Resubmissions
18-03-2024 13:45
240318-q2hzhaab76 10Analysis
-
max time kernel
1790s -
max time network
1561s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-04-2024 10:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
1800 seconds
Behavioral task
behavioral2
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win10-20240404-en
windows10-1703-x64
23 signatures
1800 seconds
Behavioral task
behavioral3
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
18 signatures
1800 seconds
Behavioral task
behavioral4
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win11-20240412-en
windows11-21h2-x64
26 signatures
1800 seconds
General
-
Target
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
-
Size
1020KB
-
MD5
496f86f951e1dbd3c4534d51a5297668
-
SHA1
1199c5f30f5724841905cbdb9787649d15aae3d5
-
SHA256
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621
-
SHA512
382abc596081ca5d0fdea39b12afe433e446cd50f59e4abca818162d96e46465beb1cda631109083071e7c050af6bfcf867be41d02c1e2ebe5dd99f61f45d510
-
SSDEEP
24576:es0fVWVbd8fKT0KqTAFFCa/2yDEmdvAkomBbOsn51D:es0fVWVR8fKTeU1imBbl51D
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1284-4-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-6-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-7-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-12-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-13-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-14-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-15-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-16-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-17-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-18-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-21-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-22-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-23-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-24-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-25-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-26-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-27-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-28-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-29-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-30-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-31-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-32-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-33-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-34-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-35-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-36-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-37-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-38-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-39-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-40-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-41-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-42-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-43-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-44-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-45-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-46-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-47-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-48-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-49-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-50-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-51-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-52-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-53-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-54-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-55-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-56-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-57-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-58-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-59-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-60-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-61-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-62-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-63-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-64-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-65-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-66-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-67-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-68-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-69-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-70-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-71-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-72-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-73-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1284-74-0x0000000000400000-0x00000000005DE000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\90FFF73E90FFF73E.bmp" 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\splash.gif 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\gadget.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_left.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter_partly-cloudy.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_pressed.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\weather.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\RSSFeeds.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked-loading.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\grayStateIcon.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\settings.css 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\gadget.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\row_over.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1660 vssadmin.exe 1596 vssadmin.exe 1744 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1284 wrote to memory of 2504 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 28 PID 1284 wrote to memory of 2504 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 28 PID 1284 wrote to memory of 2504 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 28 PID 1284 wrote to memory of 2504 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 28 PID 1284 wrote to memory of 1660 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 31 PID 1284 wrote to memory of 1660 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 31 PID 1284 wrote to memory of 1660 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 31 PID 1284 wrote to memory of 1660 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 31 PID 1284 wrote to memory of 1596 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 35 PID 1284 wrote to memory of 1596 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 35 PID 1284 wrote to memory of 1596 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 35 PID 1284 wrote to memory of 1596 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 35 PID 1284 wrote to memory of 1744 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 37 PID 1284 wrote to memory of 1744 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 37 PID 1284 wrote to memory of 1744 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 37 PID 1284 wrote to memory of 1744 1284 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe"C:\Users\Admin\AppData\Local\Temp\8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2504
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:1660
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1596
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:1744
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2552