Resubmissions
17/04/2024, 14:30
240417-rt43faca491017/04/2024, 14:30
240417-rt4fxade5v1017/04/2024, 14:29
240417-rtyknaca441017/04/2024, 14:29
240417-rtsz6sde3z1017/04/2024, 14:29
240417-rtspeade3y1031/07/2022, 05:21
220731-f17w5aade210Analysis
- max time kernel
1803s - max time network
1603s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
17/04/2024, 14:30
Behavioral task
behavioral1
Sample
94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
Resource
win10-20240319-en
windows10-1703-x64
25 signatures
1800 seconds
Behavioral task
behavioral2
Sample
94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
Resource
win7-20240215-en
windows7-x64
17 signatures
1800 seconds
Behavioral task
behavioral3
Sample
94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
Resource
win10-20240404-en
windows10-1703-x64
25 signatures
1800 seconds
Behavioral task
behavioral4
Sample
94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
21 signatures
1800 seconds
Behavioral task
behavioral5
Sample
94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
Resource
win11-20240412-en
windows11-21h2-x64
29 signatures
1800 seconds
General
- Target 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe
- Size 1.5MB
- Sample240417-rt43faca49
- SHA256 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
- MD5 6599f79e40a26186261b58aa89194e5b
- SHA1 0a44b71f930447d545de0f10b6f9c70d513acacc
- SHA512 9e4c8b704bdf6f69df693c40c323f069ac7b9900ab8486d7e5a8423670aa1ee686ccfb6c4026f903d0928145efeee04b0b4cded0000f918862208baba9913748
- SSDEEP 24576:4i9CFkYBMSUkGUbDkAv0f3BIykhWmRkLhKRahLo1ChjllyzD8k20ZItIhi4Gx:4ieMSU0bD7Q3Bfkh9k1VtKChpIzD/Std
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral3/memory/5088-0-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-1-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-2-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-3-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-4-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-5-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-6-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-7-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-8-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-9-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-10-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-11-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-12-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-13-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/5088-16-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/3292-20-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-21-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/5088-22-0x0000000000400000-0x000000000062A000-memory.dmp upx behavioral3/memory/3292-23-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-28-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-29-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-30-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-31-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-32-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-33-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-34-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-37-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-38-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-39-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-40-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-41-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-42-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-43-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-44-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-45-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-46-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-47-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-48-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-49-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-50-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-51-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-52-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-53-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-54-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-55-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-56-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-57-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-58-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-59-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-60-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-61-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-62-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-63-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-64-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-65-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-66-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-67-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-68-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-69-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-70-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-71-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-72-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-73-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral3/memory/3292-74-0x0000000000400000-0x0000000000608000-memory.dmp upx - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\0AEC3A620AEC3A62.bmp" 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5088 set thread context of 3292 5088 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 72 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.scale-100.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache-Light.scale-100.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\it-IT.Messaging.config 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100_contrast-high.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\MedTile.scale-100.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-250.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-256.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1113_20x20x32.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\4613_20x20x32.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-black\Movie-TVStoreLogo.scale-125_contrast-black.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-128.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailBadge.scale-200.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\WideTile.scale-100.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\video.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\aquarium_10h.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-400.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\StopwatchSmallTile.scale-200.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-400.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8794_20x20x32.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\kiss.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\CardBacks\Western.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPageState2\tripeaks_bp_920.jpg 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\LargeTile.scale-100.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-96_altform-unplated.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\western_13c.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Resources\TopicPage\Images\playbutton-rollover.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-200.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\vc_16x11.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\cw_16x11.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\mn_60x42.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionWideTile.scale-200.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxManifest.xml 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\MedTile.scale-200.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-200_contrast-black.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ls_16x11.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\wfh.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-125.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\CoreEngine\Data\BrushProfile\TrailMask.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.targetsize-48.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-125.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-colorize.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-96.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-150_contrast-white.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-30_altform-unplated.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6478_20x20x32.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1949_24x24x32.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PeopleMedTile.scale-125.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\RunningLate.scale-64.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-24.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-72.png 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri SearchUI.exe File created C:\Windows\rescache\_merged\4032412167\4002656488.pri explorer.exe File opened for modification C:\Windows\ 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe File created C:\Windows\rescache\_merged\2717123927\1590785016.pri explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe - Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4892 vssadmin.exe 3980 vssadmin.exe 3628 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000\Software\Microsoft\Internet Explorer\GPU SearchUI.exe - Modifies registry class 32 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "0" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567067019138555" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "0" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80704004100720067006a006200650078002000200032000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000c63dc4260791da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80704004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000d73fa5260791da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc7600000000000000000000000088d27c708a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23" SearchUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23" SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2768987046-1485460554-1347040953-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56" SearchUI.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3292 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 3292 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 3292 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 3292 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeShutdownPrivilege 5088 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe Token: SeCreatePagefilePrivilege 5088 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe Token: SeShutdownPrivilege 5088 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe Token: SeCreatePagefilePrivilege 5088 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe Token: SeBackupPrivilege 4164 vssvc.exe Token: SeRestorePrivilege 4164 vssvc.exe Token: SeAuditPrivilege 4164 vssvc.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe Token: SeShutdownPrivilege 2488 explorer.exe Token: SeCreatePagefilePrivilege 2488 explorer.exe - Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe - Suspicious use of SendNotifyMessage 23 IoCs
pid Process 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3444 SearchUI.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5088 wrote to memory of 3292 5088 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 72 PID 5088 wrote to memory of 3292 5088 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 72 PID 5088 wrote to memory of 3292 5088 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 72 PID 5088 wrote to memory of 3292 5088 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 72 PID 3292 wrote to memory of 4892 3292 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 74 PID 3292 wrote to memory of 4892 3292 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 74 PID 3292 wrote to memory of 3980 3292 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 78 PID 3292 wrote to memory of 3980 3292 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 78 PID 3292 wrote to memory of 3628 3292 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 80 PID 3292 wrote to memory of 3628 3292 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe 80 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exeC:\Users\Admin\AppData\Local\Temp\94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02.exe2⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows3⤵
- Interacts with shadow copies
PID:4892
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:3980
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows3⤵
- Interacts with shadow copies
PID:3628
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2488
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\System32\xfs
- Size 250KB
- SHA256 d8caebb5ceb75cedc4d2677b995ad1a8936fe5e9e696d9387ac8ae8c85e1ddb7
- MD5 5d020c50f963a22db14e5f247e7c3079
- SHA1 c77dbdc5e519ac69cebd4fe921365587942d3069
- SHA512 a09d9e39a95ccee9864e64bcd6a61fbdabdf881770930c8a74f56c17843f02a7e179a69fb63d145440f6ec677445bd945cd0da2a554bc549efe4dad73496a664
- SSDEEP 3072:yU5hXyjKups7zL6SE76iQfARcd6vAIFrLhUzVAsUWX2+d8stCrj0zLgPEANXVVQU:ylKupFB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
- Size 1024KB
- SHA256 68431ab4b4a76a1a635df107e402a68d272c88729c157e5de0fbdf84523b879e
- MD5 f5fef41e3d9b7053177844b3f94d8b61
- SHA1 c0c6384f2e0b56c6ac0b999d8584a2bc9509d20e
- SHA512 7039fbe40f264b4a79df4219fbee8952ad0d05a2501cf9ca5cfd28adc86558dc6df1a2568e486d06b6f50566f1ce74b7b9d0796891b5d1dbabcf077fa7dbd885
- SSDEEP 192:G5J1/Q/8Awcrzu20ZCsBzvjILn3K2h3r2VzF:GRuHwc/p0ZxFjV2h72JF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
- Size 1024KB
- SHA256 0d33335e6c68e79d757546686988e0c34e9f10b40ae2bd6ca6635557e668b34b
- MD5 6f9599bb9f80bae4b496aeeb4428118f
- SHA1 a31beff0f9e07103d873bca51a9fcf5c7884ceb3
- SHA512 203b368d1b13785515034348097d0ce1516d0e7ac5ad073fdd383ff056b145f28fe44d5f8a970e3769abcdc651abb7cd95fef983f086d28b1cd3c7250a12b17c
- SSDEEP 3072:8zVAIgEAIgEAOUns1+nKVY37wOlJWMYwSUoYsUYYUYUYUY:ctAyA0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 7KB
- SHA256 39a780d6a9729f61a05bec79ae999168eaab1a60ad23ba6e63387fc084f1f142
- MD5 75430994a9d6eb12d7d466adc7721020
- SHA1 0f304f258fec9553341dffe96b752e9e086d265b
- SHA512 7ddda9b9d99cb59f11b079830268ad750b99c8368cffa00e552197816b829e307d2879d039023485ab6a5c21df7627376376c31a81966ea5dcad130848b18b8c
- SSDEEP 3:8m/hlFnl9aIEacmVcHRZSRd///H8PSBRJ/AaRd//bg8RC/Ld//:8QmacmVcxZ0dXt7JxdXUuC/LdX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 7KB
- SHA256 ae5d02600316a7ab4bb5a62a68dc0168d9f52c1743c976ae7f148ca5b3c65314
- MD5 efbe7b9d7f45f8d50d1ccb6135a1ead8
- SHA1 28a012b7a1735aa8edd83a5dae131abf603c5055
- SHA512 afe783eb3f94d0759063c4bbeb7e44884d3b302642c619f470353b04efee121117c7736f49cbdecfdb83d879426fe6006189250923e3240c7876239a60ff2531
- SSDEEP 12:cxmO0pSJm5y4Vv6dlUhscSatXe0ozQZs2IrwdLFW0i/foGs:60pSJm5pyd4NrMUZs25py/f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
- Size 1024KB
- SHA256 958dace4d84fd42bcd03b42555384ef4f3f0243ebf234a402470ce6913432190
- MD5 df9e340469f86b3766c7ebe034e1bfc8
- SHA1 f5b63289099c6c7e7b84bda13fa621b59cd2da4d
- SHA512 dcd6c30656954e3551c73249d7bb8805b7c4e39c18164bcd1e67026c566b4effbf28da046019b2a0037743308ebd24a93f598c766b9f7a250d454f4072f2d1d3
- SSDEEP 12:gzsnZvQric0UqYrnVJ45yRPHMLEN7jQN8abnFISxC3nRKW8s+Jl:csZvQric0UqupMXNJbFISGKW8sIl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
- Size 1024KB
- SHA256 be4c85781e9f49a256f5765758ebed9b79cd80bb4381b0c06a8afc04414b93d1
- MD5 f9ea165c2370bfb8f9ed4d8bda861226
- SHA1 7338ab4191d84b2425bdbdab037332d6842ce978
- SHA512 c2aef4aed5a2283251d8e4dd6ff03a9e68edc21642f96882c1fe95f3dfa45c331d479b50bc0515bfd811950f8e1aa909c4b6a0dfc8b14b1e451eb5d378ad4131
- SSDEEP 96:wYxrfD4UarvSU1w9OGamfTkYxrfD4UarvSU1w9OGamfT57kFpsq6:Jxrf0JvSK8Fxrf0JvSK8Vkbsq6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
- Size 24B
- SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
- MD5 ae6fbded57f9f7d048b95468ddee47ca
- SHA1 c4473ea845be2fb5d28a61efd72f19d74d5fc82e
- SHA512 f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 7KB
- SHA256 a2217c7cd4035accbbbd9ae962db7b30e20bbe08b044b3262c3e9bff560b6474
- MD5 ac55afa8805451ed8c829f69e33b915f
- SHA1 222d0bc164ee75a1b80db462c077b27627a517db
- SHA512 2efe7edc68748db50e3105528045562e062371b5553f2437b0bdd39a156b4be7d4edbbdd9f60c69c92dfe337852a44b84fcda8dacf0ace5fbe468ff93b04b8d8
- SSDEEP 3:8m/blll9/l9elke0ul/JR1//:8StEXdl/D1X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 7KB
- SHA256 44a2e81c9fdd22765e7dd395b68f8ece015c3ea5f67a10b5b3f033f6df3885c9
- MD5 b11789aff4cf5efe6bf001345d18c47d
- SHA1 86971412a049e2397709d0aa6f25a3acf82d007a
- SHA512 b6522f132b2d8d9b6591dab82b11d7759438a14f2d32bc2db278f5517d7a562e7f4630d9a96023801026d894bc5201ba1cd776e6c5dc32cfd880ec9bc151eff1
- SSDEEP 12:kjNBxXF9dl/QzgZDaCNyZRU657xHMufbu1HXVYwl2bBU0hQHM1NpVaxrUzifVO3i:Oxdlqg1UmibMBNtfuHLsqTj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\0AEC3A620AEC3A62.bmp
- Size 2.6MB
- SHA256 4aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8
- MD5 993cc909a89f0fb7fe90acc3703c2105
- SHA1 f422cdcb426718b235a19080b0daf71c9b448768
- SHA512 5ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762
- SSDEEP 384:K+5YodRiDf6I03GWBqgcPNyqMmb3T0Nu:
- MD5 SHA1 SHA512 SSDEEP
