Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
06-03-2022 02:42
Static task
static1
Behavioral task
behavioral1
Sample
aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe
Resource
win10v2004-en-20220112
General
-
Target
aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe
-
Size
1.3MB
-
MD5
d17a0c84c07cc9873940a9e879a1c279
-
SHA1
adc8efd335531c64276958def3d7658b0ef662de
-
SHA256
aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff
-
SHA512
97ed3742209f62375e7f7b83ae2ee4c05fd9ed24bd3b7a2182e5bd98e391d86a471b7e898d17ca691bd8c5501c535a4814e7a9c0c1b5bd42b1cac4fc2fcef7e6
Malware Config
Extracted
C:\README1.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README6.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README7.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README8.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README9.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README10.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
resource yara_rule behavioral2/memory/2720-131-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2720-132-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-125.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Snooze.scale-80.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_mobile_download_v1.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-48.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-16.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-48_altform-unplated_contrast-white.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-150.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-30_altform-unplated.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\MedTile.scale-100.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-150.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-16.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\MicrosoftLogo.scale-200.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare150x150Logo.scale-200_contrast-white.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_contrast-white.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailSmallTile.scale-200.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-256.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-16_altform-unplated.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-125.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-64.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-60.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_contrast-high.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-36.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_contrast-white.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp9.scale-200.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-72_altform-lightunplated.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-125_contrast-black.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-125_contrast-black.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_activityAlert.targetsize-48.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-unplated_contrast-white.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-200.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-400_contrast-black.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Spotlight_NFL.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\remove.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_contrast-black.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Studio.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\10px.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\SplashScreen.scale-125.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-lightunplated.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-200_contrast-white.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare71x71Logo.scale-125_contrast-black.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EMLAttachmentIcon.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-125.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-unplated.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\MedTile.scale-100.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockMedTile.contrast-black_scale-200.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-white_scale-200.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ExtendedSplashScreen.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-FR\View3d\3DViewerProductDescription-universal.xml aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_scale-125.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-96_altform-unplated_contrast-white.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-black_scale-100.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\PSS10O.CHM aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-400_contrast-white.png aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2160 vssadmin.exe 3204 vssadmin.exe 3844 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 992 vssvc.exe Token: SeRestorePrivilege 992 vssvc.exe Token: SeAuditPrivilege 992 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2160 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 66 PID 2720 wrote to memory of 2160 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 66 PID 2720 wrote to memory of 3204 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 70 PID 2720 wrote to memory of 3204 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 70 PID 2720 wrote to memory of 3844 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 72 PID 2720 wrote to memory of 3844 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 72 PID 2720 wrote to memory of 3080 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 74 PID 2720 wrote to memory of 3080 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 74 PID 2720 wrote to memory of 3080 2720 aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe 74 PID 3080 wrote to memory of 3232 3080 cmd.exe 76 PID 3080 wrote to memory of 3232 3080 cmd.exe 76 PID 3080 wrote to memory of 3232 3080 cmd.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe"C:\Users\Admin\AppData\Local\Temp\aed1208120f18b0d4ef1349242130c39e0bed86cc7629b33dd441106ec8ee5ff.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:2160
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:3204
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:3844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\chcp.comchcp3⤵PID:3232
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:992