Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
05/03/2025, 22:34
Static task
static1
Behavioral task
behavioral1
Sample
b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe
Resource
win10v2004-20250217-en
General
-
Target
b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe
-
Size
353KB
-
MD5
6e352cd0e6130ec8e16c0a212f0ddfa2
-
SHA1
fb4a19beb12dac8cc3ec5bf0544c2d7260dd8eac
-
SHA256
b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b
-
SHA512
3b9776eb4de648bb550af2252d16d5708d01dbf89de518f9fcab00f5fb44a4cc7ab8fcf529a990f8c4c4dd79d664647d5eb72768c5c5eb2b5e3ceec9c279a164
-
SSDEEP
6144:/vHLtLMCHg3FxbyypAlFy1BWfc3xhacB58A22LU1Z2B0lrTs4HybaY:/fLhMCHgVx2ypgFy1BWfyEL2vOTsCY
Malware Config
Extracted
C:\Users\Admin\Desktop\_HELP_HELP_HELP_ZGX6M_.hta
http://p27dokhpz2n7nvgr.onion.to/14DD-0481-9738-0006-46A8http://p27dokhpz2n7nvgr.onion.cab/14DD-0481-9738-0006-46A8http://p27dokhpz2n7nvgr.onion.nu/14DD-0481-9738-0006-46A8http://p27dokhpz2n7nvgr.onion.link/14DD-0481-9738-0006-46A8http://p27dokhpz2n7nvgr.tor2web.org/14DD-0481-9738-0006-46A8
http://p27dokhpz2n7nvgr.onion/14DD-0481-9738-0006-46A8
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Blocklisted process makes network request 5 IoCs
flow pid Process 2180 1172 mshta.exe 2184 1172 mshta.exe 2186 1172 mshta.exe 2188 1172 mshta.exe 2190 1172 mshta.exe -
Contacts a large (1095) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid Process 2316 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe -
Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\steam b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\microsoft\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\microsoft\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\the bat! b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\desktop b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\thunderbird b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\microsoft\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\the bat! b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\microsoft\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\microsoft\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\microsoft\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\bitcoin b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\microsoft\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\bitcoin b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\thunderbird b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\documents b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\local\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\system32\config\systemprofile\appdata\roaming\steam b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp671C.bmp" b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2096 set thread context of 2896 2096 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 30 -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files\ b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\microsoft\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\microsoft\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\steam b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\the bat! b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\ b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\thunderbird b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\bitcoin b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\microsoft\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\ b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2512 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 2320 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2512 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2896 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2896 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe Token: SeDebugPrivilege 2320 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2356 DllHost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2356 DllHost.exe 2356 DllHost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2896 2096 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 30 PID 2096 wrote to memory of 2896 2096 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 30 PID 2096 wrote to memory of 2896 2096 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 30 PID 2096 wrote to memory of 2896 2096 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 30 PID 2096 wrote to memory of 2896 2096 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 30 PID 2096 wrote to memory of 2896 2096 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 30 PID 2096 wrote to memory of 2896 2096 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 30 PID 2096 wrote to memory of 2896 2096 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 30 PID 2096 wrote to memory of 2896 2096 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 30 PID 2096 wrote to memory of 2896 2096 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 30 PID 2896 wrote to memory of 1172 2896 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 32 PID 2896 wrote to memory of 1172 2896 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 32 PID 2896 wrote to memory of 1172 2896 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 32 PID 2896 wrote to memory of 1172 2896 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 32 PID 2896 wrote to memory of 2316 2896 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 37 PID 2896 wrote to memory of 2316 2896 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 37 PID 2896 wrote to memory of 2316 2896 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 37 PID 2896 wrote to memory of 2316 2896 b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe 37 PID 2316 wrote to memory of 2320 2316 cmd.exe 39 PID 2316 wrote to memory of 2320 2316 cmd.exe 39 PID 2316 wrote to memory of 2320 2316 cmd.exe 39 PID 2316 wrote to memory of 2512 2316 cmd.exe 40 PID 2316 wrote to memory of 2512 2316 cmd.exe 40 PID 2316 wrote to memory of 2512 2316 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe"C:\Users\Admin\AppData\Local\Temp\b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe"C:\Users\Admin\AppData\Local\Temp\b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe"2⤵
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_HELP_HELP_HELP_ZGX6M_.hta"3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1172
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\taskkill.exetaskkill /f /im "b2f2ac6419392e3202cf057ef928104f795afb3e96747d85a62937cc6c7d8c9b.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2512
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2356
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
PID:1764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD583142242e97b8953c386f988aa694e4a
SHA1833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10
-
Filesize
183KB
MD5109cab5505f5e065b63d01361467a83b
SHA14ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc
-
Filesize
426KB
MD51904c168e7ff7349966f4715011981bf
SHA1e7010e8bef0dd0cb7dc4ae6f0485b466d9ab70a5
SHA2564f514c55cc72de2c0ff8f028602c419345890202c41cf5c994aee2c2146c7615
SHA51237039d3c4343d759795b8577959385f0685b379eb7c6f2cc3d5698ee21f6bb244ff07a716a0e86d28131d7bd2e41733439b0864375cd0364037b3028756efecc
-
Filesize
74KB
MD5ff1a3c3c6e44449ffaf61b13a588016e
SHA105d6f8dd728ee3212be25505a2f38e56aeaf6e9b
SHA256878b978b01147841b36ef92c14aceb8837d61948055c01ec449a51a733be2ee1
SHA512427b5327d60883bb9cccea8590154f133562fa7dae042503dd1359dc3ec40b6ad9873dc6dcab3e848a7649679c49dc14aac72af2ec8deb68a4259a16c40862cf