Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
09/10/2023, 22:48
231009-2rg51aah99 1029/01/2023, 17:35
230129-v55pwsha8v 1030/11/2022, 18:03
221130-wm9rkafc81 10Analysis
-
max time kernel
389s -
max time network
388s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2023, 17:35
Static task
static1
Behavioral task
behavioral1
Sample
3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
18 signatures
300 seconds
General
-
Target
3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe
-
Size
2.4MB
-
MD5
c2c5848ec8ae11e84d42521c527f75ca
-
SHA1
d8d98dff64297d4cf8a227a2c138efc4774942b2
-
SHA256
3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467
-
SHA512
10e3f210c2d98c090ce3a65be2ff70279c07c1bf3dcb06a48dbfaa34ab6471ed0e8f2a35fbf5bd0c9b61b1c55493c5042daa32556b4b28e22c28e8d80c5d0846
-
SSDEEP
49152:3rKiRwG7r2ie/XMK+kLg7SdqnCvIUdJi0l2Css5qq2nY4/gX1aNnUm5vL:3RXK+b7ScCvFPx3Kr48UmN
Score
10/10
Malware Config
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Executes dropped EXE 1 IoCs
pid Process 3876 drpbx.exe -
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\SwitchSelect.tiff.locked drpbx.exe File created C:\Users\Admin\Pictures\UndoDismount.png.locked drpbx.exe File opened for modification C:\Users\Admin\Pictures\UnpublishPing.tiff drpbx.exe File created C:\Users\Admin\Pictures\UnpublishPing.tiff.locked drpbx.exe File created C:\Users\Admin\Pictures\UnregisterPush.raw.locked drpbx.exe File created C:\Users\Admin\Pictures\MountSelect.raw.locked drpbx.exe File opened for modification C:\Users\Admin\Pictures\SwitchSelect.tiff drpbx.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" 3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 40 IoCs
pid Process 4536 3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe 3876 drpbx.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-100_contrast-high.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-400.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-36_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookSmallTile.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-48_altform-unplated.png drpbx.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe.locked drpbx.exe File created C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html.locked drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-64_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-30_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_contrast-black.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-100_contrast-black.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-96_altform-unplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-64_contrast-black.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-125.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-unplated_devicefamily-colorfulunplated.png drpbx.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\javaws.jar drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-150.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-24.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe drpbx.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-20.png drpbx.exe File created C:\Program Files\7-Zip\Lang\pt.txt.locked drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-48.png drpbx.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.169.31\MicrosoftEdgeUpdateCore.exe drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Content\SaturationGradient.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-125.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe drpbx.exe File created C:\Program Files\7-Zip\Lang\da.txt.locked drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-400.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFirstRunCarousel_Animation2.mp4 drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-80_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\HeroAppTile.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockSmallTile.contrast-white_scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-48.png drpbx.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg drpbx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-96.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarBadge.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_altform-unplated.png drpbx.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-400.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-100.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-white_scale-100.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_contrast-white.png drpbx.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-80.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-100.png drpbx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4148 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4148 taskmgr.exe Token: SeSystemProfilePrivilege 4148 taskmgr.exe Token: SeCreateGlobalPrivilege 4148 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 3876 drpbx.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4536 3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe 3876 drpbx.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4536 wrote to memory of 3876 4536 3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe 81 PID 4536 wrote to memory of 3876 4536 3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe 81 PID 4536 wrote to memory of 3876 4536 3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe"C:\Users\Admin\AppData\Local\Temp\3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3876
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4148
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:400
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5c2c5848ec8ae11e84d42521c527f75ca
SHA1d8d98dff64297d4cf8a227a2c138efc4774942b2
SHA2563efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467
SHA51210e3f210c2d98c090ce3a65be2ff70279c07c1bf3dcb06a48dbfaa34ab6471ed0e8f2a35fbf5bd0c9b61b1c55493c5042daa32556b4b28e22c28e8d80c5d0846
-
Filesize
2.4MB
MD5c2c5848ec8ae11e84d42521c527f75ca
SHA1d8d98dff64297d4cf8a227a2c138efc4774942b2
SHA2563efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467
SHA51210e3f210c2d98c090ce3a65be2ff70279c07c1bf3dcb06a48dbfaa34ab6471ed0e8f2a35fbf5bd0c9b61b1c55493c5042daa32556b4b28e22c28e8d80c5d0846
-
Filesize
2.4MB
MD5c2c5848ec8ae11e84d42521c527f75ca
SHA1d8d98dff64297d4cf8a227a2c138efc4774942b2
SHA2563efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467
SHA51210e3f210c2d98c090ce3a65be2ff70279c07c1bf3dcb06a48dbfaa34ab6471ed0e8f2a35fbf5bd0c9b61b1c55493c5042daa32556b4b28e22c28e8d80c5d0846