Resubmissions
18-03-2024 13:45
240318-q2hzhaab76 10Analysis
-
max time kernel
1192s -
max time network
1068s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
14-04-2024 10:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win7-20240319-en
windows7-x64
16 signatures
1200 seconds
Behavioral task
behavioral2
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win10-20240404-en
windows10-1703-x64
23 signatures
1200 seconds
Behavioral task
behavioral3
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
18 signatures
1200 seconds
Behavioral task
behavioral4
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win11-20240412-en
windows11-21h2-x64
25 signatures
1200 seconds
General
-
Target
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
-
Size
1020KB
-
MD5
496f86f951e1dbd3c4534d51a5297668
-
SHA1
1199c5f30f5724841905cbdb9787649d15aae3d5
-
SHA256
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621
-
SHA512
382abc596081ca5d0fdea39b12afe433e446cd50f59e4abca818162d96e46465beb1cda631109083071e7c050af6bfcf867be41d02c1e2ebe5dd99f61f45d510
-
SSDEEP
24576:es0fVWVbd8fKT0KqTAFFCa/2yDEmdvAkomBbOsn51D:es0fVWVR8fKTeU1imBbl51D
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2884-4-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-6-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-7-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-12-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-13-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-14-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-15-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-16-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-17-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-18-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-21-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-22-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-23-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-24-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-25-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-26-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-27-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-28-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-29-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-30-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-31-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-32-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-33-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-34-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-35-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-36-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-37-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-38-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-39-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-40-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-41-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-42-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-43-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-44-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-45-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-46-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-47-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-48-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-49-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-50-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-51-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-52-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-53-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-54-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-55-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-56-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-57-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-58-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-59-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-60-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-61-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-62-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-63-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-64-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-65-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-66-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-67-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-68-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-69-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-70-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-71-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-72-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-73-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/2884-74-0x0000000000400000-0x00000000005DE000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\687CDE21687CDE21.bmp" 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent_partly-cloudy.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\logo.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\cpu.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Mozilla Firefox\application.ini 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_pressed.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\flyoutBack.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\library.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\4.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\settings.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\settings.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\picturePuzzle.css 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\gadget.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\settings.css 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_thunderstorm.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_bottom.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 872 vssadmin.exe 1984 vssadmin.exe 1824 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2936 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 28 PID 2884 wrote to memory of 2936 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 28 PID 2884 wrote to memory of 2936 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 28 PID 2884 wrote to memory of 2936 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 28 PID 2884 wrote to memory of 1824 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 31 PID 2884 wrote to memory of 1824 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 31 PID 2884 wrote to memory of 1824 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 31 PID 2884 wrote to memory of 1824 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 31 PID 2884 wrote to memory of 872 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 35 PID 2884 wrote to memory of 872 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 35 PID 2884 wrote to memory of 872 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 35 PID 2884 wrote to memory of 872 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 35 PID 2884 wrote to memory of 1984 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 37 PID 2884 wrote to memory of 1984 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 37 PID 2884 wrote to memory of 1984 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 37 PID 2884 wrote to memory of 1984 2884 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe"C:\Users\Admin\AppData\Local\Temp\8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2936
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:1824
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:872
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:1984
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:868