Resubmissions
13/02/2022, 03:26
220213-dy59eafben 1025/06/2021, 19:08
210625-fml1gypkn6 819/06/2021, 15:14
210619-d3391n953n 10Analysis
-
max time kernel
1785s -
max time network
1428s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
13/02/2022, 03:26
Static task
static1
Behavioral task
behavioral1
Sample
Tray.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Tray.exe
-
Size
321KB
-
MD5
6585cb51ff21007fb9ef936e96c58982
-
SHA1
7a3d5563460b9935fe84879ee14fabfc7c664825
-
SHA256
e07b0cd7eca5bc70b07ea786c3ef4da28036c901effa2193a93caf945cb2b334
-
SHA512
523c7b3ed0907a473eac04c8cb8642eeea1d3a223069f876a7e0bc18075d59f9903319f6b2e3c2fa262158f04c4ad3637568dd9b0558732c8a574ffe566efc7d
Score
10/10
Malware Config
Signatures
-
Drops file in Drivers directory 21 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\gm.dls Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\afunix.sys Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui Tray.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ConnectResolve.tiff Tray.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Tray.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\Searches\desktop.ini Tray.exe File opened for modification C:\Users\Public\desktop.ini Tray.exe File opened for modification C:\Users\Public\Libraries\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.19041.1_none_a81a33274fb1b624\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_10.0.19041.1_none_345e4e1d2701732b\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.19041.1_none_2f07a4cad3dec315\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.19041.1_none_0cf1a65e91dfb2be\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Music\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Tray.exe File opened for modification C:\Windows\Web\Wallpaper\Theme2\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.19041.1_none_b2014b56ea660ec9\desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Links\desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.19041.1_none_f6eee8789c1c6fdd\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-maintenanceuser_31bf3856ad364e35_10.0.19041.1_none_bbf8ad8ff53c9b5b\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.19041.1_none_148b41803c849a3c\Desktop.ini Tray.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Tray.exe File opened for modification C:\Windows\Fonts\desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-publiclibraries_31bf3856ad364e35_10.0.19041.1_none_cbd9ad4986c925d5\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Tray.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.19041.1_none_04c252e5678f305a\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.19041.1_none_a208296858c76413\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.423_none_7c917c97525f1487\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-theme2_31bf3856ad364e35_10.0.19041.1_none_8ccaf9c8444b9274\Desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Tray.exe File opened for modification C:\Users\Public\Pictures\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.19041.1_none_3870d3554f39ac78\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini Tray.exe -
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\es-ES\TestDtc.psd1 Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-HgsClient-Core-Package~31bf3856ad364e35~amd64~~10.0.19041.84.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\miradisp.inf_loc Tray.exe File opened for modification C:\Windows\SysWOW64\fr-FR\spp.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\PerceptionSimulation.ProxyStubs.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-OpenSSH-ClientOnly-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\MSFT_NetISATAPConfiguration.types.ps1xml Tray.exe File opened for modification C:\Windows\SysWOW64\fr-FR\RemoveDeviceContextHandler.dll.mui Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VirtualDevice-SMB-merged-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\SysWOW64\de-DE\wmitomi.dll.mui Tray.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\ks.inf_loc Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\xwizard.exe.mui Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\ActionCenterCPL.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\mfc100ita.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PhotoBasic-PictureTools-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Containers-Guest-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.867.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\netathr10x.INF_loc Tray.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\netip6.inf_loc Tray.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\inlineUi.xsd Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WindowsSearchEngineSKU-Group-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VirtualDevice-FibreChannel-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\SysWOW64\it-IT\rstrui.exe.mui Tray.exe File opened for modification C:\Windows\System32\DriverStore\en-US\iaLPSS2i_I2C_BXT_P.inf_loc Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.inf Tray.exe File opened for modification C:\Windows\SysWOW64\ja-JP\iexpress.exe.mui Tray.exe File opened for modification C:\Windows\SysWOW64\wbem\it-IT\vdswmi.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\keymgr.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VirtualDevice-FibreChannel-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-RDP4VS-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\msorc32r.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\it-IT\ir50_32original.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SecureBoot\SecureBoot.psd1 Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Security-SPP-Component-SKU-Enterprise-Package~31bf3856ad364e35~amd64~~10.0.19041.1266.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Media-Foundation-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat Tray.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMETIP.DLL Tray.exe File opened for modification C:\Windows\SysWOW64\lt-LT\comctl32.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\wdigest.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-UnifiedWriteFilter-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\netvg63a.inf_loc Tray.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\usb.inf_loc Tray.exe File opened for modification C:\Windows\SysWOW64\Keywords\{A5A7C794-3D59-41DF-915F-19ACDA526FC9}1036.bin Tray.exe File opened for modification C:\Windows\SysWOW64\wbem\it-IT\p2p-mesh.mfl Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Optional-Features-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\oposdrv.inf_loc Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms004.inf_amd64_c28ee88ec1bd4178\prnms004.PNF Tray.exe File opened for modification C:\Windows\SysWOW64\fr-FR\l2nacp.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\dimsjob.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-DisposableClientVM-merged-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmcommu.inf_amd64_9d8718c8b82a0aeb\mdmcommu.inf Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-MFCore-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectoryServices-ADAM-Tools-Opt-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\61883.inf_loc Tray.exe File opened for modification C:\Windows\SysWOW64\networklist\icons\StockIcons\bench_32.bin Tray.exe File opened for modification C:\Windows\SysWOW64\wwapi.dll Tray.exe File opened for modification C:\Windows\SysWOW64\es-ES\gpscript.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\fr-FR\dialer.exe.mui Tray.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe Tray.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\uefi.inf_loc Tray.exe File opened for modification C:\Windows\SysWOW64\InputMethod\JPN\Windows.Globalization.JapanesePhoneme.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\usbaudio2.inf_loc Tray.exe File opened for modification C:\Windows\SysWOW64\ja-JP\fontext.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\rgb9rast.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.cat Tray.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-i..ectionsharingconfig_31bf3856ad364e35_10.0.19041.746_none_98843ad327c98d51\f\hnetcfg.dll Tray.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_a892faef80a943dc\MuiUnattend.exe Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..es-drprov.resources_31bf3856ad364e35_10.0.19041.1_it-it_a737cdb3906f0e6f\drprov.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\amd64_wpdmtp.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_f8021327d4cf27a4\wpdmtpdr.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$_apppatch_custom_2adff76bea4847ec.cdf-ms Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_windows-networking-..component.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a34d3501da32d08b.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_hyperv-hypervisor-d..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_de-de_995a317924087ea9.manifest Tray.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.19041.1_none_55d16b95f6e3e25c\dnsapi.dll Tray.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Client-AssignedAccess-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-bluetooth-bthserv_31bf3856ad364e35_10.0.19041.1_none_6ecca0810842a5a2\bthserv.dll Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..shandlers-forcesync_31bf3856ad364e35_10.0.19041.746_none_6fec1ff00528879f\SettingsHandlers_ForceSync.dll Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-a..necoreuap.resources_31bf3856ad364e35_10.0.19041.1_de-de_3e33e4d97cf94f6d.manifest Tray.exe File opened for modification C:\Windows\WinSxS\amd64_msmouse.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_140b8b90ffa02a68\mouhid.sys.mui Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-security-netlogon-mof_31bf3856ad364e35_10.0.19041.1_none_1f2bfc8915bc0086.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_ro-ro_1219f92ac5b548b0.manifest Tray.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\SMSvcHost.resources.dll Tray.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-SmbDirect-Opt-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\SystemSettings.exe.manifest Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..glelanguage-license_31bf3856ad364e35_10.0.19041.1266_none_a7e91bd412e950b5\ProfessionalSingleLanguage-Retail-1-ul-store.xrm-ms Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-c..orization.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_dfc7c0614ba4ef91\capauthz.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.19041.1_es-es_6e3c2686dd2d1656\combase.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-authorizationmanagerui_31bf3856ad364e35_10.0.19041.746_none_0a27ebbb92d57ff6\azroleui.dll Tray.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_4.0.15805.0_none_3e9ad81e717c318a\AppSetting.ascx Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-csrss.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bf5260d13e1424e0.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_hyperv-compute-stor..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_fr-fr_eb14cf392ec693d4.manifest Tray.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.964_none_dc22c8f6a2b16b3e\WpcMigration.Uplevel.dll Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-api.resources_31bf3856ad364e35_10.0.19041.1_it-it_66727760c10bdf9e\wevtapi.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-f..tory-core.resources_31bf3856ad364e35_10.0.19041.1_en-us_aec305a85fdb2d10\fhtask.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\Catalogs\ee471fb84a9e09ac4d59cc9b1b7e7a6cf7df0d195bbe306472b324d6e5188d10.cat Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-media-streaming-dll_31bf3856ad364e35_10.0.19041.264_none_2c51fa7165e32114.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..s-devices.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_783f0a06bf7924d8.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-nfs-openrpc_31bf3856ad364e35_10.0.19041.1_none_99ab05ecea65e618.manifest Tray.exe File opened for modification C:\Windows\WinSxS\wow64_libarchive-internal_31bf3856ad364e35_10.0.19041.1_none_3ae776a122b2016c\archiveint.dll Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.19041.1_none_7d55e8342077d456\api-ms-win-core-timezone-l1-1-0.dll Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ssmanager.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_dbe47c07d0531580\ubpm.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..stack-termsrv-extra_31bf3856ad364e35_10.0.19041.1_none_c8c1e002df10f7b6\VmHostAI.dll Tray.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-onecore-pnp-umpnpmgr.resources_31bf3856ad364e35_10.0.19041.1_en-us_1bd351c127f6d03f_umpnpmgr.dll.mui_d66aed17 Tray.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.resources\v4.0_4.0.0.0_it_b77a5c561934e089\System.AddIn.resources.dll Tray.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Portable-Devices-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.mum Tray.exe File opened for modification C:\Windows\servicing\Packages\HyperV-HypervisorPlatform-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-activationmanager_31bf3856ad364e35_10.0.19041.1151_none_d3bbe3071f172827\r\ActivationManager.dll Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-cngcredui.resources_31bf3856ad364e35_10.0.19041.1_en-us_593296064d30d832.manifest Tray.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageconsolidatedProviders.aspx.ja.resx Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_10.0.19041.1_it-it_68b0cd514097f698\csv.xsl Tray.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.19041.1_en-us_7cd59418f708faf0_wudfhost.exe.mui_1fc689ff Tray.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.ja.resx Tray.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Runtime-Metadata-Desktop-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1202.cat Tray.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\invalidcert.htm Tray.exe File opened for modification C:\Windows\WinSxS\amd64_c_system.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_f8c54ae1d45eb4b7\c_system.inf_loc Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-u..k-library.resources_31bf3856ad364e35_10.0.19041.1_de-de_c3c24178ec233e13.manifest Tray.exe File opened for modification C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_de-de_d7f4b3c0973f3fda\SqlPersistenceProviderSchema.sql Tray.exe File opened for modification C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\r\msscntrs.dll Tray.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-WMPNetworkSharingService-Opt-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat Tray.exe File opened for modification C:\Windows\WinSxS\amd64_multipoint-wms.eventlogmsg.resources_31bf3856ad364e35_10.0.19041.1_es-es_c93c280113f48e62\Wms.EventLogMsg.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_3f7ee0a8ee28ef7d.manifest Tray.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$_system32_speech_common_fr-fr_fda6dace6086c198.cdf-ms Tray.exe File opened for modification C:\Windows\Boot\EFI\fr-FR\bootmgr.efi.mui Tray.exe File opened for modification C:\Windows\WinSxS\amd64_dual_prnms003.inf_31bf3856ad364e35_10.0.19041.1202_none_8b568f04f79b359a\f\prnms003.cat Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_multimedia-mfcore-w..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_ja-jp_a329dbfc6292254c.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-onecore-c..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_it-it_8d9721991e543117.manifest Tray.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.DeveloperLicense.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\Microsoft.Windows.DeveloperLicense.Commands.Resources.dll Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.powershell.scheduledjob.module_31bf3856ad364e35_10.0.19041.1_none_ccde75ff5981d2f3\PSScheduledJob.psd1 Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-t..od-wow64-deployment_31bf3856ad364e35_10.0.19041.746_none_67726bc89916f479.manifest Tray.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-m..oracle-provider-dll_31bf3856ad364e35_10.0.19041.746_none_14fdaa9539af2bee\msdaora.dll Tray.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1004 svchost.exe Token: SeCreatePagefilePrivilege 1004 svchost.exe Token: SeShutdownPrivilege 1004 svchost.exe Token: SeCreatePagefilePrivilege 1004 svchost.exe Token: SeShutdownPrivilege 1004 svchost.exe Token: SeCreatePagefilePrivilege 1004 svchost.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe Token: SeRestorePrivilege 4792 TiWorker.exe Token: SeSecurityPrivilege 4792 TiWorker.exe Token: SeBackupPrivilege 4792 TiWorker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tray.exe"C:\Users\Admin\AppData\Local\Temp\Tray.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
PID:2384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1004
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4792