Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
07/04/2024, 06:24
240407-g6g4bsfa4s 1007/04/2024, 06:24
240407-g6de5sfa3y 1007/04/2024, 06:24
240407-g59f7afe37 1007/04/2024, 06:24
240407-g547gafa3t 1005/03/2022, 21:34
220305-1e7pfsbacj 10Analysis
-
max time kernel
1561s -
max time network
1565s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/04/2024, 06:24
Static task
static1
Behavioral task
behavioral1
Sample
701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe
Resource
win7-20240221-en
General
-
Target
701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe
-
Size
1.2MB
-
MD5
6bb55449f9ad55bb73f25877a1041e1f
-
SHA1
b303f1c9c4564551853cd08a770836aae5725cf2
-
SHA256
701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e
-
SHA512
b6e5393b39ca5f0fc2f5f4a0ed0e5aeb8207e228abb676f4f25a069289dd322cb17b38b0e83f9767a32f9e202fff2adb26d6c4f00660721d3b4b161c07f8e49c
-
SSDEEP
24576:nCM1zIIQedHu6nxFMHjM8lJ5bnAd+V/PTfnT:P1zVB1yI8lJ5bZxTnT
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2864-1-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-2-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-3-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-4-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-5-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-6-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-12-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-13-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-16-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-37-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-38-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-40-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-41-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-43-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-42-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-44-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-45-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-46-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-47-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-48-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-49-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-50-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-51-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-52-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-53-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-54-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-55-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-56-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-57-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-58-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-59-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-60-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-61-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-62-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-63-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-64-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-65-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-66-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-67-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-68-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-69-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-70-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-71-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-72-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-73-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-74-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-75-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-76-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-77-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-78-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-79-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-80-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-81-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-82-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-83-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-84-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-85-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-86-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-87-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-88-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-89-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-91-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-90-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2864-92-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\1E9C08901E9C0890.bmp" 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter_partly-cloudy.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\settings.js 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\settings.js 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\clock.css 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\gadget.xml 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-right.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_h.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\calendar.js 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Java\jre7\Welcome.html 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\greenStateIcon.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\library.js 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\17.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\uninstall.log 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_snow.png 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\settings.js 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\settings.css 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1988 vssadmin.exe 936 vssadmin.exe 1516 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 632 vssvc.exe Token: SeRestorePrivilege 632 vssvc.exe Token: SeAuditPrivilege 632 vssvc.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2864 wrote to memory of 1988 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 30 PID 2864 wrote to memory of 1988 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 30 PID 2864 wrote to memory of 1988 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 30 PID 2864 wrote to memory of 1988 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 30 PID 2864 wrote to memory of 936 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 34 PID 2864 wrote to memory of 936 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 34 PID 2864 wrote to memory of 936 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 34 PID 2864 wrote to memory of 936 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 34 PID 2864 wrote to memory of 1516 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 36 PID 2864 wrote to memory of 1516 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 36 PID 2864 wrote to memory of 1516 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 36 PID 2864 wrote to memory of 1516 2864 701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe"C:\Users\Admin\AppData\Local\Temp\701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:1988
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:936
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:1516
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD58be7bd72b2f6cb1d88d1411e23c2ee48
SHA108231fd392f93d96cb1f366e6002614e1137a2f8
SHA25656dea416d44d9c1c4f7a1588927dcd66a00b4c687a3a882035145af34b1f5ef0
SHA512466420318df77a08882214661e8d7f16c7b1003c74a1cb8772d627fd35e1efcde43213c5cb66d21a372224e105123f45a78ba48c813148344b4f503932a9f300