Analysis
-
max time kernel
69s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe
Resource
win10v20201028
General
-
Target
167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe
-
Size
69KB
-
MD5
9172586c2f870ab76eb0852d1f4dfaea
-
SHA1
69e858f578fb0e7fdfb1d26db52dd6a95f5802ff
-
SHA256
167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49
-
SHA512
a44bfdb4a86bfd9446015f6eaf4103dcf455ce1b56d38b0307251f1bc5187a036e85de2b2b8cd1d959dd6df13675d8fa64c1a8c60b73845d32897a0c4f360ed4
Malware Config
Extracted
C:\C137E9-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\C137E9-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C137E9-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\AppData\Roaming\C137E9-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exedescription ioc process File renamed C:\Users\Admin\Pictures\CloseComplete.crw => C:\Users\Admin\Pictures\CloseComplete.crw.c137e9 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File renamed C:\Users\Admin\Pictures\DisconnectCompress.tif => C:\Users\Admin\Pictures\DisconnectCompress.tif.c137e9 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File renamed C:\Users\Admin\Pictures\AssertShow.tif => C:\Users\Admin\Pictures\AssertShow.tif.c137e9 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File renamed C:\Users\Admin\Pictures\RevokeMove.png => C:\Users\Admin\Pictures\RevokeMove.png.c137e9 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File renamed C:\Users\Admin\Pictures\ExitEnable.raw => C:\Users\Admin\Pictures\ExitEnable.raw.c137e9 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File renamed C:\Users\Admin\Pictures\AddProtect.raw => C:\Users\Admin\Pictures\AddProtect.raw.c137e9 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe -
Drops file in Program Files directory 17185 IoCs
Processes:
167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\ui-strings.js 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSplash.scale-200_contrast-white.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File created C:\Program Files\Microsoft Office\PackageManifests\C137E9-Readme.txt 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-20.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-white_scale-200.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-200.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore\Resources\Assets\RT_Icons_Fresh_16.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\am_get.svg 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\C137E9-Readme.txt 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PeopleSmallTile.scale-125.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-3.jpg 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\C137E9-Readme.txt 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1725_24x24x32.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-24_altform-unplated.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteMediumTile.scale-400.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\ui-strings.js 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-24.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6124_40x40x32.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-72.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\jfluid-server-15.jar 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\ui-strings.js 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.scale-200.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.Views\Images\Smile.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-black_scale-200.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_18.svg 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\se_60x42.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\jfluid-server.jar 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\PREVIEW.GIF 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\_Resources\6.rsrc 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-unplated_contrast-white.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tiles\create-new-theme.jpg 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\acrobat_parcel_generic_32.svg 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_delete_18.svg 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8268_48x48x32.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\C137E9-Readme.txt 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ui-strings.js 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\AppStore_icon.svg 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\Assets\Images\Tiles\SplashScreen.scale-200.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\DailyChallenges\tile6.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-400.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Audio\slide_in.wav 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\freecell\On_Parole_.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-125.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Dark.scale-300.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\C137E9-Readme.txt 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\C137E9-Readme.txt 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\ui-strings.js 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\animations\OneNoteFRE_ClipAndAdd_RTL_Tablet.mp4 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\en-US.Calendar.ot 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\common\First_One’s_Free_.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\sx_16x11.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsBadge.contrast-black_scale-200.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\lobby_deck_style_aquarium.png 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3408 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2184 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 14874 IoCs
Processes:
167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exepid process 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe Token: SeImpersonatePrivilege 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe Token: SeBackupPrivilege 416 vssvc.exe Token: SeRestorePrivilege 416 vssvc.exe Token: SeAuditPrivilege 416 vssvc.exe Token: SeDebugPrivilege 2184 taskkill.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.execmd.exedescription pid process target process PID 4768 wrote to memory of 3408 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe vssadmin.exe PID 4768 wrote to memory of 3408 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe vssadmin.exe PID 4768 wrote to memory of 5360 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe notepad.exe PID 4768 wrote to memory of 5360 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe notepad.exe PID 4768 wrote to memory of 5360 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe notepad.exe PID 4768 wrote to memory of 9972 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe cmd.exe PID 4768 wrote to memory of 9972 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe cmd.exe PID 4768 wrote to memory of 9972 4768 167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe cmd.exe PID 9972 wrote to memory of 2184 9972 cmd.exe taskkill.exe PID 9972 wrote to memory of 2184 9972 cmd.exe taskkill.exe PID 9972 wrote to memory of 2184 9972 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe"C:\Users\Admin\AppData\Local\Temp\167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49.bin.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\C137E9-Readme.txt"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5593.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 47683⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5593.tmp.batMD5
65200c5ea91f677dd6e93bdbd1aee17c
SHA1ba175a8c3187f4988b1624f9ea2c60d5b8a2d588
SHA2561b410237e34b63c736738f2886178e94620d72a5bb13b7ca1a7973f2e9ae2b44
SHA512b7648b1a119ed96ee7586bc60469df1fd196726febec777e9aa258db3374c53c1fc95492e2a92aba50fd4e473ed7f880a5d7b8bc8c4b3f55648e0b27a8852e90
-
C:\Users\Admin\Desktop\C137E9-Readme.txtMD5
0ab55b8181d3f7c4097f4db47fb1f082
SHA1a62c4990ca8075204720e228aedf3d70e0583c5f
SHA2566d6abe91fdd312b1c07abf86c87919ac41e81ff01a97870393181f1544603130
SHA512362579f36a02f1b6f293c2d9bab1ec8204b1f95520cb45fa1ade7760eee5b90dc0b4b113adcd24dd3834ccc503becf129308325dff084e5f4561fb6fb59a847f
-
memory/2184-4-0x0000000000000000-mapping.dmp
-
memory/3408-0-0x0000000000000000-mapping.dmp
-
memory/5360-1-0x0000000000000000-mapping.dmp
-
memory/9972-2-0x0000000000000000-mapping.dmp