Analysis
-
max time kernel
154s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 09:24
Static task
static1
Behavioral task
behavioral1
Sample
d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe
Resource
win10-en-20210920
General
-
Target
d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe
-
Size
1.2MB
-
MD5
1d46afb839b846ede01cb925470f0488
-
SHA1
8cffc99cda16d5d6b5192c62fefae6c0ac89b33d
-
SHA256
d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1
-
SHA512
888862ef478c79823a56af36f303e5a5686ce31bfdcb4e9b630e8bea791f10bf52f22b7fdb24be4b01b6087292467b45ebeb52d4f954b482f24094af14f64f10
Malware Config
Extracted
C:\README1.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README6.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README7.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README8.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README9.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README10.txt
pilotpilot088@gmail.com
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2736 created 3028 2736 WerFault.exe Explorer.EXE -
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs
-
Processes:
resource yara_rule behavioral2/memory/2428-116-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\AppxManifest.xml d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Effects\02.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-256_altform-unplated.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\bt_60x42.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-96_altform-unplated.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\tn_16x11.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\gy_60x42.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\OneConnectAppList.scale-100.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_11s.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5311_40x40x32.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-60_contrast-white.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\emo.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2818_24x24x32.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Icons\pyramid_icon.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.StarClub\Assets\fue_2_1.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\SmallLogo.scale-200.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\WideTile.scale-200.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-150.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\Solve\autosolve_button_press.mobile.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\WideTile.scale-200.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200_contrast-white.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8201_48x48x32.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PeopleSmallTile.scale-100.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-200.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Effects\effects_lobby_leaves.jpg d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.dualsim2.surprise.small.scale-150.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp6.scale-125.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\am_16x11.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\SmallTile.scale-200.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\4665_20x20x32.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\AppxManifest.xml d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\tripeaks\Expedition_Leader_.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-48.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\169.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-16.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\RunningLate.scale-80.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\cz_16x11.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7205_20x20x32.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Audio\Daily_challenge_Coins Hit progress bar.wav d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Pyramid\Tips_2.jpg d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\FreeCell\Goal_6.jpg d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-96.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\premium_ribbon.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\AppxManifest.xml d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-150.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-30.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-white\Icon.targetsize-48.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.sad.small.scale-200.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-40.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page3.jpg d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\tm_60x42.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OneConnectAppList.targetsize-96.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache-Dark.scale-240.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.scale-125.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\EmbossBitmaps\Sun.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\CameraIcon_contrast-white.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-32_altform-unplated.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-30.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsLargeTile.scale-200.png d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe -
Drops file in Windows directory 1 IoCs
Processes:
explorer.exedescription ioc process File created C:\Windows\rescache\_merged\2717123927\1713683155.pri explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1488 3028 WerFault.exe Explorer.EXE 2736 3028 WerFault.exe Explorer.EXE 2816 3964 WerFault.exe explorer.exe -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 2216 vssadmin.exe 2240 vssadmin.exe 3016 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exeWerFault.exeWerFault.exepid process 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe 2816 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
vssvc.exeWerFault.exeexplorer.exeWerFault.exedescription pid process Token: SeBackupPrivilege 500 vssvc.exe Token: SeRestorePrivilege 500 vssvc.exe Token: SeAuditPrivilege 500 vssvc.exe Token: SeDebugPrivilege 1488 WerFault.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeDebugPrivilege 2816 WerFault.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
explorer.exepid process 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
explorer.exepid process 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.execmd.execmd.exedescription pid process target process PID 2428 wrote to memory of 2216 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe vssadmin.exe PID 2428 wrote to memory of 2216 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe vssadmin.exe PID 2428 wrote to memory of 2240 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe vssadmin.exe PID 2428 wrote to memory of 2240 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe vssadmin.exe PID 2428 wrote to memory of 3016 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe vssadmin.exe PID 2428 wrote to memory of 3016 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe vssadmin.exe PID 2428 wrote to memory of 852 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe cmd.exe PID 2428 wrote to memory of 852 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe cmd.exe PID 2428 wrote to memory of 852 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe cmd.exe PID 852 wrote to memory of 3904 852 cmd.exe chcp.com PID 852 wrote to memory of 3904 852 cmd.exe chcp.com PID 852 wrote to memory of 3904 852 cmd.exe chcp.com PID 2428 wrote to memory of 1336 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe cmd.exe PID 2428 wrote to memory of 1336 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe cmd.exe PID 2428 wrote to memory of 1336 2428 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe cmd.exe PID 1336 wrote to memory of 2184 1336 cmd.exe chcp.com PID 1336 wrote to memory of 2184 1336 cmd.exe chcp.com PID 1336 wrote to memory of 2184 1336 cmd.exe chcp.com
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe"C:\Users\Admin\AppData\Local\Temp\d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp4⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3028 -s 31402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3028 -s 54522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3964 -s 20722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WERFEA6.tmp.appcompat.txtMD5
75bf213603796241e0ebd774fd5522a9
SHA19ad754777a3defbff5820833910b12159eaa7961
SHA256b4605e9439971da811740341fe40f7510da68f9d5a24902121712a3bbbdfed46
SHA5122ffe6a26687a3da3fb437bd03a6919236c4d8895744c55ed0e67387dd2ce48874fdd40c60cc3a20fe3dab3ffb2306ff1a9f62b407af7ae54cdf86ddfe66db148
-
memory/852-120-0x0000000000000000-mapping.dmp
-
memory/1336-123-0x0000000000000000-mapping.dmp
-
memory/2184-124-0x0000000000000000-mapping.dmp
-
memory/2216-117-0x0000000000000000-mapping.dmp
-
memory/2240-118-0x0000000000000000-mapping.dmp
-
memory/2428-115-0x0000000000690000-0x00000000007DA000-memory.dmpFilesize
1.3MB
-
memory/2428-116-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/3016-119-0x0000000000000000-mapping.dmp
-
memory/3904-121-0x0000000000000000-mapping.dmp