Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-03-2022 16:55
Static task
static1
Behavioral task
behavioral1
Sample
e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe
Resource
win10v2004-en-20220113
General
-
Target
e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe
-
Size
1.2MB
-
MD5
78be5b87f4282ad396ba0cdb3219a8c4
-
SHA1
2b07c58af5ae103c9b4745c948cabc36cd12d97c
-
SHA256
e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a
-
SHA512
9539b3ad5c65243b13d2dcc7ef98599e50cac742d5c097f4305d5de025b0c8cb8c7af579ffb533f67517c6c01d8a18b5e42a6030ce3b5d535362efbe62d784b7
Malware Config
Extracted
C:\README1.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README6.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README7.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README8.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README9.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README10.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
resource yara_rule behavioral1/memory/1084-57-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/1084-58-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 whatismyipaddress.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\2E3BFB552E3BFB55.bmp" e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\settings.css e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\flyout.css e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_top_right.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\settings.css e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\gadget.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\gadget.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_pressed.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_dot.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_snow.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\gadget.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\localizedSettings.css e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_On.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\localizedSettings.css e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\picturePuzzle.css e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_snow.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back_lrg.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.bmp e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\settings.css e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\flyout.html e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 204 1396 WerFault.exe 16 -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 640 vssadmin.exe 1280 vssadmin.exe 1484 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1456 vssvc.exe Token: SeRestorePrivilege 1456 vssvc.exe Token: SeAuditPrivilege 1456 vssvc.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1084 wrote to memory of 640 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 27 PID 1084 wrote to memory of 640 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 27 PID 1084 wrote to memory of 640 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 27 PID 1084 wrote to memory of 640 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 27 PID 1084 wrote to memory of 1280 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 31 PID 1084 wrote to memory of 1280 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 31 PID 1084 wrote to memory of 1280 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 31 PID 1084 wrote to memory of 1280 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 31 PID 1084 wrote to memory of 1484 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 33 PID 1084 wrote to memory of 1484 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 33 PID 1084 wrote to memory of 1484 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 33 PID 1084 wrote to memory of 1484 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 33 PID 1084 wrote to memory of 1724 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 35 PID 1084 wrote to memory of 1724 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 35 PID 1084 wrote to memory of 1724 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 35 PID 1084 wrote to memory of 1724 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 35 PID 1724 wrote to memory of 868 1724 cmd.exe 37 PID 1724 wrote to memory of 868 1724 cmd.exe 37 PID 1724 wrote to memory of 868 1724 cmd.exe 37 PID 1724 wrote to memory of 868 1724 cmd.exe 37 PID 1084 wrote to memory of 1572 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 41 PID 1084 wrote to memory of 1572 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 41 PID 1084 wrote to memory of 1572 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 41 PID 1084 wrote to memory of 1572 1084 e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe 41 PID 1572 wrote to memory of 1188 1572 cmd.exe 43 PID 1572 wrote to memory of 1188 1572 cmd.exe 43 PID 1572 wrote to memory of 1188 1572 cmd.exe 43 PID 1572 wrote to memory of 1188 1572 cmd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe"C:\Users\Admin\AppData\Local\Temp\e5093e304a50d34cdf67ee8e49713c6131d6740e664ea49d9c98682336e3141a.exe"1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:640
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1280
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:1484
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\chcp.comchcp3⤵PID:868
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\chcp.comchcp3⤵PID:1188
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1396 -s 17961⤵
- Program crash
PID:204