Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2023 03:09
Static task
static1
Behavioral task
behavioral1
Sample
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
Resource
win10-20230915-en
Behavioral task
behavioral2
Sample
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
Resource
win10v2004-20230915-en
General
-
Target
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
-
Size
53KB
-
MD5
5efa19dc204e46e8d8c57482f80e7a40
-
SHA1
5c83b3ddc8417fe64e0bbd3495445ddcee52e35e
-
SHA256
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f
-
SHA512
0cdf4a1263b9a341240acea245155f0afbaac864eccd1d9623a9a152a9287e8a65cd62f12804d5a1293c9d960a4958c2aa05a720f35d42699fec5d4ac0accfc1
-
SSDEEP
768:FKcvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5YW:F9eytM3alnawrRIwxVSHMweio3+
Malware Config
Extracted
C:\ProgramData\regid.1991-06.com.microsoft\how_to_back_files.html
Signatures
-
Renames multiple (7143) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\WideTile.scale-200.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\mooning.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\Tile\Sticker.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5311_40x40x32.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteNavigationLogo.scale-140.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-200.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\diamond_Badge_Earned.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_IT-IT.respack fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check_2x.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20_altform-fullcolor.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteWideTile.scale-400.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_unselected_18.svg fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\EmbossBitmaps\Moon_icon.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20_altform-unplated_contrast-white.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\km_16x11.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ru_60x42.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Fonts\MapsMDL2.2.01.ttf fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchWideTile.contrast-black_scale-100.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\puking.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookSmallTile.scale-100.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\CIEXYZ.pf fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\OneConnectSplashScreen.scale-100.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_duplicate_18.svg fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_signed_out.svg fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-100_contrast-black.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\svgCheckboxUnselected.svg fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Exchange.scale-100.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailWideTile.scale-200.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_sv.properties fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\et_16x11.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\kg_16x11.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_FI-FI.respack fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\AppList.scale-200.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-400.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-400.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\lb_60x42.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exedescription pid process target process PID 3444 wrote to memory of 2956 3444 fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe cmd.exe PID 3444 wrote to memory of 2956 3444 fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe cmd.exe PID 3444 wrote to memory of 2956 3444 fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe"C:\Users\Admin\AppData\Local\Temp\fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe > nul2⤵PID:2956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5262797936249af0fc5c36138847fb982
SHA1154ca864bf4e8878900a9b8a222b8aff1691d7f6
SHA256748da15758ce85368c01a6e16954982abdb2190c03d539e809f7467ca1e7e33d
SHA5125af30dc3353038caba17a52cfd873135de228e3b80b7a40378658c9e9085601049aa8f3bf7ac4ead7ee85da3d441711c7d2f984e9e055b96863acdc6db86bf06