Analysis
-
max time kernel
154s -
max time network
124s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe
Resource
win10v20201028
General
-
Target
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe
-
Size
69KB
-
MD5
18c32583a6fe320b4dc66a251be45e64
-
SHA1
c3d0c0568fa08b94172d88fc0c0795cf7da31b60
-
SHA256
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98
-
SHA512
3faaed3f4aeda3f04a9325e20e9df5e907239c9329913d688009f008763b6960956df87d84c5cc809e2c9cbcbc9da12e6b0f6745c69e3ade3e0ad2ff0f747c1c
Malware Config
Extracted
C:\Users\Public\Libraries\38D35F-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\38D35F-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\38D35F-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\38D35F-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exedescription ioc process File renamed C:\Users\Admin\Pictures\SetDisable.crw => C:\Users\Admin\Pictures\SetDisable.crw.38d35f 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Users\Admin\Pictures\SyncComplete.tiff 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Users\Admin\Pictures\UnregisterUse.tiff 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File renamed C:\Users\Admin\Pictures\DenyGet.png => C:\Users\Admin\Pictures\DenyGet.png.38d35f 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File renamed C:\Users\Admin\Pictures\UnregisterUse.tiff => C:\Users\Admin\Pictures\UnregisterUse.tiff.38d35f 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File renamed C:\Users\Admin\Pictures\SyncCheckpoint.raw => C:\Users\Admin\Pictures\SyncCheckpoint.raw.38d35f 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File renamed C:\Users\Admin\Pictures\NewConnect.crw => C:\Users\Admin\Pictures\NewConnect.crw.38d35f 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File renamed C:\Users\Admin\Pictures\SyncComplete.tiff => C:\Users\Admin\Pictures\SyncComplete.tiff.38d35f 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 13785 IoCs
Processes:
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-100_contrast-black.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster.jpg 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag@4x.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\38D35F-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\hn_16x11.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-sl\ui-strings.js 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\38D35F-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-80_altform-unplated.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Icons\pyramid_icon.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\rs_60x42.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\resources.pri 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\fonts\symbol.ttf 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\38D35F-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\jawt_md.h 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-16_altform-unplated.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Fable\fable_1h.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\bg3.jpg 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\VisualElements\SmallLogo.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\SmallTile.scale-100.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.scale-150.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\TextureBitmaps\pitissue.jpg 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\ui-strings.js 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-30_altform-unplated.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\38D35F-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30_altform-unplated.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\38D35F-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\YellowAbstractNote.scale-200.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\cat.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageLargeTile.scale-100.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover_2x.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-16_altform-unplated.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\SmallTile.scale-200.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-unplated_contrast-black.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\38D35F-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1938_36x36x32.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\cw_60x42.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\music_empty_state_lifestyle.jpg 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\LargeTile.scale-100.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\ui-strings.js 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\powerview.x-none.msi.16.x-none.vreg.dat 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\ui-strings.js 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\bo_60x42.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\38D35F-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-200.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\Icon.targetsize-256.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main-selector.css 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\ui-strings.js 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\38D35F-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7260_20x20x32.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-32_altform-unplated_contrast-white.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\8.jpg 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\38D35F-Readme.txt 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\submission_history.gif 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ao_60x42.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-125.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-150.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\download-btn.png 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3520 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 45690 IoCs
Processes:
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exepid process 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exevssvc.exedescription pid process Token: SeDebugPrivilege 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe Token: SeImpersonatePrivilege 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe Token: SeBackupPrivilege 204 vssvc.exe Token: SeRestorePrivilege 204 vssvc.exe Token: SeAuditPrivilege 204 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exedescription pid process target process PID 576 wrote to memory of 3520 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe vssadmin.exe PID 576 wrote to memory of 3520 576 162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe"C:\Users\Admin\AppData\Local\Temp\162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3520-0-0x0000000000000000-mapping.dmp