KB
MD5fc2a3b136df9ed2642e3366f94f5ee48
SHA1ae124ba9b05fb8aa3144697286675c674d9f9b34
SHA2560995f0a43be3425f3fd3bae770a9cf0c6ebb33b9cab54e868e50553d4dce9575
SHA5125222c59878963f41c92e1d399f16e54ee77f1771da358090d822e1a15b9211ff48d79f320b139ccf3666446fdc5b1aa254460a9401e107578fbb2ae8846bad4a
-
Filesize
19KB
MD58ebc0e807a744b926c88591b48dad8c3
SHA1cae1fbaa33efe2b960b2a874191861e29485e597
SHA2569db7be0b55732fff9e0766245cd7c96b7ec9c395367fc16f336b73b189c997f5
SHA51263f7c9c888aac2ceb2dac49d0d4dc7270b4c6f93f591a2073c72777e3556edf6b771e666ce01d19546897b231e9fae09eb31a71c8ffe882b391e51e3a1c42432
-
Filesize
10KB
MD5292dfaf6e70809046cb3f21e1fb6c8aa
SHA14da7be42a5fd0dddde68b246f26dbece2de9ec78
SHA256d54479ba731bc66ccf5f0317bab3c93e041642b9802c0c590829df674ac26433
SHA512dbc46772c1940ea8eb16cfe92b1844b5e146b656e10df1866ad6efc665b0e4e4461408ca7638b5876889549a66bc790d4d16cc1408749f480929bd2abe8e3e93
-
Filesize
90B
MD5bc1bb4b1ee1df9946f6bc7e849aff5e1
SHA18ab20e0068bf05aa4d72d764a5aef578005e6ad7
SHA25682d2415b9de91ce3abb20ee114ad129eab06882270ffd9f33d79898811914676
SHA51229c4ca0c4bee8eccd7fe592f10a5f028a9e54354c7fa8a1a9e314d188a245c1cc4f32860f5c86a5d5d294d3c21b8a8745414183f4d18fd3c73b6652e36b0a830
-
Filesize
940B
MD5764b285dff272a359649a6f186fb5564
SHA1cce9eedfac5b0b33587787ee3e3a88d49059fb10
SHA256aae9d778d4f1aab839bd6db3ac3a732f3a3496d91127f667f8177a0d9f1c36de
SHA51256773b067b831850aa056c9c185047cc62e19062c5b9ffb55c985876ee57793108bdb5faef513b8e3d6d51ed34b765a3f826c821155c138ba919f67ac56caa1c
-
Filesize
195KB
MD53a93542ef653c9211885999f6be603df
SHA135d36643555790d859653c60fd6712035a1ec806
SHA25614f9231bd987060133bc1e2908a9a5691e829d6f2cc43010f943e4070b0102cf
SHA5122039bed38fd2586898af38d5bcba3549cf58e3e3e71ae6256d191a60ee80d8cd448fc242d3ae9b939d5531288b680fcb21b045568c624073f5d8243c30a01b3a
-
Filesize
1.9MB
MD521c1d06c5e5a3c2a4234d4cbf729ccfd
SHA149c3464b8e863dcbe571dca4d3872f16012f32fd
SHA256154fefcc43ac75f06c1a0b35a292531e41e5977d38b8b23feda15f6ac7410b01
SHA5126708dda48790a45a55dc2eba485cdfc3d65d5606059a86010002dcc66698621d08ca85f87770e69225c0c3cc947729cac287429c93efbad686c609aa03f5e064
-
Filesize
376KB
MD5f5002d397908a598439660b936f713b9
SHA1372ac77e8fd7ed0919b0b66a55514d6437093a43
SHA25663cc0459c04c6da01fea3e947ae7356ed23469ff4fc082705a6547b7b0c9a157
SHA512b4f1ab6d3614c02869b67c4181e981d40690bd3ebc39b5b1036f8ad8918139083b17d9fc5b93033cb1872e8b42a6d4d4288b36cf7acc5d5497bd5abed4da6010
-
Filesize
1.8MB
MD54cccaa5cfb192851d364230d184a0472
SHA16453801f53aabd336417b5b2d3d9bad1a5df4527
SHA2568c561bd369af161f42dc9e98346ee039fced680e82666887f6dcd7ffaf84ab75
SHA512fc01eb8dbceecc31a7ea193ec44417e5648b4efc3d5583d851a6c7e3bb814acac6d82be922cb1e5775429cc07d4c20768a539312539c9bf5f50605ff71c8ad65
-
Filesize
115KB
MD5fed3dbb724d8364ef12976526447f8aa
SHA19c92a66492675ff7c593eae74813e6e53b73c881
SHA256811539a46838f499beaebb935d3c771e4e31201530fd455cba97da656e16cc24
SHA512986a5011d7a298016e9f78cc40d4837ba2e9123e05e15b8b630c63a0e5cb136ac822885c15ec16d1d3ad6b0d36c7887bf0e4d17e6a61f4dc810f53c60d40d407
-
Filesize
277KB
MD582f0133b4c752cf1ff4c4be7aad4e7fc
SHA1d9a5aba99d0e5a253ed8d31fc703097348723d02
SHA256f274c20ab5d564b45c6fd923728fb109c1eff9b6522504f3540e2232b1c4fb51
SHA5123132794da90f0e7542a87119a11a73ba405020c09db9eb06f25e6f1fc93e6b87ec51b4d4ca243f247686b1cfe7af30de3c2a992ffda9a11b4151e66ab64ae5f9
-
Filesize
244KB
MD5bd5f6a6a82a3bbb0004a0f3a312dde96
SHA18e4c593bd985dab4777d4a6b0c40a1b2a45c5db7
SHA2562cdd1b0c3cc727315663a07761e2919c4a114f79c3cd9db6e541c44e5afa1453
SHA512083a0b1c664ac99686bbc8143dae1972ceedddb97fa0fe732fc94252270674cc997c9634c99e160100be17eb519ee96d333f5b418fd677d54e3109b425ebb129
-
Filesize
281KB
MD56cdd9d7e0300fdf9ec878d83f8b064d9
SHA10ddb718c9c49339f37090976604e21d263f7f242
SHA256284fc767e7ee38c1c0c01c56be0448fb83cdcf4b32098429735ff04ff08b4355
SHA512ad2ac4671c807144ba9db2831b5beeb6fa5e0e231420e8c4d6b3cdc209f6f35dbe8927351d6659687c260907b0f3735dc04cac6b149b304f17c1f7d34f6c6ef6
-
Filesize
340KB
MD5273c23e73735fd3d0db438edafe52287
SHA10c660ed417994b1630edc3a73599e30ce69a5d65
SHA256f22703a8d709be91614e6f71a0bfc683f13b44b8dcb8c5b6cabff70b59fda39e
SHA512980f30ceca8d4b729f3d85726935ffabbdea2149970fb677f92ca6e6eb0edc64389358aab729318c5d99d6da9009728c6b5d203efe08a2e14c36ed367680c99d
-
Filesize
411KB
MD5dff0940a39675fe15fdf0dfbf6fa1549
SHA1e85713e8074d02a21cfa9b8ace7723e9540774cb
SHA25649ffc90ff02fb02e0d9401bcee07583533aef33f84eb028a8ff0e996f1a1e1a6
SHA512d9b7307f0ea3abbb5bbd2e01e55060c5623ff279a33746e79d98606163dc5172912c2718d6aec0aadd61e75712116f06ba65c80b70f1f97574d442765205da39
-
Filesize
392KB
MD54a2592bc635987fa01678a5eff79cdde
SHA1f7554f1f50e31080f6dd6946fc3755984ab4993e
SHA25647f9ce6bbefff2abe7311f6d02196722c95ae080cfb352aea478600a144204e0
SHA512807fbeb38bf285780a1cdb4dee569a077123fbeb28861738f001334171d6d89b7d30e53546f878cd3eff2e8e0763b92ed0331e59397a013150df13860e7e9d52
-
Filesize
352KB
MD5a0edcf1f6d3dac996ca1eb09bd7a0d87
SHA1a436b32c9218281767a291a5b0fab164b49b24e6
SHA256612a87e3d0a3009decaea23c246d86fa6f6f9fc116595ea09636be24728362de
SHA512a26f9ec662feb6d033e69b897d2112078fd00b9a474ab68fa5746c64d89874b3ce572f78eedf5f326db70ef550f6bd48a0430dc683aa3ed7319d447a9622b114
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
11KB
MD53e6bf00b3ac976122f982ae2aadb1c51
SHA1caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
SHA2564ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
SHA5121286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
-
Filesize
840KB
-
Filesize
252KB
-
Filesize
840KB
-
Filesize
108KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
188KB
-
Filesize
416KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
32KB
-
Filesize
88KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
224KB
-
Filesize
4KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB