Analysis

  • max time kernel
    150s
  • max time network
    155s
  • resource
    win7

General

  • Target

    2c.jpg

  • Sample

    191016-8b56wcmt7e

  • SHA256

    45521351aa8ff351931e7d7eb7c0d0183184b1adb7484cc0b7a7bba2c992cd24

Score
N/A

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 10 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Adds Run entry to start application 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses
  • Interacts with shadow copies 2 TTPs
  • Suspicious use of SetWindowsHookEx
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Modifies service 2 TTPs 7 IoCs
  • Deletes shadow copies 2 TTPs
  • Drops Office document 218 IoCs
  • Drops file in system dir 11061 IoCs
  • Program crash
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies registry class 1 TTPs 6 IoCs
  • Suspicious use of FindShellTrayWindow
  • Suspicious use of SendNotifyMessage
  • Suspicious behavior: GetForegroundWindowSpam
  • Uses Task Scheduler COM API 1 TTPs 14 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Loads dropped DLL
  • Executes dropped EXE
  • troldesh family

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c.jpg.exe
    "C:\Users\Admin\AppData\Local\Temp\2c.jpg.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetThreadContext
    PID:1116
  • C:\Users\Admin\AppData\Local\Temp\2c.jpg.exe
    "C:\Users\Admin\AppData\Local\Temp\2c.jpg.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Adds Run entry to start application
    • Drops Office document
    • Drops file in system dir
    • Sets desktop wallpaper using registry
    PID:1096
  • C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe List Shadows
    1⤵
      PID:1256
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "-681491697-7187468469199196-10401541551318071804-1362890075-5166471162047007008"
      1⤵
        PID:1976
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Modifies service
        PID:828
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k swprv
        1⤵
          PID:896
        • C:\Windows\system32\vssadmin.exe
          C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
          1⤵
            PID:1792
          • C:\Windows\system32\conhost.exe
            \??\C:\Windows\system32\conhost.exe "-1711419161-19632180451062160174-3262558585046371331897705408-473469839-1266906363"
            1⤵
              PID:1112
            • C:\Windows\system32\vssadmin.exe
              C:\Windows\system32\vssadmin.exe List Shadows
              1⤵
                PID:1168
              • C:\Windows\system32\conhost.exe
                \??\C:\Windows\system32\conhost.exe "1777798986-20679229861032774399538915421-1244484547416757417-862131644-1242436558"
                1⤵
                  PID:2012
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2000
                • C:\Windows\system32\conhost.exe
                  \??\C:\Windows\system32\conhost.exe "-1052235083-13093355341933765500-1859806164-40047876-130918283-1739140492134548468"
                  1⤵
                    PID:1884
                  • C:\Windows\SysWOW64\chcp.com
                    chcp
                    1⤵
                      PID:1976
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k WerSvcGroup
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1388
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -u -p 1232 -s 2332
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1028
                    • C:\Windows\Explorer.EXE
                      "C:\Windows\Explorer.EXE"
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      • Modifies service
                      • Modifies Installed Components in the registry
                      • Modifies registry class
                      • Uses Task Scheduler COM API
                      PID:236
                    • C:\Users\Admin\AppData\Local\Temp\67D81C40.exe
                      "C:\Users\Admin\AppData\Local\Temp\67D81C40.exe"
                      1⤵
                      • Adds Run entry to start application
                      PID:1804
                    • C:\Users\Admin\AppData\Local\Temp\EE1F5F6C.exe
                      "C:\Users\Admin\AppData\Local\Temp\EE1F5F6C.exe"
                      1⤵
                      • Adds Run entry to start application
                      PID:1408

                    Network

                    MITRE ATT&CK Enterprise v15

                    MITRE ATT&CK Additional techniques

                    • T1060
                    • T1107
                    • T1031

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/236-351-0x0000000003A00000-0x0000000003A01000-memory.dmp

                      Filesize

                      4KB

                    • memory/236-348-0x0000000003A00000-0x0000000003A01000-memory.dmp

                      Filesize

                      4KB

                    • memory/236-347-0x0000000003A00000-0x0000000003A01000-memory.dmp

                      Filesize

                      4KB

                    • memory/236-346-0x0000000003A00000-0x0000000003A01000-memory.dmp

                      Filesize

                      4KB

                    • memory/236-345-0x0000000003A00000-0x0000000003A01000-memory.dmp

                      Filesize

                      4KB

                    • memory/236-344-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

                      Filesize

                      4KB

                    • memory/1028-340-0x0000000001F00000-0x0000000001F11000-memory.dmp

                      Filesize

                      68KB

                    • memory/1028-342-0x0000000002B10000-0x0000000002B21000-memory.dmp

                      Filesize

                      68KB

                    • memory/1028-341-0x0000000002B10000-0x0000000002B21000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-142-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-323-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-165-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-179-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-200-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-201-0x0000000002C80000-0x0000000002C91000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-202-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-204-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-206-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-207-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-208-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-210-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-211-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-212-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-213-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-215-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-216-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-217-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-218-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-219-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-220-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-221-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-222-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-226-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-230-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-231-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-233-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-234-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-237-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-239-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-240-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-241-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-242-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-243-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-244-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-246-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-247-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-248-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-249-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-250-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-251-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-253-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-254-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-255-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-256-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-258-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-265-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-266-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-267-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-268-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-269-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-280-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-281-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-297-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-301-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-302-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-303-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-304-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-305-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-306-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-307-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-308-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-310-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-311-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-312-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-313-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-314-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-315-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-316-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-317-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-318-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-319-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-320-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-321-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-322-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-150-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-324-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-325-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-327-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-328-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-329-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-330-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-331-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-332-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-337-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-339-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-143-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-2-0x0000000000400000-0x0000000000608000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/1096-120-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-119-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-118-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-114-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-113-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-111-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-109-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-108-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-107-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-106-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-105-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-104-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-103-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-85-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-84-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-83-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-82-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-81-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-73-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-71-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-69-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-65-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-63-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-60-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-59-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-58-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-57-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-56-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-55-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-53-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-51-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-45-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-44-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-43-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-42-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-41-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-39-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-33-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-29-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-27-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-9-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-8-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-7-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-6-0x0000000002C80000-0x0000000002C91000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-5-0x0000000002870000-0x0000000002881000-memory.dmp

                      Filesize

                      68KB

                    • memory/1096-3-0x0000000000400000-0x0000000000608000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/1096-4-0x0000000000400000-0x0000000000608000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/1116-0-0x00000000039F0000-0x0000000003B0F000-memory.dmp

                      Filesize

                      1.1MB

                    • memory/1116-1-0x0000000003B10000-0x0000000003B21000-memory.dmp

                      Filesize

                      68KB

                    • memory/1408-848-0x0000000003370000-0x0000000003381000-memory.dmp

                      Filesize

                      68KB

                    • memory/1408-847-0x0000000002F60000-0x0000000002F71000-memory.dmp

                      Filesize

                      68KB

                    • memory/1408-849-0x0000000002F60000-0x0000000002F71000-memory.dmp

                      Filesize

                      68KB

                    • memory/1408-860-0x0000000002F60000-0x0000000002F71000-memory.dmp

                      Filesize

                      68KB

                    • memory/1408-1073-0x0000000002F60000-0x0000000002F71000-memory.dmp

                      Filesize

                      68KB

                    • memory/1408-1074-0x0000000003370000-0x0000000003381000-memory.dmp

                      Filesize

                      68KB

                    • memory/1408-1075-0x0000000002F60000-0x0000000002F71000-memory.dmp

                      Filesize

                      68KB

                    • memory/1804-623-0x0000000002700000-0x0000000002711000-memory.dmp

                      Filesize

                      68KB

                    • memory/1804-400-0x0000000002B10000-0x0000000002B21000-memory.dmp

                      Filesize

                      68KB

                    • memory/1804-399-0x0000000002700000-0x0000000002711000-memory.dmp

                      Filesize

                      68KB

                    • memory/1804-622-0x0000000002B10000-0x0000000002B21000-memory.dmp

                      Filesize

                      68KB

                    • memory/1804-621-0x0000000002700000-0x0000000002711000-memory.dmp

                      Filesize

                      68KB

                    • memory/1804-401-0x0000000002700000-0x0000000002711000-memory.dmp

                      Filesize

                      68KB