Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2023, 02:20
Behavioral task
behavioral1
Sample
3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe
Resource
win10v2004-20230220-en
General
-
Target
3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe
-
Size
34KB
-
MD5
bd935610cb878e275d35f292b93d8459
-
SHA1
2cfc4a68ece6c9465ba44f96b677cc00536908ad
-
SHA256
3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7
-
SHA512
2b754a4aeae53fc78fd07e08007d47f232d1b30855c098a3469459def47f912155f53bc918bdbae7fa0daf903185a38db76c9dfd354fa447729dc285b506907b
-
SSDEEP
768:x4K+eQXL36kOK1R01WseZ0y/QyYvhITluDA1afkKIDo:xueQbgK1e1S235HA1a20
Malware Config
Extracted
C:\Program Files\7-Zip\readme-warning.txt
makop
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 4828 wbadmin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe\"" 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\MedTile.scale-100.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_scale-100.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyCalendarSearch.scale-400.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_up_hover_18.svg 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\readme-warning.txt 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\ui-strings.js 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\readme-warning.txt 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.boot.tree.dat 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBGTaskHelper.winmd 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-150_contrast-white.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\LargeTile.scale-100.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_f_col.hxk 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockMedTile.contrast-black_scale-125.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-150.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-150.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-400.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\trdtv2r41.xsl 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-32_altform-unplated_contrast-black.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBLR6.CHM 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLargeTile.scale-100.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-125.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-default_32.svg 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\readme-warning.txt 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\THMBNAIL.PNG 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\Fingerprinting.DATA 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\readme-warning.txt 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LargeTile.scale-125.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_patterns_header.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\ij.bat 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win8.css 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-100.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ui-strings.js 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLike.Tests.ps1 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\br.gif 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-black_scale-125.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-125.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp4.scale-100.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\LargeTile.scale-125.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\MedTile.scale-200.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\release 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\SONORA.INF 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-unplated.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Mock.ps1 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200_contrast-high.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-32.png 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4120 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4764 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe 4764 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeBackupPrivilege 1800 vssvc.exe Token: SeRestorePrivilege 1800 vssvc.exe Token: SeAuditPrivilege 1800 vssvc.exe Token: SeBackupPrivilege 1848 wbengine.exe Token: SeRestorePrivilege 1848 wbengine.exe Token: SeSecurityPrivilege 1848 wbengine.exe Token: SeIncreaseQuotaPrivilege 112 WMIC.exe Token: SeSecurityPrivilege 112 WMIC.exe Token: SeTakeOwnershipPrivilege 112 WMIC.exe Token: SeLoadDriverPrivilege 112 WMIC.exe Token: SeSystemProfilePrivilege 112 WMIC.exe Token: SeSystemtimePrivilege 112 WMIC.exe Token: SeProfSingleProcessPrivilege 112 WMIC.exe Token: SeIncBasePriorityPrivilege 112 WMIC.exe Token: SeCreatePagefilePrivilege 112 WMIC.exe Token: SeBackupPrivilege 112 WMIC.exe Token: SeRestorePrivilege 112 WMIC.exe Token: SeShutdownPrivilege 112 WMIC.exe Token: SeDebugPrivilege 112 WMIC.exe Token: SeSystemEnvironmentPrivilege 112 WMIC.exe Token: SeRemoteShutdownPrivilege 112 WMIC.exe Token: SeUndockPrivilege 112 WMIC.exe Token: SeManageVolumePrivilege 112 WMIC.exe Token: 33 112 WMIC.exe Token: 34 112 WMIC.exe Token: 35 112 WMIC.exe Token: 36 112 WMIC.exe Token: SeIncreaseQuotaPrivilege 112 WMIC.exe Token: SeSecurityPrivilege 112 WMIC.exe Token: SeTakeOwnershipPrivilege 112 WMIC.exe Token: SeLoadDriverPrivilege 112 WMIC.exe Token: SeSystemProfilePrivilege 112 WMIC.exe Token: SeSystemtimePrivilege 112 WMIC.exe Token: SeProfSingleProcessPrivilege 112 WMIC.exe Token: SeIncBasePriorityPrivilege 112 WMIC.exe Token: SeCreatePagefilePrivilege 112 WMIC.exe Token: SeBackupPrivilege 112 WMIC.exe Token: SeRestorePrivilege 112 WMIC.exe Token: SeShutdownPrivilege 112 WMIC.exe Token: SeDebugPrivilege 112 WMIC.exe Token: SeSystemEnvironmentPrivilege 112 WMIC.exe Token: SeRemoteShutdownPrivilege 112 WMIC.exe Token: SeUndockPrivilege 112 WMIC.exe Token: SeManageVolumePrivilege 112 WMIC.exe Token: 33 112 WMIC.exe Token: 34 112 WMIC.exe Token: 35 112 WMIC.exe Token: 36 112 WMIC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4764 wrote to memory of 2008 4764 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe 84 PID 4764 wrote to memory of 2008 4764 3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe 84 PID 2008 wrote to memory of 4120 2008 cmd.exe 86 PID 2008 wrote to memory of 4120 2008 cmd.exe 86 PID 2008 wrote to memory of 4828 2008 cmd.exe 89 PID 2008 wrote to memory of 4828 2008 cmd.exe 89 PID 2008 wrote to memory of 112 2008 cmd.exe 93 PID 2008 wrote to memory of 112 2008 cmd.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe"C:\Users\Admin\AppData\Local\Temp\3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe"C:\Users\Admin\AppData\Local\Temp\3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe" n47642⤵PID:1524
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4120
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:4828
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:112
-
-
-
C:\Users\Admin\AppData\Local\Temp\3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe"C:\Users\Admin\AppData\Local\Temp\3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe" n47642⤵PID:768
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2424
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:3340
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a0db2b736f236b31cb5d6c027f78da78
SHA19e02b24c00bf47ee0fd2c1f9aab712e53b6baf98
SHA2564623a48d0fbaea158c3735136bf94762ab0c915fb2d129f8542e98a1d23366f1
SHA512ee2a0ff3509fa0a75b1bd1b363ef6e2103428fa057597c6baeda81e29c9bb0d0b5356e9b464692d74687442b59cdea0d4a8d92484a07cc47220845b8fa88df6d