Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10 -
submitted
29-07-2020 07:22
Static task
static1
Behavioral task
behavioral1
Sample
a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe
Resource
win7
Behavioral task
behavioral2
Sample
a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe
Resource
win10
General
-
Target
a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe
-
Size
464KB
-
MD5
473f6df655eece05943fe06ee7af5b2e
-
SHA1
425a6da02f4c723269b3c17c488fd1296c4138b8
-
SHA256
a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875
-
SHA512
8aad405bdba2b7c0d333638b9df2b5b6fd48a3d0ecd859573557827d5125e2111346bab9039e4fa9bba717d7a654e4cb159254718d9a8ec7f2dee36b58fafa84
Malware Config
Extracted
C:\Users\Admin\Desktop\!HELP_SOS.hta
http://7gie6ffnkrjykggd.we0sgd.com/
http://7gie6ffnkrjykggd.y8lkjg5.net/
http://7gie6ffnkrjykggd.onion/login/AQclfCePjfWiRnCcdRw1uTxo5YpPKJli5IX1nnEvyJKFIF2LVmmAsTbA
http://7gie6ffnkrjykggd.onion/login/AQclfCePjfWiRnCcdRw1uTxo5YpPKJli5IX1nnEvyJKFIF2LVmmAsTbA到浏览器的地址栏,然后按下"回车"键;
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000200000001ad22-36.dat js -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3908 vssadmin.exe 1840 vssadmin.exe 3912 vssadmin.exe -
Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-19 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-20 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DDx.bmp" a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe -
Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\sage.notice\shell\open a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\sage.notice\DefaultIcon a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\sage.notice a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\sage.notice\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,47" a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\sage.notice\shell\open\command a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\htafile a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\sage.notice\FriendlyTypeName\ = "encrypted by SAGE" a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\htafile\DefaultIcon a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\htafile\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,44" a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\.sage\ = "sage.notice" a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\sage.notice\FriendlyTypeName a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\sage.notice\shell a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\"" a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe -
Suspicious use of FindShellTrayWindow 14 IoCs
pid Process 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 3960 Rj3fNWF3.exe 2568 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 840 Rj3fNWF3.exe 1056 Rj3fNWF3.exe 1300 Rj3fNWF3.exe 1604 Rj3fNWF3.exe 2668 Rj3fNWF3.exe 3956 Rj3fNWF3.exe 2020 Rj3fNWF3.exe 2132 Rj3fNWF3.exe 3800 Rj3fNWF3.exe 3676 Rj3fNWF3.exe -
Deletes itself 1 IoCs
pid Process 748 WScript.exe -
Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 3960 Rj3fNWF3.exe 3960 Rj3fNWF3.exe 2568 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 2568 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 840 Rj3fNWF3.exe 840 Rj3fNWF3.exe 1056 Rj3fNWF3.exe 1056 Rj3fNWF3.exe 1300 Rj3fNWF3.exe 1300 Rj3fNWF3.exe 1604 Rj3fNWF3.exe 1604 Rj3fNWF3.exe 2668 Rj3fNWF3.exe 2668 Rj3fNWF3.exe 3956 Rj3fNWF3.exe 3956 Rj3fNWF3.exe 2020 Rj3fNWF3.exe 2020 Rj3fNWF3.exe 2132 Rj3fNWF3.exe 2132 Rj3fNWF3.exe 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 3800 Rj3fNWF3.exe 3800 Rj3fNWF3.exe 3676 Rj3fNWF3.exe 3676 Rj3fNWF3.exe -
Executes dropped EXE 11 IoCs
pid Process 3960 Rj3fNWF3.exe 840 Rj3fNWF3.exe 1056 Rj3fNWF3.exe 1300 Rj3fNWF3.exe 1604 Rj3fNWF3.exe 2668 Rj3fNWF3.exe 3956 Rj3fNWF3.exe 2020 Rj3fNWF3.exe 2132 Rj3fNWF3.exe 3800 Rj3fNWF3.exe 3676 Rj3fNWF3.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 416 schtasks.exe 3800 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: 0 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Token: 0 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Token: 0 3960 Rj3fNWF3.exe Token: 0 2568 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe Token: 0 840 Rj3fNWF3.exe Token: 0 1056 Rj3fNWF3.exe Token: 0 1300 Rj3fNWF3.exe Token: 0 1604 Rj3fNWF3.exe Token: 0 2668 Rj3fNWF3.exe Token: 0 3956 Rj3fNWF3.exe Token: 0 2020 Rj3fNWF3.exe Token: 0 2132 Rj3fNWF3.exe Token: SeBackupPrivilege 2732 vssvc.exe Token: SeRestorePrivilege 2732 vssvc.exe Token: SeAuditPrivilege 2732 vssvc.exe Token: 0 3800 Rj3fNWF3.exe Token: 0 3676 Rj3fNWF3.exe -
Suspicious use of WriteProcessMemory 69 IoCs
description pid Process procid_target PID 4040 wrote to memory of 3844 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 67 PID 4040 wrote to memory of 3844 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 67 PID 4040 wrote to memory of 3844 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 67 PID 4040 wrote to memory of 3800 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 68 PID 4040 wrote to memory of 3800 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 68 PID 4040 wrote to memory of 3800 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 68 PID 4040 wrote to memory of 3960 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 70 PID 4040 wrote to memory of 3960 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 70 PID 4040 wrote to memory of 3960 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 70 PID 4040 wrote to memory of 748 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 71 PID 4040 wrote to memory of 748 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 71 PID 4040 wrote to memory of 748 4040 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 71 PID 3844 wrote to memory of 2568 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 72 PID 3844 wrote to memory of 2568 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 72 PID 3844 wrote to memory of 2568 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 72 PID 3844 wrote to memory of 416 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 73 PID 3844 wrote to memory of 416 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 73 PID 3844 wrote to memory of 416 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 73 PID 3960 wrote to memory of 840 3960 Rj3fNWF3.exe 75 PID 3960 wrote to memory of 840 3960 Rj3fNWF3.exe 75 PID 3960 wrote to memory of 840 3960 Rj3fNWF3.exe 75 PID 840 wrote to memory of 1056 840 Rj3fNWF3.exe 76 PID 840 wrote to memory of 1056 840 Rj3fNWF3.exe 76 PID 840 wrote to memory of 1056 840 Rj3fNWF3.exe 76 PID 1056 wrote to memory of 1300 1056 Rj3fNWF3.exe 77 PID 1056 wrote to memory of 1300 1056 Rj3fNWF3.exe 77 PID 1056 wrote to memory of 1300 1056 Rj3fNWF3.exe 77 PID 1300 wrote to memory of 1604 1300 Rj3fNWF3.exe 78 PID 1300 wrote to memory of 1604 1300 Rj3fNWF3.exe 78 PID 1300 wrote to memory of 1604 1300 Rj3fNWF3.exe 78 PID 1604 wrote to memory of 2668 1604 Rj3fNWF3.exe 79 PID 1604 wrote to memory of 2668 1604 Rj3fNWF3.exe 79 PID 1604 wrote to memory of 2668 1604 Rj3fNWF3.exe 79 PID 2668 wrote to memory of 3956 2668 Rj3fNWF3.exe 80 PID 2668 wrote to memory of 3956 2668 Rj3fNWF3.exe 80 PID 2668 wrote to memory of 3956 2668 Rj3fNWF3.exe 80 PID 3956 wrote to memory of 2020 3956 Rj3fNWF3.exe 81 PID 3956 wrote to memory of 2020 3956 Rj3fNWF3.exe 81 PID 3956 wrote to memory of 2020 3956 Rj3fNWF3.exe 81 PID 2020 wrote to memory of 2132 2020 Rj3fNWF3.exe 82 PID 2020 wrote to memory of 2132 2020 Rj3fNWF3.exe 82 PID 2020 wrote to memory of 2132 2020 Rj3fNWF3.exe 82 PID 3844 wrote to memory of 3908 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 83 PID 3844 wrote to memory of 3908 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 83 PID 3844 wrote to memory of 3908 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 83 PID 3844 wrote to memory of 1840 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 86 PID 3844 wrote to memory of 1840 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 86 PID 3844 wrote to memory of 1840 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 86 PID 2132 wrote to memory of 3800 2132 Rj3fNWF3.exe 88 PID 2132 wrote to memory of 3800 2132 Rj3fNWF3.exe 88 PID 2132 wrote to memory of 3800 2132 Rj3fNWF3.exe 88 PID 3844 wrote to memory of 3912 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 89 PID 3844 wrote to memory of 3912 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 89 PID 3844 wrote to memory of 3912 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 89 PID 3844 wrote to memory of 644 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 91 PID 3844 wrote to memory of 644 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 91 PID 3844 wrote to memory of 644 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 91 PID 3844 wrote to memory of 1412 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 93 PID 3844 wrote to memory of 1412 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 93 PID 3844 wrote to memory of 1412 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 93 PID 3844 wrote to memory of 1212 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 94 PID 3844 wrote to memory of 1212 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 94 PID 3844 wrote to memory of 1212 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 94 PID 3800 wrote to memory of 3676 3800 Rj3fNWF3.exe 96 PID 3800 wrote to memory of 3676 3800 Rj3fNWF3.exe 96 PID 3800 wrote to memory of 3676 3800 Rj3fNWF3.exe 96 PID 3844 wrote to memory of 2044 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 97 PID 3844 wrote to memory of 2044 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 97 PID 3844 wrote to memory of 2044 3844 a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe 97 -
Modifies extensions of user files 24 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SwitchRequest.raw... => C:\Users\Admin\Pictures\SwitchRequest.raw.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File opened for modification C:\Users\Admin\Pictures\MountEnter.tiff a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File renamed C:\Users\Admin\Pictures\RenameConfirm.raw... => C:\Users\Admin\Pictures\RenameConfirm.raw.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File created C:\Users\Admin\Pictures\SwitchRequest.raw... a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File created C:\Users\Admin\Pictures\WaitAssert.tif... a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File created C:\Users\Admin\Pictures\DisconnectWrite.tiff... a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File renamed C:\Users\Admin\Pictures\ResetImport.png... => C:\Users\Admin\Pictures\ResetImport.png.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File created C:\Users\Admin\Pictures\ConvertFromUninstall.png... a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File renamed C:\Users\Admin\Pictures\ConvertFromUninstall.png... => C:\Users\Admin\Pictures\ConvertFromUninstall.png.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File created C:\Users\Admin\Pictures\RenameConfirm.raw... a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File renamed C:\Users\Admin\Pictures\DismountJoin.raw... => C:\Users\Admin\Pictures\DismountJoin.raw.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File renamed C:\Users\Admin\Pictures\MountEnter.tiff... => C:\Users\Admin\Pictures\MountEnter.tiff.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File renamed C:\Users\Admin\Pictures\DisconnectWrite.tiff... => C:\Users\Admin\Pictures\DisconnectWrite.tiff.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File created C:\Users\Admin\Pictures\ResetImport.png... a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File created C:\Users\Admin\Pictures\FormatPop.png... a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File renamed C:\Users\Admin\Pictures\FormatPop.png... => C:\Users\Admin\Pictures\FormatPop.png.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File renamed C:\Users\Admin\Pictures\OptimizeBlock.tif... => C:\Users\Admin\Pictures\OptimizeBlock.tif.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File created C:\Users\Admin\Pictures\MountEnter.tiff... a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File created C:\Users\Admin\Pictures\DismountJoin.raw... a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File created C:\Users\Admin\Pictures\OptimizeBlock.tif... a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File renamed C:\Users\Admin\Pictures\WaitAssert.tif... => C:\Users\Admin\Pictures\WaitAssert.tif.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File opened for modification C:\Users\Admin\Pictures\DisconnectWrite.tiff a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File created C:\Users\Admin\Pictures\SuspendInstall.raw... a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe File renamed C:\Users\Admin\Pictures\SuspendInstall.raw... => C:\Users\Admin\Pictures\SuspendInstall.raw.sage a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe"C:\Users\Admin\AppData\Local\Temp\a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe"1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe"C:\Users\Admin\AppData\Local\Temp\a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe" g2⤵
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Modifies extensions of user files
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe"C:\Users\Admin\AppData\Local\Temp\a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe" g3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Admin\AppData\Local\Temp\a8386d784f0382466e502cb0135ddff8148547a16446b8b4b2d9625b75aaf875.exe" /SC ONLOGON /RL HIGHEST /F3⤵
- Creates scheduled task(s)
PID:416
-
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3908
-
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1840
-
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3912
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵PID:644
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"3⤵PID:1412
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /DELETE /TN /F "N0mFUQoa"3⤵PID:1212
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f16184093.vbs"3⤵PID:2044
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F2⤵
- Creates scheduled task(s)
PID:3800
-
-
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g4⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g5⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g6⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g7⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g8⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g9⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g10⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g11⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g12⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f252888.vbs"2⤵
- Deletes itself
PID:748
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:2732