Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10013e80dc8e...a8.exe
windows10-2004-x64
7040677c072...cc.exe
windows10-2004-x64
10ba3a15c5f...6a.exe
windows10-2004-x64
1019d029dd80...b2.dll
windows10-2004-x64
101ac4f94c2d...83.exe
windows10-2004-x64
71efeb07862...bb.dll
windows10-2004-x64
327861dacdd...03.exe
windows10-2004-x64
1031860041f6...ff.exe
windows10-2004-x64
33c49ffd8bf...86.dll
windows10-2004-x64
141edb742c1...45.exe
windows10-2004-x64
74ad4c837ce...e1.exe
windows10-2004-x64
150682871a2...53.exe
windows10-2004-x64
65f3bfe76bb...b6.exe
windows10-2004-x64
10784f3902fd...12.exe
windows10-2004-x64
10816c0e4deb...6c.exe
windows10-2004-x64
781b49d3c61...a9.exe
windows10-2004-x64
1082d1e979d2...67.exe
windows10-2004-x64
78ba3f20419...4f.exe
windows10-2004-x64
108d8576432c...fe.exe
windows10-2004-x64
7962bbb1929...e2.exe
windows10-2004-x64
1096f295d08c...d1.exe
windows10-2004-x64
796f2bcea04...28.exe
windows10-2004-x64
109972304b5c...64.exe
windows10-2004-x64
19ff988d7ea...09.exe
windows10-2004-x64
7bfddb59433...b0.exe
windows10-2004-x64
3c0ca77690a...a5.dll
windows10-2004-x64
1cb0f8c9180...69.exe
windows10-2004-x64
10cfbcc54f36...29.exe
windows10-2004-x64
7dd0f55e997...a3.exe
windows10-2004-x64
8ded033da36...58.exe
windows10-2004-x64
7ea55e146fe...59.exe
windows10-2004-x64
10fffd0cdd49...d6.exe
windows10-2004-x64
10Resubmissions
14/11/2023, 17:31
231114-v3qg7acf42 1014/11/2023, 17:21
231114-vxdw7sdg61 1028/10/2023, 19:29
231028-x7cs1age56 1024/10/2023, 13:29
231024-qrn3rsdb6z 1018/10/2023, 12:04
231018-n8ybnaeb31 1007/09/2023, 12:10
230907-pce1wahe2x 10Analysis
-
max time kernel
1794s -
max time network
1150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2023, 12:04
Behavioral task
behavioral1
Sample
013e80dc8e53bd7d98dd94915f05563499b6a323df343bb765a1d3f188753aa8.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral2
Sample
040677c072d3f39edc3d3ec5f95573c1532875c1d57ddc1b62ce396afae016cc.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral4
Sample
19d029dd80a0823d4abe2dfea87b17935844142cb0921eb35a390f70d5f522b2.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
1ac4f94c2d34dbf38aaf1b7b7103349479fbe5b427e45fd213d4f31845958b83.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral6
Sample
1efeb078625478129da10c0e62b0c842e54286312fbb55c38187bda4d78974bb.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
3c49ffd8bfdcc42aee16d8679893aa28f3ed5e433dcf0900ed32f7a88da3f386.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
4ad4c837ce02e146680abb4f673fbca2d5f8588f4ae2c766b393c2b4141a9ee1.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
50682871a2a335d7c5f89cfc1ed16bec99abfa7856a05f54477ee639bbbfd453.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
5f3bfe76bbd22dd8fd936b3833220ba03964b08e28ecf13dafdbbae24a620cb6.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
784f3902fdf296683a82c32aba987fd4c12bbed74a6300582da2d53e23954112.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
816c0e4debc58580e62e0698d31111436c8f99bd895ad2b4d0c9b7c2798dd96c.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral16
Sample
81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral17
Sample
82d1e979d2e673d0b1a47d34c1c968582185e284e0532ed66fd69d0e21063c67.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral18
Sample
8ba3f20419e36946e978e69ae892805569a3b8e5ae702038065296aae8dc414f.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral19
Sample
8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral20
Sample
962bbb1929620dc69e35d52ce7e9684412e16e8ad2727222dbe3e47e9220f8e2.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral21
Sample
96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral22
Sample
96f2bcea04abecb6ba4e87bb6cd62beb439882a9bb013fa12def110ea3335528.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral23
Sample
9972304b5cf97f0369e5b287583931d87dfe984aa698c9123b7061379db68e64.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral24
Sample
9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral25
Sample
bfddb59433bec29faf6210449f73503f38e61234c09be3f405be8196d9d6f8b0.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral26
Sample
c0ca77690ad65d797c3c9a662229046b0cc28e89ca54e0e39c70f656201280a5.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral27
Sample
cb0f8c9180b92b75f130ecdd9fd42fa9c687796313cc968179d1c9b217c65e69.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral28
Sample
cfbcc54f36dbdfc8d78d2be3a6b565f4e25b4d52f51de10ad7e4ca14c7f55d29.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral29
Sample
dd0f55e997999bfddd040f676fd616b99afe386daf1a69c3a02a8324274baba3.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral30
Sample
ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral31
Sample
ea55e146fed653416bd40c92ce89cd61b46035c7bc6f55a33c71a9872e2c9659.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral32
Sample
fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
Resource
win10v2004-20230915-en
General
-
Target
27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe
-
Size
1.3MB
-
MD5
ab10e574b270345ae0c5b25045f637ec
-
SHA1
b7b80abf720246f149c9d57b7daf744690ef1381
-
SHA256
27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503
-
SHA512
b04f2eead322694f588ac47bbf80df7f9161ab6cd460da726619c7bca2b3bc319c2c141d668fa20076a5d8882df1157bd43c8b7a5cdc238fa61c857824df0d25
-
SSDEEP
24576:hUtPLf3UeTgLPgOzwUi9ERQm85EKXqKi76:hU1fUeTwPJzk98e7i76
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral7/memory/2104-1-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-2-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-3-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-4-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-5-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-8-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-11-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-13-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-14-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-15-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-16-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-17-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-18-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-21-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-22-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-23-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-24-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-25-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-26-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-27-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-28-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-29-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-30-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-31-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-32-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-33-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-34-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-35-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-36-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-37-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-38-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-39-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-40-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-41-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-42-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-43-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-44-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-45-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-46-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-47-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-48-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-49-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-50-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-51-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-52-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-53-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-54-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-55-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-56-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-57-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-58-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-59-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-60-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-61-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-62-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-63-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-64-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-65-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-66-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-67-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-68-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-69-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-70-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral7/memory/2104-71-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\796EAB29796EAB29.bmp" 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-125_contrast-black.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\PREVIEW.GIF 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-20_contrast-black.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleWideTile.scale-200.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\BadgeLogo.scale-100_contrast-black.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-36_altform-unplated.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-200_contrast-white.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-80_contrast-white.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-125_contrast-white.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\iheart-radio.scale-125_contrast-white.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfigOnLogon.xml 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\BloodPressureTracker.xltx 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-40.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ImagePlaceholderWhite.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-black_scale-200.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.White.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-36_altform-unplated.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200_contrast-white.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookPromoTile.scale-200.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-unplated_contrast-black.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\archives\archive_manifest.json 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\MixerBranding\mixer_logo.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-150.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\MedTile.scale-200.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-400.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_altform-unplated_contrast-black.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-lightunplated.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jscripts\wefgallerywinrt.js 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-125.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Klondike.Wide.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-100_contrast-white.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-200.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-96_altform-unplated.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-125.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-20.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_DiningReservation.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-72_altform-unplated.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-250.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarLargeTile.scale-100.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-48_altform-unplated.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogoWithTextLight.scale-200.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-256_altform-unplated.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-125.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageLargeTile.scale-150.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\7px.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\2px.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_NinjaCat.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_altform-unplated_contrast-black.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalMedTile.scale-125.png 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 944 vssadmin.exe 184 vssadmin.exe 2672 vssadmin.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1141987721-3945596982-3297311814-1000\{1C9822A7-8F04-4AEA-A3C9-60B7064A39D4} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2104 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe 2104 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe 2104 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe 2104 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeBackupPrivilege 2216 vssvc.exe Token: SeRestorePrivilege 2216 vssvc.exe Token: SeAuditPrivilege 2216 vssvc.exe Token: SeShutdownPrivilege 4896 explorer.exe Token: SeCreatePagefilePrivilege 4896 explorer.exe Token: SeShutdownPrivilege 4896 explorer.exe Token: SeCreatePagefilePrivilege 4896 explorer.exe Token: SeShutdownPrivilege 4896 explorer.exe Token: SeCreatePagefilePrivilege 4896 explorer.exe Token: SeShutdownPrivilege 4896 explorer.exe Token: SeCreatePagefilePrivilege 4896 explorer.exe Token: SeShutdownPrivilege 4896 explorer.exe Token: SeCreatePagefilePrivilege 4896 explorer.exe Token: SeShutdownPrivilege 4896 explorer.exe Token: SeCreatePagefilePrivilege 4896 explorer.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2104 wrote to memory of 944 2104 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe 92 PID 2104 wrote to memory of 944 2104 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe 92 PID 2104 wrote to memory of 184 2104 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe 96 PID 2104 wrote to memory of 184 2104 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe 96 PID 2104 wrote to memory of 2672 2104 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe 98 PID 2104 wrote to memory of 2672 2104 27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe 98 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe"C:\Users\Admin\AppData\Local\Temp\27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:944
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:184
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:2672
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD53e13da8081b4f6f1e5f81ba26c047612
SHA144736ab7a4c384b4ea427deba52511b4342bffef
SHA256be39b2e12eda7f91c197bf8a6ee06addff8e1b0dec7328025deee12fc62608ba
SHA5124f5b95f87c02e044bde8c1eda79bafc2f12da8501facc13826bbfec34455f71f0b66ad51e7c7d2e447fd949b338a581d4dc67a25d6a9a7c16173c98cd6fb4b10