Task
task1
Sample
2c.jpg.exe
Resource
win7
0 signatures
Task
task2
Sample
2c.jpg.exe
Resource
win10
0 signatures
General
-
Target
2c.jpg
-
Sample
191016-8b56wcmt7e
-
SHA256
45521351aa8ff351931e7d7eb7c0d0183184b1adb7484cc0b7a7bba2c992cd24
Score
N/A
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
2c.jpg.exe2c.jpg.execmd.exesvchost.exeSppExtComObj.exeat description process target process 1906 PID 1012 wrote to memory of 3488 2c.jpg.exe 2c.jpg.exe 1937 PID 1012 wrote to memory of 3488 2c.jpg.exe 2c.jpg.exe 52656 PID 3488 wrote to memory of 4088 2c.jpg.exe vssadmin.exe 55281 PID 3488 wrote to memory of 2768 2c.jpg.exe vssadmin.exe 56578 PID 3488 wrote to memory of 3848 2c.jpg.exe vssadmin.exe 56797 PID 3488 wrote to memory of 3912 2c.jpg.exe cmd.exe 57406 PID 3912 wrote to memory of 3868 cmd.exe chcp.com 89640 PID 2224 wrote to memory of 3788 svchost.exe WerFault.exe 98906 PID 2224 wrote to memory of 3068 svchost.exe WerFault.exe 122062 PID 980 wrote to memory of 1208 SppExtComObj.exe SLUI.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2c.jpg.exeat description process target process 1953 PID 1012 set thread context of 3488 2c.jpg.exe 2c.jpg.exe -
Adds Run entry to start application 2 TTPs 4 IoCs
Processes:
2c.jpg.exeat description ioc process 3172 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 2c.jpg.exe 3172 Set value (str) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 2c.jpg.exe 128234 Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 2c.jpg.exe 128234 Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 2c.jpg.exe -
Suspicious behavior: EnumeratesProcesses
-
Interacts with shadow copies 2 TTPs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
vssvc.exeWerFault.exeexplorer.exeWerFault.exeat description process 53000 Token: SeBackupPrivilege vssvc.exe 53000 Token: SeRestorePrivilege vssvc.exe 53000 Token: SeAuditPrivilege vssvc.exe 90984 Token: SeDebugPrivilege WerFault.exe 98156 Token: SeShutdownPrivilege explorer.exe 98156 Token: SeCreatePagefilePrivilege explorer.exe 98468 Token: SeShutdownPrivilege explorer.exe 98468 Token: SeCreatePagefilePrivilege explorer.exe 98609 Token: SeShutdownPrivilege explorer.exe 98609 Token: SeCreatePagefilePrivilege explorer.exe 98781 Token: SeShutdownPrivilege explorer.exe 98781 Token: SeCreatePagefilePrivilege explorer.exe 99000 Token: SeDebugPrivilege WerFault.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exeat description ioc process 53047 Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe 53047 Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe 53062 Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe 53078 Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe 53078 Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Deletes shadow copies 2 TTPs
-
Processes:
2c.jpg.exeat description ioc process 62562 File opened for modification C:\Users\Admin\Music\JoinUndo.pptm 2c.jpg.exe 62578 File opened for modification C:\Users\Admin\Music\JoinUndo.pptm 2c.jpg.exe 63156 File opened for modification C:\Users\Admin\Music\ApproveTrace.pptx 2c.jpg.exe 63187 File opened for modification C:\Users\Admin\Music\ApproveTrace.pptx 2c.jpg.exe 63203 File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm 2c.jpg.exe 63234 File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm 2c.jpg.exe 63250 File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx 2c.jpg.exe 63281 File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx 2c.jpg.exe 64203 File opened for modification C:\Users\Admin\AppData\Roaming\ApproveUnpublish.ppsm 2c.jpg.exe 64265 File opened for modification C:\Users\Admin\AppData\Roaming\ApproveUnpublish.ppsm 2c.jpg.exe 93218 File opened for modification C:\Program Files\Microsoft Office\root\VFS\Windows\SHELLNEW\EXCEL12.XLSX 2c.jpg.exe 93234 File opened for modification C:\Program Files\Microsoft Office\root\VFS\Windows\SHELLNEW\EXCEL12.XLSX 2c.jpg.exe 95828 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\WidescreenPresentation.potx 2c.jpg.exe 95859 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\WidescreenPresentation.potx 2c.jpg.exe 95875 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Training.potx 2c.jpg.exe 95922 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessResume.dotx 2c.jpg.exe 95922 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessReport.dotx 2c.jpg.exe 95937 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessReport.dotx 2c.jpg.exe 95937 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessLetter.dotx 2c.jpg.exe 95937 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimeCard.xltx 2c.jpg.exe 95953 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx 2c.jpg.exe 96000 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx 2c.jpg.exe 96015 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx 2c.jpg.exe 96015 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx 2c.jpg.exe 96047 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackLetter.dotx 2c.jpg.exe 96047 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\QuizShow.potx 2c.jpg.exe 96062 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\QuizShow.potx 2c.jpg.exe 96062 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Pitchbook.potx 2c.jpg.exe 96078 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Pitchbook.potx 2c.jpg.exe 96078 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\PersonalMonthlyBudget.xltx 2c.jpg.exe 96093 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\PersonalMonthlyBudget.xltx 2c.jpg.exe 96093 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\OriginResume.Dotx 2c.jpg.exe 96093 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx 2c.jpg.exe 96125 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx 2c.jpg.exe 96140 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\OriginLetter.Dotx 2c.jpg.exe 96140 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Office Word 2003 Look.dotx 2c.jpg.exe 96140 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\LoanAmortization.xltx 2c.jpg.exe 96172 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\LoanAmortization.xltx 2c.jpg.exe 96172 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Word 2010 look.dotx 2c.jpg.exe 96172 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ExpenseReport.xltx 2c.jpg.exe 96187 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ExpenseReport.xltx 2c.jpg.exe 96187 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\EssentialResume.dotx 2c.jpg.exe 96203 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\EssentialResume.dotx 2c.jpg.exe 96218 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\EssentialReport.dotx 2c.jpg.exe 96250 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\EssentialReport.dotx 2c.jpg.exe 96297 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\EssentialLetter.dotx 2c.jpg.exe 96312 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\EssentialLetter.dotx 2c.jpg.exe 96328 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx 2c.jpg.exe 96343 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx 2c.jpg.exe 96375 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ClassicPhotoAlbum.potx 2c.jpg.exe 96437 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx 2c.jpg.exe 96453 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx 2c.jpg.exe 96453 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalLetter.dotx 2c.jpg.exe 96468 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalLetter.dotx 2c.jpg.exe 96468 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\BloodPressureTracker.xltx 2c.jpg.exe 96468 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Blog.dotx 2c.jpg.exe 96484 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Blog.dotx 2c.jpg.exe 96484 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\BillingStatement.xltx 2c.jpg.exe 96515 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\BillingStatement.xltx 2c.jpg.exe 96515 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryResume.dotx 2c.jpg.exe 96547 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx 2c.jpg.exe 96562 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx 2c.jpg.exe 96578 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx 2c.jpg.exe 96593 File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyResume.dotx 2c.jpg.exe -
Drops file in system dir 11503 IoCs
Processes:
2c.jpg.exeat description ioc process 76203 File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt 2c.jpg.exe 76203 File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt 2c.jpg.exe 76203 File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt 2c.jpg.exe 76218 File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt 2c.jpg.exe 76218 File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt 2c.jpg.exe 76218 File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\README.md 2c.jpg.exe 76234 File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\nunit_schema_2.5.xsd 2c.jpg.exe 76234 File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\CHANGELOG.md 2c.jpg.exe 76265 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 2c.jpg.exe 76265 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 2c.jpg.exe 76265 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Images\BlankImage.png 2c.jpg.exe 76281 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-100_contrast-black.png 2c.jpg.exe 76281 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-100_contrast-black.png 2c.jpg.exe 76281 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-100_contrast-black.png 2c.jpg.exe 76281 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Movie-TVStoreLogo.scale-100_contrast-black.png 2c.jpg.exe 76297 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-100_contrast-black.png 2c.jpg.exe 76297 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-100_contrast-black.png 2c.jpg.exe 76297 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_contrast-black.png 2c.jpg.exe 76297 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png 2c.jpg.exe 76297 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png 2c.jpg.exe 76312 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_altform-unplated_contrast-black.png 2c.jpg.exe 76312 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_contrast-black.png 2c.jpg.exe 76312 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_altform-unplated_contrast-black.png 2c.jpg.exe 76312 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png 2c.jpg.exe 76312 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_altform-unplated_contrast-black.png 2c.jpg.exe 76328 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png 2c.jpg.exe 76328 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_altform-unplated_contrast-black.png 2c.jpg.exe 76328 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png 2c.jpg.exe 76328 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png 2c.jpg.exe 76328 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png 2c.jpg.exe 76328 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png 2c.jpg.exe 76359 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_contrast-black.png 2c.jpg.exe 76359 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png 2c.jpg.exe 76359 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png 2c.jpg.exe 76359 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png 2c.jpg.exe 76359 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png 2c.jpg.exe 76359 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_altform-unplated_contrast-black.png 2c.jpg.exe 76375 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png 2c.jpg.exe 76375 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png 2c.jpg.exe 76375 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png 2c.jpg.exe 76375 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_altform-unplated_contrast-black.png 2c.jpg.exe 76390 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png 2c.jpg.exe 76390 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png 2c.jpg.exe 76390 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png 2c.jpg.exe 76390 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_altform-unplated_contrast-black.png 2c.jpg.exe 76406 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png 2c.jpg.exe 76406 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-100_contrast-white.png 2c.jpg.exe 76406 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png 2c.jpg.exe 76406 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-100_contrast-white.png 2c.jpg.exe 76406 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\Movie-TVStoreLogo.scale-100_contrast-white.png 2c.jpg.exe 76406 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-100_contrast-white.png 2c.jpg.exe 76406 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-100_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png 2c.jpg.exe 76422 File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white.png 2c.jpg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
svchost.exeat description process target process 89609 PID 2224 created 2500 svchost.exe Explorer.EXE 98890 PID 2224 created 3832 svchost.exe explorer.exe -
Program crash
-
Checks system information in the registry (likely anti-VM) 2 TTPs 8 IoCs
Processes:
WerFault.exeexplorer.exeWerFault.exeat description ioc process 97156 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer WerFault.exe 97156 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName WerFault.exe 98172 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer explorer.exe 98172 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName explorer.exe 99312 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer WerFault.exe 99312 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName WerFault.exe 102625 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer WerFault.exe 102625 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName WerFault.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exeat description ioc process 98187 Key created \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Suspicious use of FindShellTrayWindow
-
Suspicious use of SendNotifyMessage
-
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
WerFault.exeat description ioc process 102625 Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe 102625 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe 102625 Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe 102625 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Checks processor information in registry (likely anti-VM) 2 TTPs 2 IoCs
Processes:
WerFault.exeat description ioc process 102625 Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe 102625 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Checks processor name in registry (likely anti-VM) 2 TTPs 1 IoCs
Processes:
WerFault.exeat description ioc process 102625 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2c.jpg.exeat description ioc process 128468 Set value (str) \REGISTRY\USER\S-1-5-21-1582453539-3709319398-2561783890-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\0C2593510C259351.bmp" 2c.jpg.exe -
troldesh family
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2c.jpg.exe"C:\Users\Admin\AppData\Local\Temp\2c.jpg.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1012
-
C:\Users\Admin\AppData\Local\Temp\2c.jpg.exe"C:\Users\Admin\AppData\Local\Temp\2c.jpg.exe"1⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
- Drops Office document
- Drops file in system dir
- Sets desktop wallpaper using registry
PID:3488
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows1⤵PID:4088
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:3704
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵PID:4040
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet1⤵PID:2768
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows1⤵PID:3848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe1⤵
- Suspicious use of WriteProcessMemory
PID:3912
-
C:\Windows\SysWOW64\chcp.comchcp1⤵PID:3868
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:2224
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2500 -s 22641⤵
- Suspicious use of AdjustPrivilegeToken
- Checks system information in the registry (likely anti-VM)
PID:3788
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Checks system information in the registry (likely anti-VM)
- Modifies Installed Components in the registry
PID:3832
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3832 -s 22361⤵
- Suspicious use of AdjustPrivilegeToken
- Checks system information in the registry (likely anti-VM)
- Enumerates system info in registry
- Checks processor information in registry (likely anti-VM)
- Checks processor name in registry (likely anti-VM)
PID:3068
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:980
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:1208
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1060
- T1107
- T1031