Analysis
-
max time kernel
114s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-09-2022 09:40
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe
-
Size
179KB
-
MD5
61fccc142e2bbf498885bb6e42bae62c
-
SHA1
7f15507c7798d8b99696c19929c86c6c629eb2f5
-
SHA256
ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf
-
SHA512
a3cc95a442581d02c97d4fe48494b157f37e5dff4ddf175723a2c99e442492370ad65f9f22da29ffd020754445193215b7dadc3515ab8cee91b6dd3b1f1202b1
-
SSDEEP
3072:yX7iPbPtN614Kej7QsyuEnQACE+6GJTOr/q+i5fAQXGfiPbPtN6144iPbPtN614V:y7Ity4KejEswQAxK+ilAQXGfIty44Itq
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\BackupConvertFrom.tif => C:\Users\Admin\Pictures\BackupConvertFrom.tif.matryoshka HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Users\Admin\Pictures\ResumeUnpublish.tiff HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File renamed C:\Users\Admin\Pictures\ResumeUnpublish.tiff => C:\Users\Admin\Pictures\ResumeUnpublish.tiff.matryoshka HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File renamed C:\Users\Admin\Pictures\UpdateBlock.png => C:\Users\Admin\Pictures\UpdateBlock.png.matryoshka HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File renamed C:\Users\Admin\Pictures\CompressHide.png => C:\Users\Admin\Pictures\CompressHide.png.matryoshka HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File renamed C:\Users\Admin\Pictures\ConvertFind.tif => C:\Users\Admin\Pictures\ConvertFind.tif.matryoshka HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File renamed C:\Users\Admin\Pictures\DismountPublish.tif => C:\Users\Admin\Pictures\DismountPublish.tif.matryoshka HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File renamed C:\Users\Admin\Pictures\MeasureSelect.tif => C:\Users\Admin\Pictures\MeasureSelect.tif.matryoshka HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File renamed C:\Users\Admin\Pictures\PublishRead.png => C:\Users\Admin\Pictures\PublishRead.png.matryoshka HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File renamed C:\Users\Admin\Pictures\SearchNew.png => C:\Users\Admin\Pictures\SearchNew.png.matryoshka HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_left.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_over.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\16.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\DataSet.zip HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\common.js HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_down.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mousedown.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\localizedStrings.js HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\gadget.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImage.jpg HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImage.jpg HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mousedown.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\daisies.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePage.html HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_h.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_m.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewFrame.html HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_dot.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_windy.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\17.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginDialogBackground.jpg HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous.png HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1604 vssvc.exe Token: SeRestorePrivilege 1604 vssvc.exe Token: SeAuditPrivilege 1604 vssvc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1688 HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe 1688 HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1688
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604