Analysis
-
max time kernel
130s -
max time network
133s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
06-10-2020 17:21
Static task
static1
Behavioral task
behavioral1
Sample
46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe
Resource
win10v200722
General
-
Target
46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe
-
Size
69KB
-
MD5
ab8d59aba3dc3c4be755255eca51d879
-
SHA1
24d2abc132f1337f3bf2dd582efb00e5ac911161
-
SHA256
46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9
-
SHA512
0b1f3a51d6a3006c39f0a4b6ad861944fa9484920d41d68a00d7e88819a732c8bbee9d90da5c6e2c816b5e7cd13a9a35f6a26c85e29a3c3841f59e5cfab87a1e
Malware Config
Extracted
C:\odt\237C22-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\237C22-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\237C22-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\237C22-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\237C22-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exedescription ioc process File renamed C:\Users\Admin\Pictures\ReadUnpublish.raw => C:\Users\Admin\Pictures\ReadUnpublish.raw.237c22 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Users\Admin\Pictures\SelectEnter.tiff 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File renamed C:\Users\Admin\Pictures\TraceRemove.tiff => C:\Users\Admin\Pictures\TraceRemove.tiff.237c22 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File renamed C:\Users\Admin\Pictures\SelectEnter.tiff => C:\Users\Admin\Pictures\SelectEnter.tiff.237c22 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File renamed C:\Users\Admin\Pictures\UseShow.tif => C:\Users\Admin\Pictures\UseShow.tif.237c22 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File renamed C:\Users\Admin\Pictures\DisableSelect.tif => C:\Users\Admin\Pictures\DisableSelect.tif.237c22 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File renamed C:\Users\Admin\Pictures\CompressOut.crw => C:\Users\Admin\Pictures\CompressOut.crw.237c22 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Users\Admin\Pictures\NewLimit.tiff 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Users\Admin\Pictures\TraceRemove.tiff 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File renamed C:\Users\Admin\Pictures\NewLimit.tiff => C:\Users\Admin\Pictures\NewLimit.tiff.237c22 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File renamed C:\Users\Admin\Pictures\SplitExpand.crw => C:\Users\Admin\Pictures\SplitExpand.crw.237c22 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File renamed C:\Users\Admin\Pictures\RemoveLock.png => C:\Users\Admin\Pictures\RemoveLock.png.237c22 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 17089 IoCs
Processes:
46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme-2x.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\Microsoft.Skype.ImageTool.winmd 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\PSS10R.CHM 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\is_16x11.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\ui-strings.js 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-250.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\rt.jar 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\237C22-Readme.txt 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\AppxManifest.xml 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSmallTile.scale-200.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\mask\12d.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.dualsim1.scale-150.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\chess.3mf 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\MedTile.scale-100.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\237C22-Readme.txt 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-100_contrast-white.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-unplated_contrast-white.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\sb_16x11.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\SmallTile.scale-200_contrast-white.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-60.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-40.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\en-GB.PhoneNumber.SMS.ot 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\LargeTile.scale-125.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_it.jar 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\OneConnectAppList.targetsize-36.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Klondike\Tips_2.jpg 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Effects\outer glow.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\AppStore_icon.svg 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\AppxManifest.xml 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\TimerMedTile.contrast-white_scale-200.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\ui-strings.js 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.tree.dat 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-100.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_RHP.aapp 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\237C22-Readme.txt 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\ui-strings.js 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\acrobat_pdf.svg 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\MedTile.scale-100.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\LargeTile.scale-125.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\mask\1c.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1937_20x20x32.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\SmallTile.scale-200.png 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\237C22-Readme.txt 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1520 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5792 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 20869 IoCs
Processes:
46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exepid process 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe Token: SeImpersonatePrivilege 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe Token: SeBackupPrivilege 2776 vssvc.exe Token: SeRestorePrivilege 2776 vssvc.exe Token: SeAuditPrivilege 2776 vssvc.exe Token: SeDebugPrivilege 5792 taskkill.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.execmd.exedescription pid process target process PID 1380 wrote to memory of 1520 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe vssadmin.exe PID 1380 wrote to memory of 1520 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe vssadmin.exe PID 1380 wrote to memory of 9652 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe notepad.exe PID 1380 wrote to memory of 9652 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe notepad.exe PID 1380 wrote to memory of 9652 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe notepad.exe PID 1380 wrote to memory of 7540 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe cmd.exe PID 1380 wrote to memory of 7540 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe cmd.exe PID 1380 wrote to memory of 7540 1380 46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe cmd.exe PID 7540 wrote to memory of 5792 7540 cmd.exe taskkill.exe PID 7540 wrote to memory of 5792 7540 cmd.exe taskkill.exe PID 7540 wrote to memory of 5792 7540 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe"C:\Users\Admin\AppData\Local\Temp\46dbb7709411b1429233e0d8d33a02cccd54005a2b4015dcfa8a890252177df9.bin.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1520
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\237C22-Readme.txt"2⤵PID:9652
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\8761.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:7540 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 13803⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5792
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:2776
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
542e4021a3b7a0d3051ed41de3ee54a9
SHA17f5b65dea009106350dd691236207ab05c9ad2bf
SHA25696eda1c693049b253f4da567f38dbb566316880f77be9ad80644c9fa264c9b10
SHA512dd9f9acd60b92feae16a31c5d44a700dda0e51b26ffc3ac1110a2e00aab36e2d955a3cbee59828154733e6640591228211f1b594a26579da90b6ec059b558c80
-
MD5
1eae09d0615581d44bf7f50ca001311d
SHA1b6fd6b3d1f777e1f5a7ac4b6749abbcccdac8e60
SHA256e12afa774b6bd39a7e909e1c178382fa8f19ad61fe3f2e1a462fa488e55d5120
SHA512ced3f4a5a33788eb193a9a72a5316bbe06be0a034ab33ae884c88707bb475eb5ebf214bc341c42432f52faf998c675f58cd920f90569e156a6cf8f41fd8638a4