blackbasta | d905781d05edf7deb91f595b96efa5a5f6a55d693305da5161db32989f8d2d9b

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
Size

13.6MB
MD5

9f28f87be2197981d2e32009a91093d5
SHA1

c6d37a32e08c244ca866d3250ae1ddb0aa1a81e6
SHA256

d905781d05edf7deb91f595b96efa5a5f6a55d693305da5161db32989f8d2d9b
SHA512

0fb502a720d6e110b2e1195b793fad05713701fcd49f89d4f49ccd0b21e30948d145356f4d8108d8acf7566ef0503889167d4ddb4c275ec23e5b98c7dc85e8ef
SSDEEP

98304:+Lu1TIRtUOV5ZQ+5jZArLu1OWWqXpy05Q4BN2IJjscn:+TRtBYk405Q03FP

Score

10^/10

blackbasta pandastealer defense_evasion discovery execution impact ransomware spyware stealer

Malware Config

Signatures

Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
ransomware blackbasta

Black Basta payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000100000000f878-13.dat	family_blackbasta

Blackbasta family
blackbasta

Panda Stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000100000000f878-13.dat	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Pandastealer family
pandastealer
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kaspersky.exe	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kaspersky.exe	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\autorun.inf	cmd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODBC.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSDecWrp.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODEXL.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\msdaurl.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msador15.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msadox.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msadrh15.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\promointl.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\MSCONV97.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\msdadc.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEERR.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEWSS.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEODBCI.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSetupPS.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FDATE.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBE7INTL.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\Microsoft.Ink.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\msdaps.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\pidgenx.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\msdaprsr.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\msdfmap.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\xmlrw.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\InkDiv.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FBIBLIO.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPLACE.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXPSRV.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RICHED20.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\METCONV.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\DirectDB.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\Microsoft.Ink.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\penkor.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\msdaremr.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\hxdsui.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\oledb32r.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODDBS.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODTXT.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\xmlrwbin.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\rtscom.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\skchui.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSPTLS.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IMCONTACT.DLL	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwgst.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwjpnr.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\msadcf.dll	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2892	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
Token: SeDebugPrivilege	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
Token: SeBackupPrivilege	2888	vssvc.exe
Token: SeRestorePrivilege	2888	vssvc.exe
Token: SeAuditPrivilege	2888	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2488	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	31
PID 2460 wrote to memory of 2488	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	31
PID 2460 wrote to memory of 2488	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	31
PID 2460 wrote to memory of 2488	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	31
PID 2488 wrote to memory of 2892	2488	cmd.exe	33
PID 2488 wrote to memory of 2892	2488	cmd.exe	33
PID 2488 wrote to memory of 2892	2488	cmd.exe	33
PID 2488 wrote to memory of 2892	2488	cmd.exe	33
PID 2460 wrote to memory of 1152	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	35
PID 2460 wrote to memory of 1152	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	35
PID 2460 wrote to memory of 1152	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	35
PID 2460 wrote to memory of 1152	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	35
PID 2460 wrote to memory of 2832	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	37
PID 2460 wrote to memory of 2832	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	37
PID 2460 wrote to memory of 2832	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	37
PID 2460 wrote to memory of 2832	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	37
PID 2460 wrote to memory of 2840	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	39
PID 2460 wrote to memory of 2840	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	39
PID 2460 wrote to memory of 2840	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	39
PID 2460 wrote to memory of 2840	2460	2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe	39

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-19_9f28f87be2197981d2e32009a91093d5_darkside_hawkeye_luca-stealer.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet && wmic shadowcopy delete
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:2892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ^[autorun^] >autorun.inf
  2⤵
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  PID:1152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ^open^=KasperskyScan^.exe >>autorun.inf
  2⤵
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ^execute=^KasperskyScan^.exe >>autorun.inf
  2⤵
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  PID:2840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe

Filesize
13.6MB

MD5
9f28f87be2197981d2e32009a91093d5

SHA1
c6d37a32e08c244ca866d3250ae1ddb0aa1a81e6

SHA256
d905781d05edf7deb91f595b96efa5a5f6a55d693305da5161db32989f8d2d9b

SHA512
0fb502a720d6e110b2e1195b793fad05713701fcd49f89d4f49ccd0b21e30948d145356f4d8108d8acf7566ef0503889167d4ddb4c275ec23e5b98c7dc85e8ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\autorun.inf

Filesize
37B

MD5
3883f693b2911e7b9cabaf1d89601ebd

SHA1
a733bc5b66e5b7beb1ab54ce430ff16cdb935fcb

SHA256
747ea7ec54ee0bc9b637867de0c451df65c840f757988f5a3b6e3fe6c73ab1b6

SHA512
41fb0555004f392f2c67fd7675d2aea2a7a28a4f51d92237fdaff2d60624c559a5401335887b66f49a721dff669f8f9bd150fde0afe0845eb366309ca1088a98

Download Submit
C:\Users\Admin\AppData\Local\Temp\autorun.inf

Filesize
65B

MD5
fbefa88e6b51c05dd63d97dfdbeb3589

SHA1
67e09918d878c6615befab5dc9194439027f268d

SHA256
3861acedffd29452d2fdb96728f7347652bde9353915d3873a7414843f49b8b1

SHA512
58f8c1a64f2eb21be7b96db335d1ade0ce0878566a8386b3689b650132ca28e14761b20fdfe50f2af9915dff2bdd3a5b07f6f3ed082e4e6998ec5f0cd052f12f

Download Submit
memory/2460-0-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/2460-1-0x0000000000970000-0x0000000000978000-memory.dmp

Filesize
32KB

Download
memory/2460-2-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2460-419-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/2460-480-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads