Analysis
-
max time kernel
112s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 13:42
Behavioral task
behavioral1
Sample
15701537546.zip
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
15701537546.zip
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe
-
Size
7.7MB
-
MD5
91de74e4426f8c9118495c56d5fa6b2d
-
SHA1
4797f529e20ff69179cab3dc21b81fbd3a62d6bd
-
SHA256
7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4
-
SHA512
eb955bc67efa46a26d37a382dcb931841151f5c55dfa77d2edc6361927a82953e3a86e77042bd6cb02c0a08a5f566e0335d3f09fca3e09927e1a3ead291520ee
-
SSDEEP
98304:BTrszeuqmeuxWJEO7OdL3vu6+er0NGBJMV1ZAU6tSOsd:1juqmeuxhAiW6yAJMVd6M/d
Score
9/10
Malware Config
Signatures
-
Renames multiple (51) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4328 takeown.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 60 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicudt53_64.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSORES.DLL.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Themes.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\xmsrv.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\archives\data-80bd83b592567d50f84a26711cad1cf82f4057f1.archive.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\classes.jsa 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOCRRES.ORP.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Java\jdk-1.8\lib\tools.jar.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\xmsrv.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSJH.TTC.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\FreshPaint.Model.CX.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files (x86)\Google\Update\Install\{A57FE46C-6BD7-4436-B4ED-1F7F22B87421}\chrome_installer.exe.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\msmdlocal_xl.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\OART.DLL.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\VVIEWER.DLL.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.UI.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Java\jre-1.8\lib\rt.jar.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\xmsrv_xl.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Java\jdk-1.8\lib\ct.sym.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Java\jre-1.8\bin\jfxwebkit.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\rt.jar.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msmdlocal.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSO.DLL.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSORES.DLL.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\WWLIB.DLL.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSYH.TTC.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onmainim.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfxwebkit.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msmdlocal.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\wlibim.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.ghost 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4328 takeown.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3620 wrote to memory of 3848 3620 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe 105 PID 3620 wrote to memory of 3848 3620 7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe 105 PID 3848 wrote to memory of 4328 3848 cmd.exe 107 PID 3848 wrote to memory of 4328 3848 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe"C:\Users\Admin\AppData\Local\Temp\7804e09b2ba224bae06bf23ca2a8b8d668d58b828a8d5aadbbb21c3b7e2acfc4.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\system32\cmd.execmd /C TAKEOWN /F C:\Windows\servicing\TrustedInstaller.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\system32\takeown.exeTAKEOWN /F C:\Windows\servicing\TrustedInstaller.exe3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4328
-
-