Resubmissions
17-04-2024 15:08
240417-sh9dfsdd79 1017-04-2024 15:08
240417-sh8rxseh9s 1017-04-2024 15:08
240417-sh76dsdd78 1017-04-2024 15:08
240417-sh7vmaeh8z 1017-04-2024 15:08
240417-sh684aeh8y 1015-04-2024 11:51
240415-n1dx2sdg29 1015-04-2024 11:51
240415-n1cd8aga41 1015-04-2024 11:48
240415-nygadsdf57 1015-04-2024 11:48
240415-nyfnvsfh8x 1015-04-2024 11:48
240415-nyfc4adf55 10Analysis
-
max time kernel
1193s -
max time network
1175s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-04-2024 15:08
Static task
static1
Behavioral task
behavioral1
Sample
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe
Resource
win11-20240412-en
General
-
Target
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe
-
Size
1.2MB
-
MD5
c722f0a20113bb1488382daefda9a358
-
SHA1
4d269f0ec76a564f952c348b32a3b59c34bab2b4
-
SHA256
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4
-
SHA512
534a1acdd94846138086a9912f8c2bcf154e0765f80d0a8432004687c76909fa9ab95adef24b8ec67b10cdff2aa59c50d0bf086e034e3b12f4ea484c7605e991
-
SSDEEP
24576:IIvEq8jlEBPkNShzxh7QjO+NhXh1l/JFfnE88smv:najiNOsbQjOuXh1lvESw
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral5/memory/5004-1-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-2-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-3-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-4-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-5-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-8-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-11-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-12-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-14-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-15-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-16-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-17-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-18-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-21-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-22-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-23-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-24-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-25-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-26-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-27-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-28-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-29-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-30-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-31-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-32-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-33-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-34-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-35-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-36-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-37-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-38-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-39-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-40-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-41-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-42-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-43-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-44-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-45-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-46-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-47-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-48-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-49-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-50-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-51-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-52-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-53-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-54-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-55-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-56-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-57-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-58-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-59-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-60-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-61-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-62-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-63-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-64-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-65-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-66-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-67-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-68-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-69-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-70-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral5/memory/5004-71-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exedescription ioc process File opened (read-only) \??\F: 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-243033537-3771492294-1461557691-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\1FAFF6F31FAFF6F3.bmp" 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe -
Drops file in Program Files directory 64 IoCs
Processes:
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-256_altform-unplated.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\Checkbox.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-48.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-80.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-125.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateAppIcon.altform-lightunplated_targetsize-16.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-36_altform-unplated.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.ini 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Images\Square44x44Logo.targetsize-24_altform-unplated.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\Keytip.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\Logo.scale-200.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-24.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-32_altform-unplated.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\AppxManifest.xml 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.tree.dat 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogo.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MediumTile.scale-200_contrast-black.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64_altform-unplated_contrast-black.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-48_altform-lightunplated.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlOuterCircle.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-20_contrast-black.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-125.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-400.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.scale-200.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubAppList.targetsize-32_altform-unplated.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\Assets\Wide310x150Logo.scale-200.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\scroll.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-200.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\FeedbackHubStoreLogo.scale-125.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-100.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\AppCS\Assets\EmptyStoryCover.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\dom\getDocument.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\setFocusVisibility.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-256.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.targetsize-36_altform-lightunplated.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DocumentCard\DocumentCardActions.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\DocumentCardActions.base.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DetailsList\DetailsList.types.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\TeachingBubble.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-100.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\warn\warnMutuallyExclusive.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\overflow.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-96_altform-unplated_contrast-white.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WeatherAppList.targetsize-96_altform-unplated_contrast-black.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\ComboBox\ComboBox.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\FocusZone.js 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeWideTile.scale-150.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-24.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsAppList.targetsize-80_altform-lightunplated_contrast-black.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\iheart-radio.scale-200.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-150.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-400.HCWhite.png 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 5024 vssadmin.exe 4748 vssadmin.exe 4780 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-243033537-3771492294-1461557691-1000\{080678E6-F641-4C91-8ED1-65C5C1A434AD} explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exepid process 5004 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe 5004 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe 5004 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe 5004 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
vssvc.exeexplorer.exedescription pid process Token: SeBackupPrivilege 4632 vssvc.exe Token: SeRestorePrivilege 4632 vssvc.exe Token: SeAuditPrivilege 4632 vssvc.exe Token: SeShutdownPrivilege 3644 explorer.exe Token: SeCreatePagefilePrivilege 3644 explorer.exe Token: SeShutdownPrivilege 3644 explorer.exe Token: SeCreatePagefilePrivilege 3644 explorer.exe Token: SeShutdownPrivilege 3644 explorer.exe Token: SeCreatePagefilePrivilege 3644 explorer.exe Token: SeShutdownPrivilege 3644 explorer.exe Token: SeCreatePagefilePrivilege 3644 explorer.exe Token: SeShutdownPrivilege 3644 explorer.exe Token: SeCreatePagefilePrivilege 3644 explorer.exe Token: SeShutdownPrivilege 3644 explorer.exe Token: SeCreatePagefilePrivilege 3644 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
explorer.exepid process 3644 explorer.exe 3644 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
explorer.exepid process 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe 3644 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exedescription pid process target process PID 5004 wrote to memory of 5024 5004 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe vssadmin.exe PID 5004 wrote to memory of 5024 5004 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe vssadmin.exe PID 5004 wrote to memory of 4748 5004 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe vssadmin.exe PID 5004 wrote to memory of 4748 5004 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe vssadmin.exe PID 5004 wrote to memory of 4780 5004 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe vssadmin.exe PID 5004 wrote to memory of 4780 5004 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe vssadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe"C:\Users\Admin\AppData\Local\Temp\3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:5024 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:4748 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:4780
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5ae7be685a6953b05916a21c0c21b2595
SHA1b07aaf912010422f0c8627f2ac129c8bc548ebad
SHA256f4aac9c93c111068c6622920517164f2fecb0358e9c1727f29aa8e2cf2bb2a17
SHA512209fa91299530e727adb1043e23e7346f7ef9aa0a88b78b63a4c148cb59c93f15ab2c06829727975349623535bb773307e25a693d6cb5830219453dada624879