Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 20:38
Static task
static1
Behavioral task
behavioral1
Sample
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
Resource
win10v2004-20230915-en
General
-
Target
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
-
Size
53KB
-
MD5
5efa19dc204e46e8d8c57482f80e7a40
-
SHA1
5c83b3ddc8417fe64e0bbd3495445ddcee52e35e
-
SHA256
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f
-
SHA512
0cdf4a1263b9a341240acea245155f0afbaac864eccd1d9623a9a152a9287e8a65cd62f12804d5a1293c9d960a4958c2aa05a720f35d42699fec5d4ac0accfc1
-
SSDEEP
768:FKcvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5YW:F9eytM3alnawrRIwxVSHMweio3+
Malware Config
Extracted
C:\ProgramData\regid.1991-06.com.microsoft\how_to_back_files.html
Signatures
-
Renames multiple (947) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-Oblique.otf fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_radio_unselected_18.svg fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Info2x.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-tw\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ru-ru\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-BoldOblique.otf fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-BoldIt.otf fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RDCNotificationClient.appx fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Info.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\help.svg fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\AddressBook.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\cross.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark-2x.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close2x.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\nub.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\plugins.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\selector.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\framework-dev.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close_h.png fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ui-strings.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\init.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\rna-main.js fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\how_to_back_files.html fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5a04d8acde3e56d5707c8277d707f5c3e
SHA1917ab95f70f619a3ee05d0471083ae2b377427b2
SHA25645c479802770e519e3e68bd7df6db8330f79b3bd1165115acba2c1efe180646b
SHA51261a976dc6495f9ebcd09873a69d86faaa2d2e469a8d822932d2abcbc66fb4897d81fb44ceae80ae669d7ae4c86761eaceb92caf232b52c9ab30ebb3ed4b286c2