Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 01:32
Behavioral task
behavioral1
Sample
416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe
-
Size
277KB
-
MD5
d60d91c24570770af42816602ac19c97
-
SHA1
0d17845f19dc2fc1e38934864424c23d8bcc7644
-
SHA256
416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e
-
SHA512
b2fdac5145f9cfdfe06d10518198aadcb9a3d5bd26f9dcb9c8af5f3be8b1e4aa82895876ed24d39225510006d134cd31e3a588513e7ab9010cb8f9482958c7bc
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\GrantRemove.tiff 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\skins\winamp2.xml 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Metro.thmx 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\7E558-Readme.txt 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Foundry.xml 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.TTS 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18241_.WMF 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieResume.dotx 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Pushpin.thmx 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OSPP.VBS 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\7E558-Readme.txt 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18208_.WMF 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendtoOneNoteFilter.gpd 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeFax.Dotx 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\7E558-Readme.txt 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18217_.WMF 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Common Files\Services\verisign.bmp 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\CT_ROOTS.XML 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ASCIIENG.LNG 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Black Tie.xml 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\youtube.crx 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\el.pak 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\AMERITECH.NET.XML 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18251_.WMF 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\DELIMR.FAE 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\7E558-Readme.txt 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveMergeLetter.dotx 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Contacts.accdt 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\DisableConvertTo.scf 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lt.pak 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\7E558-Readme.txt 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\7E558-Readme.txt 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\hi.pak 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\7E558-Readme.txt 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\drive.crx 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Horizon.xml 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\vlc.mo 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18200_.WMF 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyLetter.dotx 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\de.pak 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe Token: SeImpersonatePrivilege 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 944 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe"C:\Users\Admin\AppData\Local\Temp\416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:944