Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
06-03-2022 03:59
Static task
static1
Behavioral task
behavioral1
Sample
2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe
Resource
win10v2004-en-20220113
General
-
Target
2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe
-
Size
1.0MB
-
MD5
21d5abb9977d71918ee1de4e83dc8e84
-
SHA1
9f26bdd44c8283ccd83b46e62fc5687dc7bd4c9c
-
SHA256
2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782
-
SHA512
4613eb9edbe7b0eff338ddafb403a437e95d16e761e2a09c757c8e6e956045b3d34f64225773575a6654d233f258937eed4102935c6afa9bd1a4a2c9c5b1ca0a
Malware Config
Extracted
C:\README1.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README6.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README7.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README8.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README9.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README10.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\OutCheckpoint.tiff 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe -
resource yara_rule behavioral2/memory/1444-131-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/1444-132-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 45 whatismyipaddress.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\4ED453B74ED453B7.bmp" 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-white_scale-125.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black_devicefamily-colorfulunplated.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\WideTile.scale-200.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-400.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200_contrast-high.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\excelmui.msi.16.en-us.vreg.dat 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\MedTile.scale-100.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-400.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinLearningToolsLocal.xml 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pt-PT\View3d\3DViewerProductDescription-universal.xml 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-white_scale-100.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-100.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-64_altform-lightunplated.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlCone.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-white_scale-100.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-256_altform-unplated.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-400.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-48_altform-unplated_contrast-white.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_contrast-white.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-36.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\MedTile.scale-100.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-150.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ODBCMESSAGES.XML 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1850_32x32x32.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-400_contrast-black.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppValueProp.svg 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-300.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sw-KE\View3d\3DViewerProductDescription-universal.xml 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_altform-unplated_contrast-white.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-16_contrast-black.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\WideTile.scale-100_contrast-white.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\THMBNAIL.PNG 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-100_contrast-white.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_pound_Loud.m4a 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\Assets\[email protected] 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.scale-125.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-250.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarLargeTile.scale-150.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\CottonCandy.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-400.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-200.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_05.jpg 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\MedTile.scale-100.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-96.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-unplated.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\169.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-200.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-400.png 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 5048 3024 WerFault.exe 42 808 2448 WerFault.exe 104 -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1508 vssadmin.exe 4628 vssadmin.exe 1088 vssadmin.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1346565761-3498240568-4147300184-1000\{051A922E-7BC5-4C99-BBF0-6FD9B69C5EBA} explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeBackupPrivilege 3780 vssvc.exe Token: SeRestorePrivilege 3780 vssvc.exe Token: SeAuditPrivilege 3780 vssvc.exe Token: SeShutdownPrivilege 2448 explorer.exe Token: SeCreatePagefilePrivilege 2448 explorer.exe Token: SeShutdownPrivilege 2448 explorer.exe Token: SeCreatePagefilePrivilege 2448 explorer.exe Token: SeShutdownPrivilege 2448 explorer.exe Token: SeCreatePagefilePrivilege 2448 explorer.exe Token: SeShutdownPrivilege 2448 explorer.exe Token: SeCreatePagefilePrivilege 2448 explorer.exe Token: SeShutdownPrivilege 2448 explorer.exe Token: SeCreatePagefilePrivilege 2448 explorer.exe Token: SeShutdownPrivilege 2448 explorer.exe Token: SeCreatePagefilePrivilege 2448 explorer.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe 2448 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1444 wrote to memory of 1508 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 90 PID 1444 wrote to memory of 1508 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 90 PID 1444 wrote to memory of 4628 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 94 PID 1444 wrote to memory of 4628 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 94 PID 1444 wrote to memory of 1088 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 96 PID 1444 wrote to memory of 1088 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 96 PID 1444 wrote to memory of 3212 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 98 PID 1444 wrote to memory of 3212 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 98 PID 1444 wrote to memory of 3212 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 98 PID 3212 wrote to memory of 4680 3212 cmd.exe 100 PID 3212 wrote to memory of 4680 3212 cmd.exe 100 PID 3212 wrote to memory of 4680 3212 cmd.exe 100 PID 1444 wrote to memory of 3412 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 109 PID 1444 wrote to memory of 3412 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 109 PID 1444 wrote to memory of 3412 1444 2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe 109 PID 3412 wrote to memory of 4288 3412 cmd.exe 111 PID 3412 wrote to memory of 4288 3412 cmd.exe 111 PID 3412 wrote to memory of 4288 3412 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe"C:\Users\Admin\AppData\Local\Temp\2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:1508
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:4628
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:1088
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\chcp.comchcp3⤵PID:4680
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\chcp.comchcp3⤵PID:4288
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 412 -p 3024 -ip 30241⤵PID:4032
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3024 -s 27321⤵
- Program crash
PID:5048
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2448 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2448 -s 22322⤵
- Program crash
PID:808
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 476 -p 2448 -ip 24481⤵PID:1260
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:4500