Resubmissions
06-04-2024 15:21
240406-srdm5sdg84 1006-04-2024 15:20
240406-sq9desdb3v 1006-04-2024 15:20
240406-sqzh8adg83 1006-04-2024 15:20
240406-sqtmzadg78 1001-02-2022 07:17
220201-h4kxwabbg7 10Analysis
-
max time kernel
1121s -
max time network
1121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
06-04-2024 15:20
Static task
static1
Behavioral task
behavioral1
Sample
414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe
Resource
win7-20231129-en
General
-
Target
414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe
-
Size
1.4MB
-
MD5
4c6f64715df65201b347a48ac66d3daa
-
SHA1
2c4ff72e0f17af6dad7146a2f9de06e1187e0b69
-
SHA256
414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2
-
SHA512
64b3b78a5a22eac66ad73954870e8beb620815735b6c3554c65965c913679d0d78fdc9d5403038101ed1f8a6934cff8377ade62985c839d3ff980a15d1392e6d
-
SSDEEP
24576:AcH4RyUdH474qoYqDDBfdcxVrGpw+yf2fJala9wth/j9O/1:jgh4sqoYiDge3o2xaASZMd
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2232-2-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-1-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-3-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-4-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-5-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-6-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-10-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-11-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-13-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-16-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-38-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-37-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-41-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-42-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-46-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-45-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-47-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-44-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-43-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-48-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-40-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-49-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-50-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-52-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-51-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-53-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-54-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-56-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-55-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-57-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-58-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-59-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-60-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-61-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-62-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-63-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-64-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-65-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-66-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-67-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-68-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-69-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-70-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-71-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-72-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-73-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-74-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-75-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-76-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-78-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-77-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-79-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-80-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-81-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-82-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-83-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-84-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-85-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-86-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-87-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-88-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-89-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-91-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2232-90-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\825E6553825E6553.bmp" 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\settings.js 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_right.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\settings.js 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\EnablePush.raw 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\flyout.html 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\init.js 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\weather.css 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\settings.js 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-right.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.bmp 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\16-on-black.gif 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\settings.css 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_partly-cloudy.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\init.js 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\cpu.css 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\settings.js 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3016 vssadmin.exe 2076 vssadmin.exe 1688 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1596 vssvc.exe Token: SeRestorePrivilege 1596 vssvc.exe Token: SeAuditPrivilege 1596 vssvc.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2076 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 30 PID 2232 wrote to memory of 2076 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 30 PID 2232 wrote to memory of 2076 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 30 PID 2232 wrote to memory of 2076 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 30 PID 2232 wrote to memory of 1688 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 34 PID 2232 wrote to memory of 1688 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 34 PID 2232 wrote to memory of 1688 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 34 PID 2232 wrote to memory of 1688 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 34 PID 2232 wrote to memory of 3016 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 36 PID 2232 wrote to memory of 3016 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 36 PID 2232 wrote to memory of 3016 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 36 PID 2232 wrote to memory of 3016 2232 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe"C:\Users\Admin\AppData\Local\Temp\414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:2076
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1688
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:3016
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD575f8d194ee00ce2b5f00deb6ad9a46d4
SHA15abde7df8e9ca0f52020e6d40c3288dd81dd97cc
SHA256b42aa3508c9827efec14d54bd027842fb62c1aed2b1d4fdc6538007fae38993d
SHA512b5593b9f6c8f44bef1b31cdaede231b290bd8d75e191c8c5f520258bc31ec4e64e1e387ca7162e0783f1aa09a4a542e5810eb609c9e43f5fb3aba0ce2ac2a76f