Analysis
-
max time kernel
133s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
06-03-2022 06:33
Static task
static1
Behavioral task
behavioral1
Sample
dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe
Resource
win10v2004-en-20220113
General
-
Target
dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe
-
Size
1.1MB
-
MD5
be99e3d9cec624afe102e52ddb8be793
-
SHA1
f28bc0e2cfbe1f0e11317e19318334e50016794b
-
SHA256
dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc
-
SHA512
9c416206c4fd843b6b3e8530c53eed098a7246b9f8bc3916d745c73cc65766b9bd217ae644234cb106a5feb2a8206696aa571e68ecc543636aeb1e7e64541731
Malware Config
Extracted
C:\README1.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README6.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README7.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README8.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README9.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README10.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs
-
resource yara_rule behavioral2/memory/2440-131-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/2440-132-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 52 whatismyipaddress.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\EF01FE72EF01FE72.bmp" dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyShare.scale-125.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-black_scale-200.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-256_altform-unplated.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-96_altform-lightunplated.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\32.jpg dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-black_scale-125.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.tree.dat dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\NoiseAsset_256X256_PNG.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-32.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-24_altform-unplated.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skype-logo-40.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.contrast-white_scale-200.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-white.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d1.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\MedTile.scale-100.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36_altform-unplated.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.scale-125_contrast-white.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\PREVIEW.GIF dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare150x150Logo.scale-200_contrast-white.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Kiss.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp8.scale-125.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyLetter.dotx dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-60.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-150.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-150.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_PigNose.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-96.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-64.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageSmallTile.scale-400.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-150.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-GB\View3d\3DViewerProductDescription-universal.xml dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36_altform-lightunplated.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-200_contrast-black.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-80_altform-unplated.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-150.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-180.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\Icons_Icon_Wind_sm.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\Weather_TileMediumSquare.scale-100.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Toolkit\Images\DefaultProfileImage.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\LargeTile.scale-100.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-256.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxAccountsSplashLogo.scale-100.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-black_scale-100.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\multiple-plans.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\2876_20x20x32.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\MediumTile.scale-125.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-125.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarLargeTile.scale-200.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-60.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-125.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\PREVIEW.GIF dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-40_altform-lightunplated.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-200.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-24_contrast-black.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-16_altform-lightunplated.png dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
pid pid_target Process procid_target 1920 2216 WerFault.exe 29 4688 4024 WerFault.exe 103 1516 4024 WerFault.exe 103 -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4168 vssadmin.exe 4312 vssadmin.exe 4024 vssadmin.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1346565761-3498240568-4147300184-1000\{155D70C7-4C7C-40C4-A694-0606633C171D} explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeBackupPrivilege 1616 vssvc.exe Token: SeRestorePrivilege 1616 vssvc.exe Token: SeAuditPrivilege 1616 vssvc.exe Token: SeShutdownPrivilege 4024 explorer.exe Token: SeCreatePagefilePrivilege 4024 explorer.exe Token: SeShutdownPrivilege 4024 explorer.exe Token: SeCreatePagefilePrivilege 4024 explorer.exe Token: SeShutdownPrivilege 4024 explorer.exe Token: SeCreatePagefilePrivilege 4024 explorer.exe Token: SeShutdownPrivilege 4024 explorer.exe Token: SeCreatePagefilePrivilege 4024 explorer.exe Token: SeShutdownPrivilege 4024 explorer.exe Token: SeCreatePagefilePrivilege 4024 explorer.exe Token: SeShutdownPrivilege 4024 explorer.exe Token: SeCreatePagefilePrivilege 4024 explorer.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4024 explorer.exe 4024 explorer.exe 4024 explorer.exe 4024 explorer.exe 4024 explorer.exe 4024 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 4024 explorer.exe 4024 explorer.exe 4024 explorer.exe 4024 explorer.exe 4024 explorer.exe 4024 explorer.exe 4024 explorer.exe 4024 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2440 wrote to memory of 4312 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 86 PID 2440 wrote to memory of 4312 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 86 PID 2440 wrote to memory of 4024 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 91 PID 2440 wrote to memory of 4024 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 91 PID 2440 wrote to memory of 4168 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 93 PID 2440 wrote to memory of 4168 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 93 PID 2440 wrote to memory of 3084 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 95 PID 2440 wrote to memory of 3084 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 95 PID 2440 wrote to memory of 3084 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 95 PID 3084 wrote to memory of 3644 3084 cmd.exe 97 PID 3084 wrote to memory of 3644 3084 cmd.exe 97 PID 3084 wrote to memory of 3644 3084 cmd.exe 97 PID 2440 wrote to memory of 4792 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 109 PID 2440 wrote to memory of 4792 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 109 PID 2440 wrote to memory of 4792 2440 dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe 109 PID 4792 wrote to memory of 4996 4792 cmd.exe 111 PID 4792 wrote to memory of 4996 4792 cmd.exe 111 PID 4792 wrote to memory of 4996 4792 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe"C:\Users\Admin\AppData\Local\Temp\dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc.exe"1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:4312
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:4024
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:4168
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\chcp.comchcp3⤵PID:3644
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\chcp.comchcp3⤵PID:4996
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 432 -p 2216 -ip 22161⤵PID:296
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2216 -s 22481⤵
- Program crash
PID:1920
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4024 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4024 -s 22442⤵
- Program crash
PID:4688
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4024 -s 22442⤵
- Program crash
PID:1516
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:4988
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 468 -p 4024 -ip 40241⤵PID:2976
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 4024 -ip 40241⤵PID:3964