Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20/03/2024, 10:57
Static task
static1
Behavioral task
behavioral1
Sample
b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe
Resource
win10v2004-20240226-en
General
-
Target
b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe
-
Size
374KB
-
MD5
a2c68e2567e5ed1882e75e724d35d16b
-
SHA1
0cdb5a4e701121a373deb9d6157ee698f88160bc
-
SHA256
b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a
-
SHA512
a47aaf12bf8577191773a180c31b5a4f1e8ee3629f1b962a0ae2d2bc4d4e297e0f74614a26f2aeef37c1566945cf3003252b34b91fe58ed3660036ab6ece082d
-
SSDEEP
6144:70dryUTkT5ZLewnleutuIsjrwtO/C3mT+OFGMTZSzxyBKq:iyUc5ZLnc6uIsjrwtv2TPFGMVSzpq
Malware Config
Extracted
\Device\HarddiskVolume1\HOW TO BACK FILES.txt
targetcompany
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1516 bcdedit.exe 3148 bcdedit.exe -
Renames multiple (6517) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\R: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\S: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\W: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\G: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\K: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\O: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\T: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\H: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\M: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\A: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\I: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\J: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\Q: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\U: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\V: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\D: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\E: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\Z: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\X: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\Y: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\P: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\B: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened (read-only) \??\L: b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-400.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\svgCheckboxSelected.svg b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d0.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\ui-strings.js b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-400_contrast-black.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-100.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-100.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\mk-MK\View3d\3DViewerProductDescription-universal.xml b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\office.x-none.msi.16.x-none.vreg.dat b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MixedRealityPortalMedTile.scale-100.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-200.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lt_get.svg b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-125_contrast-black.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\mso0127.acl b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-36_altform-unplated_contrast-white.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\1.jpg b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\be-BY\View3d\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-100.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\illustration-UploadToOD.svg b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-256_altform-unplated.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons_2x.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close_h.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactNative\Tracing\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-100_contrast-black.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.stats.json b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-30_altform-unplated.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\icon_rotate.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\LargeTile.scale-200.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\wmpnscfg.exe.mui b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Resources\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\UserControls\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\HOW TO BACK FILES.txt b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-400.png b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeDebugPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe Token: SeTakeOwnershipPrivilege 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 764 wrote to memory of 4260 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe 88 PID 764 wrote to memory of 4260 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe 88 PID 764 wrote to memory of 748 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe 90 PID 764 wrote to memory of 748 764 b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe 90 PID 4260 wrote to memory of 1516 4260 cmd.exe 94 PID 4260 wrote to memory of 1516 4260 cmd.exe 94 PID 748 wrote to memory of 3148 748 cmd.exe 95 PID 748 wrote to memory of 3148 748 cmd.exe 95 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe"C:\Users\Admin\AppData\Local\Temp\b39fc2d3594b643416f6ff93aa48dad1fb2e9ee1410933daaaac7ec23c86d14a.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:764 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1516
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:3148
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.ff33ee1b.pri
Filesize137KB
MD5c588fb06904b8f043b39609dc13655fb
SHA16298e141b8d9ff6467ffa4ec2818b6bd93d6fedf
SHA256acd13c5f0a73eb7eb5e3a703fa048b4fdf221f3bb3be89e83c4b1a96e6d8de3e
SHA5126127452cdd2dafd7a56599514b4604d08e2ffbb79eb73686d3f1d088609cfd0eaafa0739c569d0a16d2f32bd59eca9d82c6f22e531c26644035f2ae02ada44b4
-
Filesize
12B
MD58cf4dec152a9d79a3d62202b886eda9b
SHA10c1b3d3d02c0b655aa3526a58486b84872f18cc2
SHA256c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01
SHA512a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd
-
Filesize
1KB
MD5206d3a42479f33b34a8d362ee7ee30c1
SHA1d5fc90d15d1ff211f4b6befd017f24820a07464f
SHA25618a46607662388d0574ba6db0537acddcdd4cfe0b65be98a4e27aa4e249f25c3
SHA512d030bf7141d7c8a446db2eac9b6b2f473607b82c90ff4d2e3d87f3e1fe8b510a87452e2fdd3b7addae530e215f2048a42da4bd23991e14926cf2fa380553bd1c