Overview
overview
10Static
static
10323389cde5...f3.exe
windows7-x64
1323389cde5...f3.exe
windows10-2004-x64
1365712147d...a7.exe
windows7-x64
9365712147d...a7.exe
windows10-2004-x64
105474e75872...06.exe
windows7-x64
105474e75872...06.exe
windows10-2004-x64
10out.exe
windows7-x64
3out.exe
windows10-2004-x64
359c59ef90d...4d.exe
windows7-x64
1059c59ef90d...4d.exe
windows10-2004-x64
1063fb410fc5...22.exe
windows7-x64
763fb410fc5...22.exe
windows10-2004-x64
79443472de4...e5.exe
windows7-x64
19443472de4...e5.exe
windows10-2004-x64
197a877b999...8d.exe
windows7-x64
1097a877b999...8d.exe
windows10-2004-x64
10a0f5def5aa...93.exe
windows7-x64
1a0f5def5aa...93.exe
windows10-2004-x64
1abfe442282...b1.exe
windows7-x64
1abfe442282...b1.exe
windows10-2004-x64
1b21f34ecfa...73.exe
windows7-x64
9b21f34ecfa...73.exe
windows10-2004-x64
9b4b97aa67e...a9.zip
windows7-x64
1b4b97aa67e...a9.zip
windows10-2004-x64
1svchost.exe
windows7-x64
9svchost.exe
windows10-2004-x64
9b8ce017478...a8.exe
windows7-x64
9b8ce017478...a8.exe
windows10-2004-x64
9bbb4627895...f2.exe
windows7-x64
1bbb4627895...f2.exe
windows10-2004-x64
1bdf06acf03...63.exe
windows7-x64
1bdf06acf03...63.exe
windows10-2004-x64
1Resubmissions
21-01-2024 14:52
240121-r8syqaeac7 1021-01-2024 14:51
240121-r8k8waeac5 1001-01-2024 13:55
240101-q776kscacp 10Analysis
-
max time kernel
129s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 13:55
Behavioral task
behavioral1
Sample
323389cde5a3059c6c6e5c6c711d11e434a577b11dc07a9aeb7f8e1fb661ecf3.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
323389cde5a3059c6c6e5c6c711d11e434a577b11dc07a9aeb7f8e1fb661ecf3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
out.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
out.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
9443472de461e9e7a9d7b7d89fa13815521db1ecebea5054643664953ee366e5.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
9443472de461e9e7a9d7b7d89fa13815521db1ecebea5054643664953ee366e5.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
97a877b999fb2a3c8286548ac4b20f364a862b132a87272fe273c670a654ba8d.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
97a877b999fb2a3c8286548ac4b20f364a862b132a87272fe273c670a654ba8d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
a0f5def5aaaefa3ae538da9c643a5e381ea89cdee3e451ab1d0c52181d758593.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
a0f5def5aaaefa3ae538da9c643a5e381ea89cdee3e451ab1d0c52181d758593.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
abfe4422828c6515e7b53c50a8f07dda0169f4ee34173357b6fa35b06fe144b1.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
abfe4422828c6515e7b53c50a8f07dda0169f4ee34173357b6fa35b06fe144b1.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
b4b97aa67e2fbfa344053be1c101cbd6560b0a5cfe2de8e2e637ba90c4df2ca9.zip
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
b4b97aa67e2fbfa344053be1c101cbd6560b0a5cfe2de8e2e637ba90c4df2ca9.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
svchost.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral26
Sample
svchost.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
b8ce0174783c9c7ec30f96f8857c356e61365562463457d3ef0d1f62f4d302a8.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral28
Sample
b8ce0174783c9c7ec30f96f8857c356e61365562463457d3ef0d1f62f4d302a8.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
bbb46278959b4628106319457405a8cc04681c82c2c8afa30475d50ed63417f2.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
bbb46278959b4628106319457405a8cc04681c82c2c8afa30475d50ed63417f2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
bdf06acf03785275d01d4135b432b56b31c7f352f9be3cf8eca00286251aa163.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral32
Sample
bdf06acf03785275d01d4135b432b56b31c7f352f9be3cf8eca00286251aa163.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
-
Size
450KB
-
MD5
e70b33103c17c000ac11025d2d8e70a1
-
SHA1
df898d9d0e8e6f2d4eb5d4742d4c206092cdcb34
-
SHA256
365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7
-
SHA512
632461a9c6bff4e013cf3e77a7262d1daaa8775156c61c70dab685ae59114b22d00a47a0214204f6c514c6be77ad5b0c371a889076072fdb1eaf574cb6d4c42c
-
SSDEEP
12288:krYn2GbqdcOuAKi1kcwyEOywAx1gT+yFCv6oE4E:kcNbqdFtVkcwyEOix1GtFCv6F4E
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (8412) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 1760 cmd.exe -
Drops desktop.ini file(s) 40 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Links\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Documents\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Music\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1268429524-3929314613-1992311491-1000\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Music\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Public\Videos\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1268429524-3929314613-1992311491-1000\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0216516.WMF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLOGO.DPV 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\readme.txt 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\readme.txt 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0214934.WMF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\readme.txt 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\calendar.css 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01080_.WMF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0305493.WMF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21326_.GIF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File created C:\Program Files\Microsoft Games\Mahjong\de-DE\readme.txt 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105530.WMF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\ContactSelector.ico 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\readme.txt 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\readme.txt 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\DVD Maker\offset.ax 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\readme.txt 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ADD.GIF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0295069.WMF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186002.WMF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue.css 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTINTL.DLL 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01063_.WMF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\readme.txt 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATWIZ11.POC 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File created C:\Program Files\VideoLAN\VLC\plugins\logger\readme.txt 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jni.h 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199469.WMF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Aspect.thmx 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext.png 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\PREVIEW.GIF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10308_.GIF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR18F.GIF 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2932 timeout.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2664 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2476 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1372 vssvc.exe Token: SeRestorePrivilege 1372 vssvc.exe Token: SeAuditPrivilege 1372 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2664 2476 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe 28 PID 2476 wrote to memory of 2664 2476 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe 28 PID 2476 wrote to memory of 2664 2476 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe 28 PID 2476 wrote to memory of 2664 2476 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe 28 PID 2476 wrote to memory of 1760 2476 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe 33 PID 2476 wrote to memory of 1760 2476 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe 33 PID 2476 wrote to memory of 1760 2476 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe 33 PID 2476 wrote to memory of 1760 2476 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe 33 PID 1760 wrote to memory of 2932 1760 cmd.exe 36 PID 1760 wrote to memory of 2932 1760 cmd.exe 36 PID 1760 wrote to memory of 2932 1760 cmd.exe 36 PID 1760 wrote to memory of 2932 1760 cmd.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe"C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2664
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe" >> NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2932
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372