Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
31/05/2024, 06:36
Static task
static1
Behavioral task
behavioral1
Sample
45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe
Resource
win11-20240426-en
General
-
Target
45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe
-
Size
478KB
-
MD5
71efe7a21da183c407682261612afc0f
-
SHA1
0f1aea2cf0c9f2de55d2b920618a5948c5e5e119
-
SHA256
45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d
-
SHA512
3cff597dbd7f0d5ab45b04e3c3731e38626b7b082a0ede7ab9a7826921848edb3c033f640da2cb13916febf84164f7415ca9ac50c3d927f04d9b61fcadb7801c
-
SSDEEP
6144:W0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:7zv66zaISTW9asWxxAh4IlXC4PUqBq/
Malware Config
Extracted
\Device\HarddiskVolume1\HOW TO BACK FILES.txt
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 3144 bcdedit.exe 3412 bcdedit.exe -
Renames multiple (7059) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\Q: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\R: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\Y: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\H: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\G: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\L: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\M: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\O: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\S: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\W: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\A: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\E: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\N: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\P: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\U: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\X: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\D: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\I: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\K: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\T: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\V: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\Z: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened (read-only) \??\B: 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsAppList.targetsize-40_contrast-black.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-24.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-20_contrast-black.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\LockScreenLogo.scale-200_contrast-white.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\Breadcrumb\index.js 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WeatherAppList.targetsize-20_altform-unplated_contrast-black.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\MapsLargeTile.scale-125.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-32_altform-unplated.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.targetsize-80_altform-lightunplated.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-200_contrast-black.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DetailsList\DetailsHeader.styles.js 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Facepile.js 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\ui-strings.js 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\CameraLargeTile.scale-125.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\AdaptiveCards.Rendering.Uwp.lib 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluCCFilesEmpty_180x180.svg 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_altform-unplated_contrast-black.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateAppIcon.altform-unplated_targetsize-24.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\OutOfOffice_Dark.scale-400.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-36_contrast-black.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-down.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\currency.data 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-125_contrast-black.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\contrast-white\MicrosoftSolitaireWideTile.scale-200_contrast-white.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-80.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.scale-100.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\extendComponent.js 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ru-ru\ui-strings.js 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-24_altform-unplated.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-150.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\selection\Selection.types.js 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_altform-lightunplated_contrast-black.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubMedTile.scale-200.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\dist\fluentui-react.min.js 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\ui-strings.js 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24_altform-unplated_contrast-black.png 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\react\jsx-dev-runtime.js 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\ui-strings.js 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_neutral_~_cw5n1h2txyewy\microsoft.system.package.metadata\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\HOW TO BACK FILES.txt 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Microsoft.Support.SDK.winmd 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Notifications\SoftLandingAssetLight.gif.DATA 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeDebugPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe Token: SeTakeOwnershipPrivilege 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 396 wrote to memory of 5084 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe 76 PID 396 wrote to memory of 5084 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe 76 PID 396 wrote to memory of 2884 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe 78 PID 396 wrote to memory of 2884 396 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe 78 PID 2884 wrote to memory of 3144 2884 cmd.exe 82 PID 2884 wrote to memory of 3144 2884 cmd.exe 82 PID 5084 wrote to memory of 3412 5084 cmd.exe 83 PID 5084 wrote to memory of 3412 5084 cmd.exe 83 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe"C:\Users\Admin\AppData\Local\Temp\45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:396 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:3412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:3144
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
910B
MD5d644c148487a334ffbaf033a4acb0918
SHA10bc1b851d90bca13c5a56ca8d03a4eb3f7039d89
SHA25656076637e72c27da75505b75d844446f299f7c9b03c4c51be404cd4531a29de6
SHA51210f49863937692fddcd41af3247de3a3286af15e53993473f57617bd06aa0603ec7c7a34a5408a2119b672de5884bd32fd63ae72b42b97b3812c4b3602b459c9