Analysis
-
max time kernel
51s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-02-2025 03:27
Static task
static1
Behavioral task
behavioral1
Sample
b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe
Resource
win10v2004-20250207-en
General
-
Target
b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe
-
Size
256KB
-
MD5
8690c5aeda72ccae065f3620d64165f0
-
SHA1
e49b2670bd7ae8501908565e9a15c5f36a4812f0
-
SHA256
b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20
-
SHA512
49ce46573863b99ac80617b07e5c354abf4f0fac46a66e0179bf1d5ce818aeb7fcc6c27c235db47b661423daa0c3bf4cc78730c06ca2acf31fcb8fcdd8226940
-
SSDEEP
6144:lYhHqom8IijrnB9eT7QRwsCrrnNGT4alKgxtTMc9YpMH:GkgXB9s7PPevpEc3H
Malware Config
Extracted
C:\Users\Admin\Desktop\_HELP_HELP_HELP_D5TBXW5_.hta
http://hjhqmbxyinislkkt.1qjl23.top/35EA-57F9-3135-0502-9F25http://hjhqmbxyinislkkt.1d8y5e.top/35EA-57F9-3135-0502-9F25http://hjhqmbxyinislkkt.1cdguw.top/35EA-57F9-3135-0502-9F25http://hjhqmbxyinislkkt.1a58vj.top/35EA-57F9-3135-0502-9F25http://hjhqmbxyinislkkt.1byty3.top/35EA-57F9-3135-0502-9F25
http://hjhqmbxyinislkkt.onion/35EA-57F9-3135-0502-9F25
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2180 2288 mshta.exe -
Contacts a large (1090) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid Process 3040 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe -
Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpDD83.bmp" b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\bitcoin b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\microsoft\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\the bat! b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\microsoft\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\steam b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files\ b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\ b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\microsoft\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\program files (x86)\thunderbird b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\ b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2748 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 1064 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2748 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2736 b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 2736 b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe Token: 33 2140 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2140 AUDIODG.EXE Token: 33 2140 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2140 AUDIODG.EXE Token: SeDebugPrivilege 1064 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2612 DllHost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2612 DllHost.exe 2612 DllHost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2288 2736 b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe 30 PID 2736 wrote to memory of 2288 2736 b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe 30 PID 2736 wrote to memory of 2288 2736 b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe 30 PID 2736 wrote to memory of 2288 2736 b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe 30 PID 2736 wrote to memory of 3040 2736 b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe 36 PID 2736 wrote to memory of 3040 2736 b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe 36 PID 2736 wrote to memory of 3040 2736 b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe 36 PID 2736 wrote to memory of 3040 2736 b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe 36 PID 3040 wrote to memory of 1064 3040 cmd.exe 38 PID 3040 wrote to memory of 1064 3040 cmd.exe 38 PID 3040 wrote to memory of 1064 3040 cmd.exe 38 PID 3040 wrote to memory of 1064 3040 cmd.exe 38 PID 3040 wrote to memory of 2748 3040 cmd.exe 39 PID 3040 wrote to memory of 2748 3040 cmd.exe 39 PID 3040 wrote to memory of 2748 3040 cmd.exe 39 PID 3040 wrote to memory of 2748 3040 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe"C:\Users\Admin\AppData\Local\Temp\b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe"1⤵
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_HELP_HELP_HELP_D5TBXW5_.hta"2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2288
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "b3e4f68809da0b576be79dadcffdbf5edcb45089cb5af2afe38f77ba81efbc20N.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2748
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2612
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
PID:1680
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4501⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5a5b00d14ec713e1d946cf1197648fd53
SHA1623e1b6cd95299742cd2e6cb3e61b5755bd4c94c
SHA2560fe244bc44cad32860d62023aec45b29bb6a8cef28761715906246340f81b52e
SHA51297b9231e22d55058290c2a7929ce3b1961372f322fe06788902e1d2603d9507ba4b46bfd8a0e02b3a07c24cd80c9d8b2249e4af380d1d6f2c6d25b4d51905dda
-
Filesize
427KB
MD55246e533cba5754547b4f16d492f82ab
SHA1241d7cf1d5d9a50b7ff9a49a03fc8c35b31f7250
SHA256f5ec833922bd02b6d2f7344ac88d98060930199c8700473ec256a5eacdbe0ebf
SHA5128231ef1162a00aa8e959f957c06057833dc4467ebf302e4452fc00cd6c65d0832b2b469fe0fe1f93a1449dc41aef56f3e6ca6ea34f60518753f9d3dada55521c