Analysis
- max time kernel
72s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
30/03/2023, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe
Resource
win7-20230220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe
- Size 819KB
- Sample230330-pwet8aeb3x
- SHA256 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47
- MD5 874d604e9d69452e9a153f2600f9e510
- SHA1 03e48b0a70060b10d0f1f5e20b48b69ce12e0215
- SHA512 764e990a607555526ccda80ae0bdff80d1798b18e802f21dc91456ea9c276bbdb7f996f3c6b0dfa45e04a02b0bf486e0e9af72e4719c9bf7caf12d736c5475eb
- SSDEEP 12288:RywTrJQaTd+OeO+OeNhBBhhBBYIoMcuceoj7EotNDkf1TiYxawKtTtMVFQa1S46R:RyalQazIHYtNDkf4YxawgeJkxSalPt6
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ClearRedo.tiff 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.VisualElementsManifest.xml 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageLargeTile.scale-150.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-48.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\editpdf.svg 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-200.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.scale-200.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansDemiBold.ttf 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-200_contrast-white.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-125.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-400.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-lightunplated.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteMedTile.scale-150.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\ui-strings.js 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-54_altform-unplated.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxSmallTile.scale-125.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\main.css 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-100_contrast-white.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionMedTile.scale-200.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\commerce\call_failure_illustration.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-utility-l1-1-0.dll 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\Microsoft.Services.Store.Engagement.dll 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-nodes.jar 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\favicon.ico 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\ui-strings.js 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\LargeTile.scale-200_contrast-white.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLike.Tests.ps1 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\ui-strings.js 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\concrt140.dll 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\Aerial.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso98win32client.dll 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_scale-100.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80_altform-lightunplated.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\classfile_constants.h 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-32_altform-lightunplated.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\15.jpg 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\skypert.dll 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordcnv.dll 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Spiral.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxManifest.xml 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-125.png 3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe"C:\Users\Admin\AppData\Local\Temp\3fe9192d920b89dc62dc264e7b2647920b902fde5cd2f2c960f4b493b1f89d47.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:5036