shell.bin.zip

General
Target

shell.bin.exe

Filesize

403KB

Completed

20-10-2020 18:26

Score
8 /10
MD5

4c64b7afcf85249f09da741c700eabb1

SHA1

18286de90456e26005c346430d1891522a8b985b

SHA256

644704ae267daa0f81613569ade954ad2c308031d55e9480501a6afc1ccea83f

Malware Config
Signatures 6

Filter: none

Collection
Credential Access
  • Modifies extensions of user files
    shell.bin.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File renamedC:\Users\Admin\Pictures\FindRead.crw.bak.32aa => C:\Users\Admin\Pictures\FindRead.crw.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\RevokeFormat.tif.bak.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\RemoveUnregister.tiffshell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\EnterAdd.tif.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\MoveUnprotect.png.bak.32aa => C:\Users\Admin\Pictures\MoveUnprotect.png.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\NewSkip.png.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\DenyEnable.png => C:\Users\Admin\Pictures\DenyEnable.png.bak.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\EnterAdd.tif.bak.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\RequestUnprotect.tif.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\RemoveUnregister.tiff.bak.32aa => C:\Users\Admin\Pictures\RemoveUnregister.tiff.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\MoveUnprotect.png.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\RemoveUnregister.tiff => C:\Users\Admin\Pictures\RemoveUnregister.tiff.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\NewSkip.png.bak.32aa => C:\Users\Admin\Pictures\NewSkip.png.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\RemoveComplete.raw.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\SyncSwitch.raw => C:\Users\Admin\Pictures\SyncSwitch.raw.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\SyncSwitch.raw.bak.32aa => C:\Users\Admin\Pictures\SyncSwitch.raw.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\FindRead.crw.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\RequestUnprotect.tif => C:\Users\Admin\Pictures\RequestUnprotect.tif.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\RevokeFormat.tif => C:\Users\Admin\Pictures\RevokeFormat.tif.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\RevokeFormat.tif.bak.32aa => C:\Users\Admin\Pictures\RevokeFormat.tif.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\ExitUnlock.png.bak.32aa => C:\Users\Admin\Pictures\ExitUnlock.png.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\ExitUnlock.png.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\NewSkip.png => C:\Users\Admin\Pictures\NewSkip.png.bak.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\NewSkip.png.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\FindRead.crw => C:\Users\Admin\Pictures\FindRead.crw.bak.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\FindRead.crw.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\RevokeFormat.tif.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\SyncSwitch.raw.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\RemoveUnregister.tiff.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\DenyEnable.png.bak.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\ExitUnlock.png.bak.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\RequestUnprotect.tif.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\RemoveComplete.raw => C:\Users\Admin\Pictures\RemoveComplete.raw.bak.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\RemoveComplete.raw.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\MoveUnprotect.png.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\RemoveComplete.raw.bak.32aa => C:\Users\Admin\Pictures\RemoveComplete.raw.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\DenyEnable.png.bak.32aa => C:\Users\Admin\Pictures\DenyEnable.png.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\EnterAdd.tif => C:\Users\Admin\Pictures\EnterAdd.tif.bak.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\SyncSwitch.raw.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\MoveUnprotect.png => C:\Users\Admin\Pictures\MoveUnprotect.png.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\ExitUnlock.png => C:\Users\Admin\Pictures\ExitUnlock.png.bak.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\EnterAdd.tif.bak.32aa => C:\Users\Admin\Pictures\EnterAdd.tif.32aashell.bin.exe
    File renamedC:\Users\Admin\Pictures\RequestUnprotect.tif.bak.32aa => C:\Users\Admin\Pictures\RequestUnprotect.tif.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\RemoveUnregister.tiff.bak.32aashell.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\DenyEnable.png.32aashell.bin.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Suspicious use of SetThreadContext
    shell.bin.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 280 set thread context of 1608280shell.bin.exeshell.bin.exe
  • Drops file in Program Files directory
    shell.bin.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files\Microsoft Office\Templates\1033\Access\Part\2 Top.accdtshell.bin.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\Setup.xml.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287020.WMF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01777_.WMF.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.propertiesshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\Schema\com.jrockit.mc.rjmx.syntheticattribute.exsdshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTVIEW.JPG.32aashell.bin.exe
    File opened for modificationC:\Program Files\7-Zip\Lang\sv.txtshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_09.MID.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00232_.WMFshell.bin.exe
    File opened for modificationC:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sigshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bayshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\1033\PUBSPAPR\PDIR2F.GIF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\1033\EXCEL.DEV_COL.HXT.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\PUBWIZ\DGWEBPQT.XML.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099155.JPG.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239611.WMF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmpshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Viennashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\Cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0shell.bin.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\zi\Asia\Dhakashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02738U.BMP.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Media\OFFICE14\BULLETS\BD21294_.GIF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239975.WMF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Media\CAGCAT10\J0291984.WMFshell.bin.exe
    File opened for modificationC:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txtshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\Certificates\groove.net\SERVERS\Management.cershell.bin.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNGshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\1033\PUBFTSCM\SCHEME45.CSS.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\1033\PUBSPAPR\ZPDIR34F.GIF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\ToolBMPs\MessageHistoryIconImagesMask.bmp.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152430.WMFshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermudashell.bin.exe
    File opened for modificationC:\Program Files\Mozilla Firefox\plugin-container.exe.sig.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198226.WMF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00735_.WMF.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB02229_.GIFshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\1033\MSPUB.DEV_K_COL.HXK.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\1033\PUBFTSCM\SCHEME48.CSS.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02522_.WMF.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.htmlshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.htmlshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\Modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.32aashell.bin.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Media\OFFICE14\AUTOSHAP\BD18224_.WMFshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00234_.WMFshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00487_.WMF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_hov.pngshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\Modules\com-sun-tools-visualvm-profiling.jarshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02261_.WMF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\ToolIcons\SpaceSelector.ico.32aashell.bin.exe
    File opened for modificationC:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\images\hint_down.pngshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02116_.WMFshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185818.WMFshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\PUBWIZ\LABEL.XMLshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftxshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01931J.JPG.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\Modules\locale\org-openide-windows_zh_CN.jar.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\jsse.jarshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Media\OFFICE14\LINES\BD14883_.GIF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239063.WMF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htmshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\BORDERS\MSART7.BDR.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02407_.WMFshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jarshell.bin.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.htmlshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00095_.WMFshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Media\OFFICE14\LINES\BD21326_.GIF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00555_.WMF.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jarshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\Modules\locale\com-sun-tools-visualvm-charts_ja.jarshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\1033\PUBSPAPR\PDIR15F.GIF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\1033\PUBSPAPR\ZPDIR46F.GIF.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\zi\Indian\Chagos.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0240291.WMF.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099200.GIF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\Modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\ToolBMPs\TaskbarIconImagesMask256Colors.bmpshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\Sounds\People\COUGH.WAV.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Media\OFFICE14\LINES\J0115856.GIF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\PREVIEW.GIF.32aashell.bin.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.pngshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Princeshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0212953.WMFshell.bin.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\RIPPLE.INF.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\7-Zip\Lang\si.txt.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\lua\intf\Modules\httprequests.luacshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Media\CAGCAT10\J0199755.WMFshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\ToolData\groove.net\GrooveForms4\rtf_justify.gif.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\TAB_ON.GIFshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\Modules\ext\updater.jar.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\PUBWIZ\DGWEBCAL.XML.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\ToolData\groove.net\GrooveForms3\rtf_italic.gifshell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\Modules\locale\org-netbeans-modules-profiler_zh_CN.jarshell.bin.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\zi\Asia\Macaushell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\PUBWIZ\FOLDPROJ.XML.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.32aashell.bin.exe
    File opened for modificationC:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.pngshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02368_.WMF.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\PUBWIZ\SIGN.DPV.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Document Themes 14\Paper.thmx.32aashell.bin.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\Modules\locale\org-netbeans-spi-quicksearch_ja.jar.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Document Themes 14\Opulent.thmxshell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\Groove\ToolBMPs\GRIPMASK.BMP.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382938.JPG.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Black Tie.eftx.32aashell.bin.exe
    File opened for modificationC:\Program Files\Microsoft Office\OFFICE14\PUBBA\MSPUB11.BDR.32aashell.bin.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\THMBNAIL.PNG.bak.32aashell.bin.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.bak.32aashell.bin.exe
  • Suspicious use of AdjustPrivilegeToken
    shell.bin.exeshell.bin.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege280shell.bin.exe
    Token: SeDebugPrivilege1608shell.bin.exe
    Token: SeDebugPrivilege1608shell.bin.exe
    Token: SeDebugPrivilege1608shell.bin.exe
  • Suspicious use of WriteProcessMemory
    shell.bin.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 280 wrote to memory of 1608280shell.bin.exeshell.bin.exe
    PID 280 wrote to memory of 1608280shell.bin.exeshell.bin.exe
    PID 280 wrote to memory of 1608280shell.bin.exeshell.bin.exe
    PID 280 wrote to memory of 1608280shell.bin.exeshell.bin.exe
    PID 280 wrote to memory of 1608280shell.bin.exeshell.bin.exe
Processes
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/1608-0-0x00000000004014E0-mapping.dmp

                        Download