Analysis
-
max time kernel
67s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe
Resource
win10v20201028
General
-
Target
3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe
-
Size
69KB
-
MD5
6a64553da499c1d9a64d97f4de3882f5
-
SHA1
6d35e6ae28e9e28ea650cfefd70eff1eaa15296b
-
SHA256
3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e
-
SHA512
11ee2422f2199e6cf0d9e7eb0dc92c20d17557877e42b632bd300281886f72564d92878d04f932e883eacb138496d0316e471c3858099a5e823109beb41bbe02
Malware Config
Extracted
C:\8D6E30-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\8D6E30-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\8D6E30-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Microsoft Office\root\Office16\BORDERS\8D6E30-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\8D6E30-Readme.txt
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\AssertUndo.tiff 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File renamed C:\Users\Admin\Pictures\AssertRename.raw => C:\Users\Admin\Pictures\AssertRename.raw.8d6e30 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File renamed C:\Users\Admin\Pictures\AssertUndo.tiff => C:\Users\Admin\Pictures\AssertUndo.tiff.8d6e30 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Users\Admin\Pictures\CheckpointImport.tiff 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File renamed C:\Users\Admin\Pictures\CheckpointImport.tiff => C:\Users\Admin\Pictures\CheckpointImport.tiff.8d6e30 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File renamed C:\Users\Admin\Pictures\ProtectRepair.png => C:\Users\Admin\Pictures\ProtectRepair.png.8d6e30 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File renamed C:\Users\Admin\Pictures\ResetPop.crw => C:\Users\Admin\Pictures\ResetPop.crw.8d6e30 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe -
Drops file in Program Files directory 17169 IoCs
Processes:
3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-125.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\8D6E30-Readme.txt 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80_altform-unplated_contrast-black.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-100.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.tree.dat 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\WideTile.scale-100.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Themes\western.jpg 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\XMLOffKeys\Keys_OffVer365.xml 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ck_60x42.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\ml.pak 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\trusted.libraries 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Livetiles\MicrosoftSolitaireWideTile.scale-125.jpg 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-30_altform-unplated.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64_altform-unplated.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ne_16x11.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\ui-strings.js 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\8D6E30-Readme.txt 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\RedoGrant.htm 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-125.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileSmallSquare.scale-200.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_contrast-white.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_checkbox_unselected_18.svg 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSmallTile.scale-200.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\29.jpg 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\af_16x11.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-150.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\8D6E30-Readme.txt 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\ui-strings.js 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\ui-strings.js 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\ui-strings.js 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-100.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-150.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailBadge.scale-200.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\OneConnectStoreLogo.scale-125.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\ui-strings.js 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\TriPeaks\Goal_3.jpg 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\8D6E30-Readme.txt 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-fullcolor.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.dualsim2.wink.small.scale-150.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-unplated_contrast-white.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\CardBacks\CardBack2.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-30.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL104.XML 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSplashScreen.scale-100_contrast-white.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\8D6E30-Readme.txt 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\Audio\incoming_im.wav 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\kb-locked.png 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2964 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4768 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 14617 IoCs
Processes:
3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exepid process 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe Token: SeImpersonatePrivilege 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe Token: SeBackupPrivilege 4028 vssvc.exe Token: SeRestorePrivilege 4028 vssvc.exe Token: SeAuditPrivilege 4028 vssvc.exe Token: SeDebugPrivilege 4768 taskkill.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.execmd.exedescription pid process target process PID 4068 wrote to memory of 2964 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe vssadmin.exe PID 4068 wrote to memory of 2964 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe vssadmin.exe PID 4068 wrote to memory of 7648 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe notepad.exe PID 4068 wrote to memory of 7648 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe notepad.exe PID 4068 wrote to memory of 7648 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe notepad.exe PID 4068 wrote to memory of 8908 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe cmd.exe PID 4068 wrote to memory of 8908 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe cmd.exe PID 4068 wrote to memory of 8908 4068 3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe cmd.exe PID 8908 wrote to memory of 4768 8908 cmd.exe taskkill.exe PID 8908 wrote to memory of 4768 8908 cmd.exe taskkill.exe PID 8908 wrote to memory of 4768 8908 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe"C:\Users\Admin\AppData\Local\Temp\3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e.bin.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2964
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\8D6E30-Readme.txt"2⤵PID:7648
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3394.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:8908 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 40683⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:4028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
a37c663a52320a83415304567705f8de
SHA1998d912523a2fe231d2b848edd62452b32783f33
SHA256364849dc5fdf1ee4356a53111a3358de388094845350432e9cc063a0d1cdc340
SHA51284da40e29f5fdea44ec5c4d1cdb89cd38e0019a8f1b4483fca52e3f65c0901f8980c6fbb829d7ce80cd70badaf2dd8faa0db6442c52abec9c2cba313b6d286f3
-
MD5
39553e7a70dc84efaa33cbfd2ed18a0e
SHA1b71cfd75688e9015dc0fe97d14bccf27f5eb65e2
SHA256894d99a5f4b036907df95a64fe80bcc942d69b1b4b0160d33c71770d05adf1df
SHA512416430ef92ee6da2b7444c3f1eb788f1636dc537850d321cc109c6b2f818a260099b74bfe4c375fd93260d705318f2beeb46c1349f76d88eaea2a64f2a0d4256