Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 04:28
Static task
static1
Behavioral task
behavioral1
Sample
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe
Resource
win10v2004-20220901-en
General
-
Target
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe
-
Size
172KB
-
MD5
c517194ef951573907186b800ea321c0
-
SHA1
1feb029d3c69d69958b317f8763fdb65d9b2df4d
-
SHA256
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81
-
SHA512
e8925698d7e32fac5b55fe98d7929a40be08b5cb31dac065cdfa8b65016f64eaef4aa6aa774b9ca733f1c72eabac4b6c87e6cd00c063a51d7e78d7a1651d3057
-
SSDEEP
3072:vwHteez3OtcHeZePIv9FTAxd8uGEnIB6P7K0Q0cNVB81VYrc0t1PbvN8KgCLn2J:/ez3OkkBVFTehI87d0WkBbv12J
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
xdyqhbn.exexdyqhbn.exepid process 3768 xdyqhbn.exe 396 xdyqhbn.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exexdyqhbn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation xdyqhbn.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
xdyqhbn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*svv_e = "C:\\Users\\Admin\\AppData\\Roaming\\xdyqhbn.exe" xdyqhbn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run xdyqhbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svv_e = "C:\\Users\\Admin\\AppData\\Roaming\\xdyqhbn.exe" xdyqhbn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce xdyqhbn.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
xdyqhbn.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\HELP_TO_SAVE_YOUR_FILES.bmp" xdyqhbn.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exexdyqhbn.exedescription pid process target process PID 996 set thread context of 1856 996 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe PID 3768 set thread context of 396 3768 xdyqhbn.exe xdyqhbn.exe -
Drops file in Program Files directory 64 IoCs
Processes:
xdyqhbn.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-48_altform-lightunplated.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp2.scale-125.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-96.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-200.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\MedTile.scale-200.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-125.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\save-money.png xdyqhbn.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteLargeTile.scale-125.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-400.png xdyqhbn.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt xdyqhbn.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\LogoDev.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-150_contrast-black.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_altform-unplated_contrast-black.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7cf.png xdyqhbn.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.scale-150.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-100.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-80_contrast-white.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-200.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60_altform-unplated_contrast-white.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-100.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-100.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\203.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_altform-unplated_contrast-black.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-100_contrast-black.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-150.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_connect.targetsize-48.png xdyqhbn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-white_scale-100.png xdyqhbn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-200_contrast-white.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyCalendarSearch.scale-125.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-80_altform-lightunplated.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsStoreLogo.scale-200.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-200.png xdyqhbn.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\LogoCanary.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-150.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-200.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-200.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\SmallTile.scale-200.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-20.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-40.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupSmallTile.scale-400.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\LargeTile.scale-125.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\HostConfigDarkMode.json xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-200_contrast-white.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-40_contrast-black.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-24_altform-unplated_contrast-white.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_contrast-black.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\firstrun\startup_background.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-48.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxMediumTile.scale-150.png xdyqhbn.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\complete.png xdyqhbn.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarWideTile.scale-150.png xdyqhbn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1596 1040 WerFault.exe 2868 4860 WerFault.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2384 vssadmin.exe -
Modifies Control Panel 2 IoCs
Processes:
xdyqhbn.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WallpaperStyle = "0" xdyqhbn.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\TileWallpaper = "0" xdyqhbn.exe -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{82226378-11EC-43BC-B6ED-CB99112B42B3} explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
xdyqhbn.exepid process 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe 396 xdyqhbn.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exexdyqhbn.exevssvc.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1856 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe Token: SeDebugPrivilege 396 xdyqhbn.exe Token: SeBackupPrivilege 4780 vssvc.exe Token: SeRestorePrivilege 4780 vssvc.exe Token: SeAuditPrivilege 4780 vssvc.exe Token: SeShutdownPrivilege 4860 explorer.exe Token: SeCreatePagefilePrivilege 4860 explorer.exe Token: SeShutdownPrivilege 4860 explorer.exe Token: SeCreatePagefilePrivilege 4860 explorer.exe Token: SeShutdownPrivilege 4860 explorer.exe Token: SeCreatePagefilePrivilege 4860 explorer.exe Token: SeShutdownPrivilege 4860 explorer.exe Token: SeCreatePagefilePrivilege 4860 explorer.exe Token: SeShutdownPrivilege 4860 explorer.exe Token: SeCreatePagefilePrivilege 4860 explorer.exe Token: SeShutdownPrivilege 4860 explorer.exe Token: SeCreatePagefilePrivilege 4860 explorer.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
explorer.exepid process 4860 explorer.exe 4860 explorer.exe 4860 explorer.exe 4860 explorer.exe 4860 explorer.exe 4860 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
explorer.exepid process 4860 explorer.exe 4860 explorer.exe 4860 explorer.exe 4860 explorer.exe 4860 explorer.exe 4860 explorer.exe 4860 explorer.exe 4860 explorer.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exexdyqhbn.exexdyqhbn.exedescription pid process target process PID 996 wrote to memory of 1856 996 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe PID 996 wrote to memory of 1856 996 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe PID 996 wrote to memory of 1856 996 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe PID 996 wrote to memory of 1856 996 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe PID 996 wrote to memory of 1856 996 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe PID 996 wrote to memory of 1856 996 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe PID 996 wrote to memory of 1856 996 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe PID 996 wrote to memory of 1856 996 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe PID 996 wrote to memory of 1856 996 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe PID 1856 wrote to memory of 3768 1856 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe xdyqhbn.exe PID 1856 wrote to memory of 3768 1856 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe xdyqhbn.exe PID 1856 wrote to memory of 3768 1856 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe xdyqhbn.exe PID 3768 wrote to memory of 396 3768 xdyqhbn.exe xdyqhbn.exe PID 3768 wrote to memory of 396 3768 xdyqhbn.exe xdyqhbn.exe PID 3768 wrote to memory of 396 3768 xdyqhbn.exe xdyqhbn.exe PID 3768 wrote to memory of 396 3768 xdyqhbn.exe xdyqhbn.exe PID 3768 wrote to memory of 396 3768 xdyqhbn.exe xdyqhbn.exe PID 3768 wrote to memory of 396 3768 xdyqhbn.exe xdyqhbn.exe PID 3768 wrote to memory of 396 3768 xdyqhbn.exe xdyqhbn.exe PID 3768 wrote to memory of 396 3768 xdyqhbn.exe xdyqhbn.exe PID 3768 wrote to memory of 396 3768 xdyqhbn.exe xdyqhbn.exe PID 1856 wrote to memory of 216 1856 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe cmd.exe PID 1856 wrote to memory of 216 1856 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe cmd.exe PID 1856 wrote to memory of 216 1856 321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe cmd.exe PID 396 wrote to memory of 2384 396 xdyqhbn.exe vssadmin.exe PID 396 wrote to memory of 2384 396 xdyqhbn.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe"C:\Users\Admin\AppData\Local\Temp\321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exeC:\Users\Admin\AppData\Local\Temp\321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81.exe2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\xdyqhbn.exeC:\Users\Admin\AppData\Roaming\xdyqhbn.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\xdyqhbn.exeC:\Users\Admin\AppData\Roaming\xdyqhbn.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\321C9E~1.EXE >> NUL3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 1040 -ip 10401⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1040 -s 31121⤵
- Program crash
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4860 -s 22882⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 480 -p 4860 -ip 48601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.eccFilesize
622KB
MD58727fe93a95ce2fdaf099d728a2186d3
SHA17ab87b1f781aed3f69f6dac295cc9ce1b67735f3
SHA25615bac9be91db032cce133dd61e75dd203d396be9699d246f94ca655bb74e1678
SHA512ee1a11dfdcd8916ee9416c0a7b30fab0e6245ba9efd77f8607cbf76216c0cd12dfb483d455d8d63719ae939cd86275bbbe5f3eafa316ec0fc8272820de1468de
-
C:\Users\Admin\AppData\Roaming\xdyqhbn.exeFilesize
172KB
MD5c517194ef951573907186b800ea321c0
SHA11feb029d3c69d69958b317f8763fdb65d9b2df4d
SHA256321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81
SHA512e8925698d7e32fac5b55fe98d7929a40be08b5cb31dac065cdfa8b65016f64eaef4aa6aa774b9ca733f1c72eabac4b6c87e6cd00c063a51d7e78d7a1651d3057
-
C:\Users\Admin\AppData\Roaming\xdyqhbn.exeFilesize
172KB
MD5c517194ef951573907186b800ea321c0
SHA11feb029d3c69d69958b317f8763fdb65d9b2df4d
SHA256321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81
SHA512e8925698d7e32fac5b55fe98d7929a40be08b5cb31dac065cdfa8b65016f64eaef4aa6aa774b9ca733f1c72eabac4b6c87e6cd00c063a51d7e78d7a1651d3057
-
C:\Users\Admin\AppData\Roaming\xdyqhbn.exeFilesize
172KB
MD5c517194ef951573907186b800ea321c0
SHA11feb029d3c69d69958b317f8763fdb65d9b2df4d
SHA256321c9ef63499b2134b32bdbb53fc0aaf917ae0e587aab872e4ad926ca8066c81
SHA512e8925698d7e32fac5b55fe98d7929a40be08b5cb31dac065cdfa8b65016f64eaef4aa6aa774b9ca733f1c72eabac4b6c87e6cd00c063a51d7e78d7a1651d3057
-
memory/216-149-0x0000000000000000-mapping.dmp
-
memory/396-150-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/396-146-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/396-155-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/396-141-0x0000000000000000-mapping.dmp
-
memory/396-144-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/396-151-0x0000000075030000-0x0000000075069000-memory.dmpFilesize
228KB
-
memory/996-135-0x00000000755D0000-0x0000000075609000-memory.dmpFilesize
228KB
-
memory/996-136-0x00000000755D0000-0x0000000075609000-memory.dmpFilesize
228KB
-
memory/1856-133-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1856-152-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1856-147-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1856-132-0x0000000000000000-mapping.dmp
-
memory/1856-153-0x0000000075030000-0x0000000075069000-memory.dmpFilesize
228KB
-
memory/1856-137-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1856-134-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1856-148-0x0000000075030000-0x0000000075069000-memory.dmpFilesize
228KB
-
memory/2384-154-0x0000000000000000-mapping.dmp
-
memory/3768-138-0x0000000000000000-mapping.dmp
-
memory/3768-145-0x0000000075030000-0x0000000075069000-memory.dmpFilesize
228KB