Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-02-2021 00:26
Static task
static1
Behavioral task
behavioral1
Sample
μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe
Resource
win10v20201028
General
-
Target
μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe
-
Size
40KB
-
MD5
5c02cb26de796b4eb98d860530e9b7b5
-
SHA1
30d0c096df1d09eb24b8cfc3663fa1ed7f351f49
-
SHA256
20c4b391c9460dd00fb0907cb6cd67c60b7f87a2761851c360e0a60d984e111a
-
SHA512
c60cbcc4b52674c49d5fbd3fb685427b0ece394c1f4b7bfd9f4c8b913153786c067b39a088205a05b826f49bfc40f56e8eedd83e72d447e94e9ebce84a5fa5b8
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\readme-warning.txt
makop
vassago_0203@tutanota.com
vassago0203@cock.li
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 1660 created 412 1660 svchost.exe μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Processes:
wbadmin.exepid process 4040 wbadmin.exe -
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ConfirmRedo.tiff μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exedescription ioc process File opened (read-only) \??\D: explorer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 64 IoCs
Processes:
μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_fr.jar μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tournament\ScoreTrophy.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-64.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5372_40x40x32.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\readme-warning.txt μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\Builtin\Bin\FullScreenQuad_PS.fxo μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\ui-strings.js μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\mask\11d.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-30.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\ui-strings.js μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\freecell\Guard_Duty_Unearned_small.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_LV-LV.respack μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-100.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache-Light.scale-240.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\rename.svg μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\readme-warning.txt μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7656_40x40x32.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\complete.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache-Light.scale-100.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\WideTile.scale-200.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-150.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\ui-strings.js μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nb-no\ui-strings.js μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-125.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\SmallTile.scale-100.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-125.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\OneConnectMedTile.scale-125.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\readme-warning.txt μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White@3x.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-32_altform-unplated.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ar_get.svg μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\FillnSign_visual.svg μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarLargeTile.scale-150.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\ui-strings.js μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\readme-warning.txt μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\readme-warning.txt μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\IconOpenInCinemagraph.contrast-white_scale-125.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ar_60x42.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014 μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe\AppxSignature.p7x μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteMediumTile.scale-200.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\readme-warning.txt μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PowerPointInterProviderRanker.bin μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\4px.png μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Pyramid\Tips_3.jpg μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4076 1680 WerFault.exe -
Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
explorer.exevds.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
SearchUI.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3464 vssadmin.exe -
Modifies Control Panel 5 IoCs
Processes:
explorer.exeShellExperienceHost.exeSearchUI.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\TranscodedImageCount = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\LastUpdated = "4294967295" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors ShellExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop explorer.exe -
Modifies registry class 30 IoCs
Processes:
explorer.exeSearchUI.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23" SearchUI.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchUI.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e50702004100720067006a006200650078000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000896e8e6c4bffd60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e50702004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000cb87256c4bffd60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e4070a004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000005aa40d5557add60100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e4070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e4070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "132483827320340134" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23" SearchUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance explorer.exe -
Processes:
μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exeWerFault.exepid process 412 μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe 412 μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exevssvc.exewbengine.exeWMIC.exeWerFault.exeexplorer.exedescription pid process Token: SeTcbPrivilege 1660 svchost.exe Token: SeTcbPrivilege 1660 svchost.exe Token: SeBackupPrivilege 3384 vssvc.exe Token: SeRestorePrivilege 3384 vssvc.exe Token: SeAuditPrivilege 3384 vssvc.exe Token: SeBackupPrivilege 2580 wbengine.exe Token: SeRestorePrivilege 2580 wbengine.exe Token: SeSecurityPrivilege 2580 wbengine.exe Token: SeIncreaseQuotaPrivilege 1112 WMIC.exe Token: SeSecurityPrivilege 1112 WMIC.exe Token: SeTakeOwnershipPrivilege 1112 WMIC.exe Token: SeLoadDriverPrivilege 1112 WMIC.exe Token: SeSystemProfilePrivilege 1112 WMIC.exe Token: SeSystemtimePrivilege 1112 WMIC.exe Token: SeProfSingleProcessPrivilege 1112 WMIC.exe Token: SeIncBasePriorityPrivilege 1112 WMIC.exe Token: SeCreatePagefilePrivilege 1112 WMIC.exe Token: SeBackupPrivilege 1112 WMIC.exe Token: SeRestorePrivilege 1112 WMIC.exe Token: SeShutdownPrivilege 1112 WMIC.exe Token: SeDebugPrivilege 1112 WMIC.exe Token: SeSystemEnvironmentPrivilege 1112 WMIC.exe Token: SeRemoteShutdownPrivilege 1112 WMIC.exe Token: SeUndockPrivilege 1112 WMIC.exe Token: SeManageVolumePrivilege 1112 WMIC.exe Token: 33 1112 WMIC.exe Token: 34 1112 WMIC.exe Token: 35 1112 WMIC.exe Token: 36 1112 WMIC.exe Token: SeIncreaseQuotaPrivilege 1112 WMIC.exe Token: SeSecurityPrivilege 1112 WMIC.exe Token: SeTakeOwnershipPrivilege 1112 WMIC.exe Token: SeLoadDriverPrivilege 1112 WMIC.exe Token: SeSystemProfilePrivilege 1112 WMIC.exe Token: SeSystemtimePrivilege 1112 WMIC.exe Token: SeProfSingleProcessPrivilege 1112 WMIC.exe Token: SeIncBasePriorityPrivilege 1112 WMIC.exe Token: SeCreatePagefilePrivilege 1112 WMIC.exe Token: SeBackupPrivilege 1112 WMIC.exe Token: SeRestorePrivilege 1112 WMIC.exe Token: SeShutdownPrivilege 1112 WMIC.exe Token: SeDebugPrivilege 1112 WMIC.exe Token: SeSystemEnvironmentPrivilege 1112 WMIC.exe Token: SeRemoteShutdownPrivilege 1112 WMIC.exe Token: SeUndockPrivilege 1112 WMIC.exe Token: SeManageVolumePrivilege 1112 WMIC.exe Token: 33 1112 WMIC.exe Token: 34 1112 WMIC.exe Token: 35 1112 WMIC.exe Token: 36 1112 WMIC.exe Token: SeDebugPrivilege 4076 WerFault.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
Processes:
explorer.exepid process 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe -
Suspicious use of SendNotifyMessage 23 IoCs
Processes:
explorer.exepid process 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
ShellExperienceHost.exeSearchUI.exepid process 896 ShellExperienceHost.exe 64 SearchUI.exe 896 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
svchost.exeμ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).execmd.exedescription pid process target process PID 1660 wrote to memory of 3984 1660 svchost.exe μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe PID 1660 wrote to memory of 3984 1660 svchost.exe μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe PID 1660 wrote to memory of 3984 1660 svchost.exe μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe PID 1660 wrote to memory of 3984 1660 svchost.exe μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe PID 1660 wrote to memory of 3984 1660 svchost.exe μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe PID 1660 wrote to memory of 3984 1660 svchost.exe μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe PID 1660 wrote to memory of 3984 1660 svchost.exe μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe PID 412 wrote to memory of 3340 412 μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe cmd.exe PID 412 wrote to memory of 3340 412 μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe cmd.exe PID 3340 wrote to memory of 3464 3340 cmd.exe vssadmin.exe PID 3340 wrote to memory of 3464 3340 cmd.exe vssadmin.exe PID 3340 wrote to memory of 4040 3340 cmd.exe wbadmin.exe PID 3340 wrote to memory of 4040 3340 cmd.exe wbadmin.exe PID 3340 wrote to memory of 1112 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 1112 3340 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe"C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe"C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ(κ²½λ ₯μ¬νμ΄λ κ°μ΄ κΈ°μ¬νμμ΅λλ€ μ λΆνλλ¦¬κ² μ΅λλ€).exe" n4122⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1680 -s 26441⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Enumerates system info in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.dbMD5
f79d2318ae10f0308fce117af39d31cd
SHA1f5c183bedbd4f88baa6ba7a6d1236f65eb6efc62
SHA2568c4a92c1498db5e8d2833d1b8cd613087c7deb8c39b6a42e7e52ac5414cc5e9e
SHA512a72b4fac2213c3f89d52b43f9ca33aa8e6df07a5ba18f8597524ebf012cf90f2fdd2dfcc13d964545bbdcbf44b24aa8c3bd987397534aa22f10d40b41a09e606
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.dbMD5
9a3f988726ccc2e20078f2044ac6aa10
SHA1bd188345ce30dfa7759eb77b96b9b3138a16afad
SHA25656d056c3a61d29157a5119364ad1c36d0608325e5e5a5f8d1b3ad6075294b60f
SHA512f028e20041de75f7aef3cc0401f2d1bbebc941cb23225abc0b825b6b5343b40bbe9328c85ca26183b222e3c5f4d46116097317af7e4679d38ac9ec5320b1c9c4
-
C:\Users\Admin\AppData\Local\Temp\WER91A4.tmp.appcompat.txtMD5
7b2de83d510f9f843a6fd57aefa5cf14
SHA1d11956c25021a5263dcb3a5911352522d28ec8b2
SHA2565a46b4292ed627189ff06a006bca935aa9322bad894a2c0b4e9eec6e014e9ae2
SHA512d149515cc2c4c97003853e33e5eb5171bd2e50740a3c7e0c9d380b4c8ef8cba9734f70e99a5cd9b3afe15486c337ff10af404732549a37fbfb68bd2bdd508b09
-
C:\Users\All Users\Microsoft\Windows\WER\Temp\WER8F60.tmp.WERInternalMetadata.xmlMD5
38c1f41cabf09a5476db8e2c23420848
SHA108b9fd5a6e6fd658baa5ea9723a909763dc75317
SHA25678ff571a91e46d45070a3cfcd4ed861a9b9da5667d4f8449bcf6ee887ec84d9f
SHA512ef8f19a4a8d89bfc42da5cc0186333678a960f806fd054e85c5aa7af2c5191cf67eede40beee85910cbf1bcc0b052ce144510820b77d3da1aaebed1eb693563e
-
memory/1112-6-0x0000000000000000-mapping.dmp
-
memory/3340-3-0x0000000000000000-mapping.dmp
-
memory/3464-4-0x0000000000000000-mapping.dmp
-
memory/3984-2-0x0000000000000000-mapping.dmp
-
memory/4040-5-0x0000000000000000-mapping.dmp
-
memory/4076-7-0x0000022F25BA0000-0x0000022F25BA1000-memory.dmpFilesize
4KB
-
memory/4076-8-0x0000022F25BA0000-0x0000022F25BA1000-memory.dmpFilesize
4KB