Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:27
Static task
static1
Behavioral task
behavioral1
Sample
803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe
Resource
win10v2004-20220414-en
General
-
Target
803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe
-
Size
1.2MB
-
MD5
53b597d0f54362a1110b1785beeebadf
-
SHA1
74804f2afa946f1409385d5ac36830517039f9be
-
SHA256
803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230
-
SHA512
8545cfbc1c084f6bbe5b8db61d9e7fe4bc7bdebabfdb56aab86667f52cacf486cb34699bbbcfd88e0f6fe97abb724e1cae0d673dfa525642f1f20b2b820bc243
Malware Config
Extracted
C:\README1.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README6.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README7.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README8.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README9.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README10.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\SwitchRead.tiff 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Users\Admin\Pictures\OpenSync.tiff 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe -
Processes:
resource yara_rule behavioral1/memory/1868-56-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/1868-57-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 whatismyipaddress.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\090E55E1090E55E1.bmp" 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe -
Drops file in Program Files directory 64 IoCs
Processes:
803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exedescription ioc process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\logo.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\gadget.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_dot.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous_partly-cloudy.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\picturePuzzle.js 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_up.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\HideConnect.html 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\gadget.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_left.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_left.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\clock.html 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_foggy.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)redStateIcon.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\SubmitRemove.pub 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\settings.js 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_down.png 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1516 1208 WerFault.exe -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 1244 vssadmin.exe 1912 vssadmin.exe 980 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exepid process 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1068 vssvc.exe Token: SeRestorePrivilege 1068 vssvc.exe Token: SeAuditPrivilege 1068 vssvc.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exepid process 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.execmd.execmd.exedescription pid process target process PID 1868 wrote to memory of 1244 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 1244 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 1244 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 1244 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 1912 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 1912 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 1912 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 1912 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 980 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 980 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 980 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 980 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe vssadmin.exe PID 1868 wrote to memory of 1848 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe cmd.exe PID 1868 wrote to memory of 1848 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe cmd.exe PID 1868 wrote to memory of 1848 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe cmd.exe PID 1868 wrote to memory of 1848 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe cmd.exe PID 1848 wrote to memory of 1864 1848 cmd.exe chcp.com PID 1848 wrote to memory of 1864 1848 cmd.exe chcp.com PID 1848 wrote to memory of 1864 1848 cmd.exe chcp.com PID 1848 wrote to memory of 1864 1848 cmd.exe chcp.com PID 1868 wrote to memory of 1752 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe cmd.exe PID 1868 wrote to memory of 1752 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe cmd.exe PID 1868 wrote to memory of 1752 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe cmd.exe PID 1868 wrote to memory of 1752 1868 803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe cmd.exe PID 1752 wrote to memory of 1444 1752 cmd.exe chcp.com PID 1752 wrote to memory of 1444 1752 cmd.exe chcp.com PID 1752 wrote to memory of 1444 1752 cmd.exe chcp.com PID 1752 wrote to memory of 1444 1752 cmd.exe chcp.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe"C:\Users\Admin\AppData\Local\Temp\803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1208 -s 7801⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/980-60-0x0000000000000000-mapping.dmp
-
memory/1244-58-0x0000000000000000-mapping.dmp
-
memory/1444-64-0x0000000000000000-mapping.dmp
-
memory/1752-63-0x0000000000000000-mapping.dmp
-
memory/1848-61-0x0000000000000000-mapping.dmp
-
memory/1864-62-0x0000000000000000-mapping.dmp
-
memory/1868-54-0x00000000759E1000-0x00000000759E3000-memory.dmpFilesize
8KB
-
memory/1868-56-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/1868-57-0x0000000000400000-0x0000000000608000-memory.dmpFilesize
2.0MB
-
memory/1868-55-0x0000000001DB0000-0x0000000001E85000-memory.dmpFilesize
852KB
-
memory/1912-59-0x0000000000000000-mapping.dmp