Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 06:05
Static task
static1
Behavioral task
behavioral1
Sample
7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe
Resource
win10v2004-20220812-en
General
-
Target
7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe
-
Size
184KB
-
MD5
89f059a012a6911765ceaf4e3eefd2f8
-
SHA1
d0aae8d39b153584b3ea8f82b1ccf99ebef6a20c
-
SHA256
7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72
-
SHA512
01938da98ff0352db5e8db56ad60158dfd758bba1036cbf31d6e95003254ab8bc5e8abdde6f6850258738099e6468c6fe228e0c32dd73a75a41d3161af468996
-
SSDEEP
3072:kyXt9mTrJfPB6y0TwqjoL0sMjHicmDJij4X0PQgyrkEp92QObfOCLn2O:p4FfZ6zTwhmjsO4XcQ1F9pObp2O
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
icllcxv.exeicllcxv.exepid process 4636 icllcxv.exe 4148 icllcxv.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
icllcxv.exedescription ioc process File renamed C:\Users\Admin\Pictures\DisableTest.crw => C:\Users\Admin\Pictures\DisableTest.crw.ecc icllcxv.exe File renamed C:\Users\Admin\Pictures\SuspendPublish.crw => C:\Users\Admin\Pictures\SuspendPublish.crw.ecc icllcxv.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exeicllcxv.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation icllcxv.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
icllcxv.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run icllcxv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svv_e = "C:\\Users\\Admin\\AppData\\Roaming\\icllcxv.exe" icllcxv.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce icllcxv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*svv_e = "C:\\Users\\Admin\\AppData\\Roaming\\icllcxv.exe" icllcxv.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
icllcxv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\HELP_TO_SAVE_YOUR_FILES.bmp" icllcxv.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exeicllcxv.exedescription pid process target process PID 1096 set thread context of 3004 1096 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe PID 4636 set thread context of 4148 4636 icllcxv.exe icllcxv.exe -
Drops file in Program Files directory 64 IoCs
Processes:
icllcxv.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Wide310x150Logo.scale-125.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-200_contrast-white.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsBadgeLogo.scale-100.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\WideTile.scale-200.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\LargeTile.scale-200.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\SmallTile.scale-100.png icllcxv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png icllcxv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\THMBNAIL.PNG icllcxv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\ExcelCapabilities.json icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\SearchPlaceholder-light.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-black_scale-100.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-24_altform-unplated.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MusicStoreLogo.scale-200_contrast-black.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\8px.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-80_altform-lightunplated.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white_devicefamily-colorfulunplated.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-30.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyShare.scale-100.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-72_altform-unplated_contrast-white.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-32.png icllcxv.exe File opened for modification C:\Program Files\SuspendDebug.pptx icllcxv.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-125_contrast-white.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\8080_20x20x32.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_es-AR.json icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchSmallTile.contrast-black_scale-200.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\WideTile.scale-200.png icllcxv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png icllcxv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\THMBNAIL.PNG icllcxv.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionSmallTile.scale-100.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-colorize.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-30_altform-lightunplated.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\placeholder.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80_contrast-white.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\WideTile.scale-200.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\MedTile.scale-200.png icllcxv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-48_altform-unplated_contrast-black.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-72_contrast-black.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg5.jpg icllcxv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-150.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_contrast-white.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare71x71Logo.scale-200_contrast-black.png icllcxv.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\kn.pak icllcxv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js icllcxv.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\SmallTile.scale-125.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30_altform-unplated.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleLargeTile.scale-125.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupMedTile.scale-100.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-unplated.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-125.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36_altform-unplated_contrast-white.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-200.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\LargeTile.scale-125.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LargeTile.scale-125_contrast-white.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_altform-unplated_contrast-white_devicefamily-colorfulunplated.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-64.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-200.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\MedTile.scale-200.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-400.HCWhite.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png icllcxv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-36.png icllcxv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1300 3052 WerFault.exe 4820 936 WerFault.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3104 vssadmin.exe -
Modifies Control Panel 2 IoCs
Processes:
icllcxv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\WallpaperStyle = "0" icllcxv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\TileWallpaper = "0" icllcxv.exe -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2891029575-1462575-1165213807-1000\{EF75A39D-B533-4B99-8AA5-C804D538E07D} explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
icllcxv.exepid process 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe 4148 icllcxv.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exeicllcxv.exevssvc.exeexplorer.exedescription pid process Token: SeDebugPrivilege 3004 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe Token: SeDebugPrivilege 4148 icllcxv.exe Token: SeBackupPrivilege 2552 vssvc.exe Token: SeRestorePrivilege 2552 vssvc.exe Token: SeAuditPrivilege 2552 vssvc.exe Token: SeShutdownPrivilege 936 explorer.exe Token: SeCreatePagefilePrivilege 936 explorer.exe Token: SeShutdownPrivilege 936 explorer.exe Token: SeCreatePagefilePrivilege 936 explorer.exe Token: SeShutdownPrivilege 936 explorer.exe Token: SeCreatePagefilePrivilege 936 explorer.exe Token: SeShutdownPrivilege 936 explorer.exe Token: SeCreatePagefilePrivilege 936 explorer.exe Token: SeShutdownPrivilege 936 explorer.exe Token: SeCreatePagefilePrivilege 936 explorer.exe Token: SeShutdownPrivilege 936 explorer.exe Token: SeCreatePagefilePrivilege 936 explorer.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
explorer.exepid process 936 explorer.exe 936 explorer.exe 936 explorer.exe 936 explorer.exe 936 explorer.exe 936 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
explorer.exepid process 936 explorer.exe 936 explorer.exe 936 explorer.exe 936 explorer.exe 936 explorer.exe 936 explorer.exe 936 explorer.exe 936 explorer.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exeicllcxv.exeicllcxv.exedescription pid process target process PID 1096 wrote to memory of 3004 1096 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe PID 1096 wrote to memory of 3004 1096 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe PID 1096 wrote to memory of 3004 1096 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe PID 1096 wrote to memory of 3004 1096 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe PID 1096 wrote to memory of 3004 1096 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe PID 1096 wrote to memory of 3004 1096 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe PID 1096 wrote to memory of 3004 1096 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe PID 1096 wrote to memory of 3004 1096 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe PID 1096 wrote to memory of 3004 1096 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe PID 3004 wrote to memory of 4636 3004 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe icllcxv.exe PID 3004 wrote to memory of 4636 3004 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe icllcxv.exe PID 3004 wrote to memory of 4636 3004 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe icllcxv.exe PID 4636 wrote to memory of 4148 4636 icllcxv.exe icllcxv.exe PID 4636 wrote to memory of 4148 4636 icllcxv.exe icllcxv.exe PID 4636 wrote to memory of 4148 4636 icllcxv.exe icllcxv.exe PID 4636 wrote to memory of 4148 4636 icllcxv.exe icllcxv.exe PID 4636 wrote to memory of 4148 4636 icllcxv.exe icllcxv.exe PID 4636 wrote to memory of 4148 4636 icllcxv.exe icllcxv.exe PID 4636 wrote to memory of 4148 4636 icllcxv.exe icllcxv.exe PID 4636 wrote to memory of 4148 4636 icllcxv.exe icllcxv.exe PID 4636 wrote to memory of 4148 4636 icllcxv.exe icllcxv.exe PID 3004 wrote to memory of 4232 3004 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe cmd.exe PID 3004 wrote to memory of 4232 3004 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe cmd.exe PID 3004 wrote to memory of 4232 3004 7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe cmd.exe PID 4148 wrote to memory of 3104 4148 icllcxv.exe vssadmin.exe PID 4148 wrote to memory of 3104 4148 icllcxv.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe"C:\Users\Admin\AppData\Local\Temp\7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exeC:\Users\Admin\AppData\Local\Temp\7db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72.exe2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\icllcxv.exeC:\Users\Admin\AppData\Roaming\icllcxv.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\icllcxv.exeC:\Users\Admin\AppData\Roaming\icllcxv.exe4⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7DB66A~1.EXE >> NUL3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 3052 -ip 30521⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3052 -s 32841⤵
- Program crash
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 936 -s 21962⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 936 -ip 9361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.eccFilesize
622KB
MD51d409b863437249f020066a2878c7efe
SHA1800ac70cf56c9df951d8047695be759c0a6f44c7
SHA25606a356ec065f54d6ff0706ce0270ccb60caa9f56e54a4caa0e1e04bb4cdb59a6
SHA512e94d6a69b1c2a298865c70d0a8f283e0debc3750944d85e7493fed961282097cfbf2ae0381eea19a12c33ac97e1c600b3794a6a5dd268e6d763d535c16260e06
-
C:\Users\Admin\AppData\Roaming\icllcxv.exeFilesize
184KB
MD589f059a012a6911765ceaf4e3eefd2f8
SHA1d0aae8d39b153584b3ea8f82b1ccf99ebef6a20c
SHA2567db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72
SHA51201938da98ff0352db5e8db56ad60158dfd758bba1036cbf31d6e95003254ab8bc5e8abdde6f6850258738099e6468c6fe228e0c32dd73a75a41d3161af468996
-
C:\Users\Admin\AppData\Roaming\icllcxv.exeFilesize
184KB
MD589f059a012a6911765ceaf4e3eefd2f8
SHA1d0aae8d39b153584b3ea8f82b1ccf99ebef6a20c
SHA2567db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72
SHA51201938da98ff0352db5e8db56ad60158dfd758bba1036cbf31d6e95003254ab8bc5e8abdde6f6850258738099e6468c6fe228e0c32dd73a75a41d3161af468996
-
C:\Users\Admin\AppData\Roaming\icllcxv.exeFilesize
184KB
MD589f059a012a6911765ceaf4e3eefd2f8
SHA1d0aae8d39b153584b3ea8f82b1ccf99ebef6a20c
SHA2567db66ad64a23f53952dcd72eb1eaef6c063fb79c59db7f096930ea9285838f72
SHA51201938da98ff0352db5e8db56ad60158dfd758bba1036cbf31d6e95003254ab8bc5e8abdde6f6850258738099e6468c6fe228e0c32dd73a75a41d3161af468996
-
memory/1096-132-0x00000000759A0000-0x00000000759D9000-memory.dmpFilesize
228KB
-
memory/1096-136-0x00000000759A0000-0x00000000759D9000-memory.dmpFilesize
228KB
-
memory/3004-153-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3004-137-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3004-135-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3004-133-0x0000000000000000-mapping.dmp
-
memory/3004-134-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3004-141-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3004-154-0x0000000075400000-0x0000000075439000-memory.dmpFilesize
228KB
-
memory/3004-142-0x0000000075400000-0x0000000075439000-memory.dmpFilesize
228KB
-
memory/3104-155-0x0000000000000000-mapping.dmp
-
memory/4148-148-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4148-149-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4148-150-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4148-151-0x0000000075400000-0x0000000075439000-memory.dmpFilesize
228KB
-
memory/4148-144-0x0000000000000000-mapping.dmp
-
memory/4148-156-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4232-152-0x0000000000000000-mapping.dmp
-
memory/4636-147-0x0000000075400000-0x0000000075439000-memory.dmpFilesize
228KB
-
memory/4636-143-0x0000000075400000-0x0000000075439000-memory.dmpFilesize
228KB
-
memory/4636-138-0x0000000000000000-mapping.dmp