Resubmissions
05-01-2024 21:06
240105-zx7azaafbl 1005-01-2024 21:06
240105-zxpe6abgh4 1031-12-2023 03:06
231231-dlwjfaeban 10Analysis
-
max time kernel
444s -
max time network
454s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
31-12-2023 03:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
600 seconds
Behavioral task
behavioral2
Sample
630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
600 seconds
Behavioral task
behavioral3
Sample
630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe
Resource
win11-20231215-en
windows11-21h2-x64
9 signatures
600 seconds
General
-
Target
630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe
-
Size
225KB
-
MD5
3a087bb7ce04eef64a82958ee3507548
-
SHA1
ee0a57ac86e2d6e87e8a29109c984a44aab53296
-
SHA256
630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed
-
SHA512
4b314dd8b1992994b8194b6e729055feafb64f873b53289537a3d81f8a54929f5fc9a32bc134ffa3c44a71d7a7ded2f99af77459e3e186d7ccfadbba1747904e
-
SSDEEP
3072:n6syAG2L/wgMrxFSbY3Fq5dQWQC0F0+aLTZtjaPPZMtcdlrRMC/p2wc:6iG2EgwFSc3U5dv0FOTDaPPZME9Bc
Score
9/10
Malware Config
Signatures
-
Renames multiple (7901) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 30 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Public\Documents\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Public\Music\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Public\Videos\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Music\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Links\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Users\Public\desktop.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\autofill_labeling_features_email.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\PREVIEW.GIF 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\THMBNAIL.PNG 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\AddressBook2x.png 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\msedge_200_percent.pak 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\ui-strings.js 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation.png 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\MLModels\autofill_labeling_features.txt.DATA 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\selector.js 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files\Microsoft Office\root\Office16\STARTUP\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Locales\uk.pak.DATA 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\msedge.EtwManifest.man 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\hyph_en_US.dic 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adobe_logo.png 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Mozilla Firefox\defaultagent.ini 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\jvm.lib 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\INDUST.ELM 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\devtools\it.pak.DATA 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\media_poster.jpg 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf.png 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\readme.txt 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\SearchEmail2x.png 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 3612 vssvc.exe Token: SeRestorePrivilege 3612 vssvc.exe Token: SeAuditPrivilege 3612 vssvc.exe Token: SeIncreaseQuotaPrivilege 4128 WMIC.exe Token: SeSecurityPrivilege 4128 WMIC.exe Token: SeTakeOwnershipPrivilege 4128 WMIC.exe Token: SeLoadDriverPrivilege 4128 WMIC.exe Token: SeSystemProfilePrivilege 4128 WMIC.exe Token: SeSystemtimePrivilege 4128 WMIC.exe Token: SeProfSingleProcessPrivilege 4128 WMIC.exe Token: SeIncBasePriorityPrivilege 4128 WMIC.exe Token: SeCreatePagefilePrivilege 4128 WMIC.exe Token: SeBackupPrivilege 4128 WMIC.exe Token: SeRestorePrivilege 4128 WMIC.exe Token: SeShutdownPrivilege 4128 WMIC.exe Token: SeDebugPrivilege 4128 WMIC.exe Token: SeSystemEnvironmentPrivilege 4128 WMIC.exe Token: SeRemoteShutdownPrivilege 4128 WMIC.exe Token: SeUndockPrivilege 4128 WMIC.exe Token: SeManageVolumePrivilege 4128 WMIC.exe Token: 33 4128 WMIC.exe Token: 34 4128 WMIC.exe Token: 35 4128 WMIC.exe Token: 36 4128 WMIC.exe Token: SeIncreaseQuotaPrivilege 4128 WMIC.exe Token: SeSecurityPrivilege 4128 WMIC.exe Token: SeTakeOwnershipPrivilege 4128 WMIC.exe Token: SeLoadDriverPrivilege 4128 WMIC.exe Token: SeSystemProfilePrivilege 4128 WMIC.exe Token: SeSystemtimePrivilege 4128 WMIC.exe Token: SeProfSingleProcessPrivilege 4128 WMIC.exe Token: SeIncBasePriorityPrivilege 4128 WMIC.exe Token: SeCreatePagefilePrivilege 4128 WMIC.exe Token: SeBackupPrivilege 4128 WMIC.exe Token: SeRestorePrivilege 4128 WMIC.exe Token: SeShutdownPrivilege 4128 WMIC.exe Token: SeDebugPrivilege 4128 WMIC.exe Token: SeSystemEnvironmentPrivilege 4128 WMIC.exe Token: SeRemoteShutdownPrivilege 4128 WMIC.exe Token: SeUndockPrivilege 4128 WMIC.exe Token: SeManageVolumePrivilege 4128 WMIC.exe Token: 33 4128 WMIC.exe Token: 34 4128 WMIC.exe Token: 35 4128 WMIC.exe Token: 36 4128 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1628 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 22 PID 1500 wrote to memory of 1628 1500 630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe 22 PID 1628 wrote to memory of 4128 1628 cmd.exe 20 PID 1628 wrote to memory of 4128 1628 cmd.exe 20 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe"C:\Users\Admin\AppData\Local\Temp\630f0ff24aeeae0c8f04383f3e193ac541ff07d371c584d1d8b2aa1f1d6492ed.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A4203AD4-A36E-40F9-8626-D25D7EDCD905}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1628
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A4203AD4-A36E-40F9-8626-D25D7EDCD905}'" delete1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4128