Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe
Resource
win10v20201028
General
-
Target
4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe
-
Size
69KB
-
MD5
729928e6fd6adafdd0a7fe876701bd7e
-
SHA1
0aa73a466c599b0b2c6e60f0aa0676b9bf6741c7
-
SHA256
4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf
-
SHA512
ebb5b53b5f4b6a3fcf7b7b19b4b7f657f0a03268223d6fd1209e2e4b9d837a8aa3a8ce79ab64a2a843c120cec366d4191f1e0452529d8360ed0ee06c0c75445e
Malware Config
Extracted
C:\6867E7-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\Downloads\6867E7-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\Documents\6867E7-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\6867E7-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Microsoft Office\root\Office16\1033\6867E7-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exedescription ioc process File renamed C:\Users\Admin\Pictures\DisableCheckpoint.raw => C:\Users\Admin\Pictures\DisableCheckpoint.raw.6867e7 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File renamed C:\Users\Admin\Pictures\CompareEnter.raw => C:\Users\Admin\Pictures\CompareEnter.raw.6867e7 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File renamed C:\Users\Admin\Pictures\OptimizeOut.crw => C:\Users\Admin\Pictures\OptimizeOut.crw.6867e7 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File renamed C:\Users\Admin\Pictures\FormatWait.png => C:\Users\Admin\Pictures\FormatWait.png.6867e7 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File renamed C:\Users\Admin\Pictures\HideCompare.tif => C:\Users\Admin\Pictures\HideCompare.tif.6867e7 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File renamed C:\Users\Admin\Pictures\UnpublishExpand.crw => C:\Users\Admin\Pictures\UnpublishExpand.crw.6867e7 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File renamed C:\Users\Admin\Pictures\SkipResume.png => C:\Users\Admin\Pictures\SkipResume.png.6867e7 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File renamed C:\Users\Admin\Pictures\CompleteRegister.crw => C:\Users\Admin\Pictures\CompleteRegister.crw.6867e7 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 17198 IoCs
Processes:
4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\SmallLogo.scale-125.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\6867E7-Readme.txt 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-150_contrast-black.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsStoreLogo.scale-200.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\selector.js 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_CS-CZ.respack 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\8201_40x40x32.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\6867E7-Readme.txt 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\ui-strings.js 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-hover_32.svg 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-150.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Gamerpics.winmd 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-100.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\ui-strings.js 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\ui-strings.js 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\SmallTile.scale-125.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\TimerSmallTile.scale-200.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef.css 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_CopyDrop32x32.gif 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8576_24x24x32.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Icons\klondike_icon.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\mk_16x11.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-64.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\video.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\tg_16x11.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\SmallTile.scale-100.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\mask\12c.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\mask\12c.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\hide_icon.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailBadge.scale-125.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_altform-unplated.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\diamond_Badge_Earned.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkClientCP 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ro_60x42.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-150.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_radio_unselected_18.svg 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-200_contrast-black.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\ui-strings.js 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ng_16x11.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ui-strings.js 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-60_contrast-black.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyResume.dotx 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6701_20x20x32.png 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\ui-strings.js 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\6867E7-Readme.txt 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2700 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 7720 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 19948 IoCs
Processes:
4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exepid process 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe Token: SeImpersonatePrivilege 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe Token: SeBackupPrivilege 3328 vssvc.exe Token: SeRestorePrivilege 3328 vssvc.exe Token: SeAuditPrivilege 3328 vssvc.exe Token: SeDebugPrivilege 7720 taskkill.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.execmd.exedescription pid process target process PID 1148 wrote to memory of 2700 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe vssadmin.exe PID 1148 wrote to memory of 2700 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe vssadmin.exe PID 1148 wrote to memory of 6344 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe notepad.exe PID 1148 wrote to memory of 6344 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe notepad.exe PID 1148 wrote to memory of 6344 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe notepad.exe PID 1148 wrote to memory of 4304 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe cmd.exe PID 1148 wrote to memory of 4304 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe cmd.exe PID 1148 wrote to memory of 4304 1148 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe cmd.exe PID 4304 wrote to memory of 7720 4304 cmd.exe taskkill.exe PID 4304 wrote to memory of 7720 4304 cmd.exe taskkill.exe PID 4304 wrote to memory of 7720 4304 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe"C:\Users\Admin\AppData\Local\Temp\4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\6867E7-Readme.txt"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ADC5.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 11483⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ADC5.tmp.batMD5
8ac042d0870147c4d3b131f37288e804
SHA11c70c618513408280d3132da5fd6eacb26bd9f3a
SHA25660dce66b6f513cc0eae15d45ce29bd8c7143a182db9e6b0da8111fd7266e3738
SHA512b4126a3efec333fc9e12e29378e350caa0a0413c54b380b28213f03b2dbdd37adeb96b61818c22161d3a9154d2638f49edbd572f561e9a72cb72617074ba4ad4
-
C:\Users\Admin\Desktop\6867E7-Readme.txtMD5
8f0d40b92f3f8c4c4b1215f8e97480fa
SHA1f46a031649a6a56e63835a1b05c04cc3bf8e1ed9
SHA256cfa15a16641e699409df750a18122b8472faf52c0cc4e190ef55a9ef6c3c3fe2
SHA5128dcb216524ca43de1ef33070f857c7d1df3c16af219b05f46bf715f6725c65e1caa3384e5e39ef6996138a744d2c25908842dff80c577a194f17a99707423a27
-
memory/2700-0-0x0000000000000000-mapping.dmp
-
memory/4304-2-0x0000000000000000-mapping.dmp
-
memory/6344-1-0x0000000000000000-mapping.dmp
-
memory/7720-4-0x0000000000000000-mapping.dmp