Analysis
-
max time kernel
67s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe
Resource
win10v20201028
General
-
Target
fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe
-
Size
69KB
-
MD5
fcedea8111abbb61e40fa5ed486fd434
-
SHA1
1d837e6ece7ff326fcbeff7994744f7bd5434d99
-
SHA256
fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913
-
SHA512
7d8383b371c3206624fffd844c1af52f5cb0f3b327b06bbe6f657485ba4e70d6390865fc5febaf60eafd9e63cc41c12d0f4e5e99c07951ce0886916b47f123b1
Malware Config
Extracted
C:\0E5F51-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Microsoft\Network\Downloader\0E5F51-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\0E5F51-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\0E5F51-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\0E5F51-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exedescription ioc process File renamed C:\Users\Admin\Pictures\BlockRevoke.crw => C:\Users\Admin\Pictures\BlockRevoke.crw.0e5f51 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File renamed C:\Users\Admin\Pictures\SuspendProtect.tif => C:\Users\Admin\Pictures\SuspendProtect.tif.0e5f51 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File renamed C:\Users\Admin\Pictures\StartResume.tiff => C:\Users\Admin\Pictures\StartResume.tiff.0e5f51 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File renamed C:\Users\Admin\Pictures\InstallRestart.tiff => C:\Users\Admin\Pictures\InstallRestart.tiff.0e5f51 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File renamed C:\Users\Admin\Pictures\LimitSwitch.raw => C:\Users\Admin\Pictures\LimitSwitch.raw.0e5f51 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File renamed C:\Users\Admin\Pictures\MeasureUpdate.crw => C:\Users\Admin\Pictures\MeasureUpdate.crw.0e5f51 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Users\Admin\Pictures\StartResume.tiff fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File renamed C:\Users\Admin\Pictures\ShowOut.png => C:\Users\Admin\Pictures\ShowOut.png.0e5f51 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File renamed C:\Users\Admin\Pictures\ProtectWrite.png => C:\Users\Admin\Pictures\ProtectWrite.png.0e5f51 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File renamed C:\Users\Admin\Pictures\CompressUndo.png => C:\Users\Admin\Pictures\CompressUndo.png.0e5f51 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File renamed C:\Users\Admin\Pictures\RemoveRegister.raw => C:\Users\Admin\Pictures\RemoveRegister.raw.0e5f51 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File renamed C:\Users\Admin\Pictures\ConnectRestart.crw => C:\Users\Admin\Pictures\ConnectRestart.crw.0e5f51 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Users\Admin\Pictures\InstallRestart.tiff fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 17188 IoCs
Processes:
fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\256x256.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\MessagesXboxLogo.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\0E5F51-Readme.txt fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us_2x.gif fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\0E5F51-Readme.txt fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ui-strings.js fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_DA-DK.respack fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_altform-unplated.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-150_contrast-white.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailWideTile.scale-400.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\0E5F51-Readme.txt fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-24_altform-unplated.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ui-strings.js fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSI.TTF fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-100.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\pl_16x11.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ui-strings.js fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\THMBNAIL.PNG fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\office.odf fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\SmallTile.scale-125.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Workflow\Density_Selected_Hollow.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\SmallTile.scale-100.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-16.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\0E5F51-Readme.txt fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\0E5F51-Readme.txt fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\ui-strings.js fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_pattern_RHP.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\ui-strings.js fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALN.TTF fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\af_get.svg fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\AppStore_icon.svg fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_WorriedEye.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.GRAPH.16.1033.hxn fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\7813_20x20x32.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\hm_16x11.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\156.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-256.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-60.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-400.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.scale-125.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\yes.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\0E5F51-Readme.txt fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\StopwatchMedTile.scale-200.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxAccountsStoreLogo.scale-100.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\selector.js fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\javaws.policy fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\ProductRecognitionSijb27pts.mdl fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\WideTile.scale-100.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\mask\11d.png fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3428 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5284 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 12156 IoCs
Processes:
fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exepid process 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe Token: SeImpersonatePrivilege 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe Token: SeBackupPrivilege 3688 vssvc.exe Token: SeRestorePrivilege 3688 vssvc.exe Token: SeAuditPrivilege 3688 vssvc.exe Token: SeDebugPrivilege 5284 taskkill.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.execmd.exedescription pid process target process PID 4640 wrote to memory of 3428 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe vssadmin.exe PID 4640 wrote to memory of 3428 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe vssadmin.exe PID 4640 wrote to memory of 8560 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe notepad.exe PID 4640 wrote to memory of 8560 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe notepad.exe PID 4640 wrote to memory of 8560 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe notepad.exe PID 4640 wrote to memory of 6920 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe cmd.exe PID 4640 wrote to memory of 6920 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe cmd.exe PID 4640 wrote to memory of 6920 4640 fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe cmd.exe PID 6920 wrote to memory of 5284 6920 cmd.exe taskkill.exe PID 6920 wrote to memory of 5284 6920 cmd.exe taskkill.exe PID 6920 wrote to memory of 5284 6920 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe"C:\Users\Admin\AppData\Local\Temp\fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3428
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\0E5F51-Readme.txt"2⤵PID:8560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2DB8.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:6920 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 46403⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5284
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:3688
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
738eb4f0ed61c9df90615e0cd5688157
SHA19ba3712f53b091c48a1bddcb6765a2f0193a80e5
SHA25607d4eaabc86f078a22d70e27c8ca08fcc557d81fe625a63ed6cc8bd765ee2ae7
SHA5123acee173e72d30009519233d52b83e820a1a8cee484bef46e559690e2c095efd5ca9ae5cabd40d27c02f305e17363b0f3736e3487597e1ad317c76311d699504
-
MD5
5cea5f7dec51a7b9a3e573fda08c49a8
SHA13e53c350af8f22c2dd4849053e0e401f5f2a21d2
SHA2560dca055409a7c524458839b7e5e261f4559118f62f3c167df88a9597952d626b
SHA512dc2b54677a5d765487c04a627c7fbbdaf6579fdf93cb2a45fa19a20511468d6e014b3a72980bfee61a273fd16aa823c1372e016f37fd9d9dc6fff81db0e8f7ea