Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 07:44
Static task
static1
Behavioral task
behavioral1
Sample
a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe
Resource
win10v2004-20240508-en
General
-
Target
a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe
-
Size
829KB
-
MD5
0b0d76744384d534ebfb2f8d13a682a8
-
SHA1
0461b92274ba9bc94c2da70221de42a49f341c59
-
SHA256
a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23
-
SHA512
5d0c1fbf16571391615b3d42874c85e0a44342af17f75a6bf748fe1d9ec470d894f7a55d0f4bc3f3f18d184686300718f9bf8fc302f1431531308ac2b7ae44a7
-
SSDEEP
24576:M3HugtHvQzVOvrDkuMX4RmUJUlpk0cK1+l0XBk0OI9NE:qHugtHoWDkuE4RmUJa5cpOXi0VNE
Malware Config
Extracted
C:\ProgramData\readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/MAYeHZzawPjL51jqGnH1euFenWdJSCSx4LjdiNz46bQ2ZPugz83x52n5vqW0O76L
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (7595) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
description ioc Process File opened for modification C:\Users\Admin\OneDrive\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Public\Desktop\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Public\Libraries\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Links\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Public\Music\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Public\Downloads\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Videos\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Public\Pictures\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Public\Videos\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Music\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Public\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Public\Documents\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Searches\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Documents\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\desktop.ini a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\en-US\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bn.pak a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.cpl a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\ui-strings.js a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\NIRMALA.TTF a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\dd_arrow_small.png a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_delete_18.svg a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\virgo-new-folder.svg a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\jawt.lib a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\delete.svg a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ui-strings.js a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Trust Protection Lists\Mu\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\ARCTIC.INF a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\WidevineCdm\_platform_specific\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\ui-strings.js a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_checkbox_unselected_18.svg a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\manifest.json a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\PREVIEW.GIF a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforsignature_18.svg a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\ui-strings.js a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files\Microsoft Office\Updates\Apply\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Locales\id.pak a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\ui-strings.js a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_forward_18.svg a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msolui.rll a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-ma\ui-strings.js a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.80\Locales\ar.pak a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\ResiliencyLinks\Locales\en-GB.pak.DATA a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\PREVIEW.GIF a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\ui-strings.js a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files\Google\Chrome\Application\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\readme.txt a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe -
Modifies registry class 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A562E6~1.EXE,1" a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\open\command a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\print\command a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A562E6~1.EXE /p \"%1\"" a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A562E6~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\"" a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\DefaultIcon a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dnd\ShellNew a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dnd\ = "DnD.Document" a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dnd\ShellNew\NullFile a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A562E6~1.EXE \"%1\"" a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\printto a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\printto\command a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\ = "DnD Document" a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\open a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\print a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dnd a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3024 a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe 3024 a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 4800 vssvc.exe Token: SeRestorePrivilege 4800 vssvc.exe Token: SeAuditPrivilege 4800 vssvc.exe Token: SeIncreaseQuotaPrivilege 1956 WMIC.exe Token: SeSecurityPrivilege 1956 WMIC.exe Token: SeTakeOwnershipPrivilege 1956 WMIC.exe Token: SeLoadDriverPrivilege 1956 WMIC.exe Token: SeSystemProfilePrivilege 1956 WMIC.exe Token: SeSystemtimePrivilege 1956 WMIC.exe Token: SeProfSingleProcessPrivilege 1956 WMIC.exe Token: SeIncBasePriorityPrivilege 1956 WMIC.exe Token: SeCreatePagefilePrivilege 1956 WMIC.exe Token: SeBackupPrivilege 1956 WMIC.exe Token: SeRestorePrivilege 1956 WMIC.exe Token: SeShutdownPrivilege 1956 WMIC.exe Token: SeDebugPrivilege 1956 WMIC.exe Token: SeSystemEnvironmentPrivilege 1956 WMIC.exe Token: SeRemoteShutdownPrivilege 1956 WMIC.exe Token: SeUndockPrivilege 1956 WMIC.exe Token: SeManageVolumePrivilege 1956 WMIC.exe Token: 33 1956 WMIC.exe Token: 34 1956 WMIC.exe Token: 35 1956 WMIC.exe Token: 36 1956 WMIC.exe Token: SeIncreaseQuotaPrivilege 1956 WMIC.exe Token: SeSecurityPrivilege 1956 WMIC.exe Token: SeTakeOwnershipPrivilege 1956 WMIC.exe Token: SeLoadDriverPrivilege 1956 WMIC.exe Token: SeSystemProfilePrivilege 1956 WMIC.exe Token: SeSystemtimePrivilege 1956 WMIC.exe Token: SeProfSingleProcessPrivilege 1956 WMIC.exe Token: SeIncBasePriorityPrivilege 1956 WMIC.exe Token: SeCreatePagefilePrivilege 1956 WMIC.exe Token: SeBackupPrivilege 1956 WMIC.exe Token: SeRestorePrivilege 1956 WMIC.exe Token: SeShutdownPrivilege 1956 WMIC.exe Token: SeDebugPrivilege 1956 WMIC.exe Token: SeSystemEnvironmentPrivilege 1956 WMIC.exe Token: SeRemoteShutdownPrivilege 1956 WMIC.exe Token: SeUndockPrivilege 1956 WMIC.exe Token: SeManageVolumePrivilege 1956 WMIC.exe Token: 33 1956 WMIC.exe Token: 34 1956 WMIC.exe Token: 35 1956 WMIC.exe Token: 36 1956 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3024 a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe 3024 a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2904 3024 a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe 93 PID 3024 wrote to memory of 2904 3024 a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe 93 PID 2904 wrote to memory of 1956 2904 cmd.exe 95 PID 2904 wrote to memory of 1956 2904 cmd.exe 95 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe"C:\Users\Admin\AppData\Local\Temp\a562e681906cbb239de7c405a9a32a850e4c0fa1fde875ba2eb2b71babba9f23.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1392B848-B8E6-436A-9AD6-6F0F57C01B2F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1392B848-B8E6-436A-9AD6-6F0F57C01B2F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4672,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:81⤵PID:2548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD504a372cdd23f8bc91474d53be5d5b0bf
SHA11eb3b106975d8a53f16715bd930cdec461b8dfde
SHA256ab27c0b6f29f6a547fd3b50eeeed06fb505a561635ca33a110d1a529ee64800b
SHA5121dc9de3fb04a3ea1051451a56514eef45655cd4dfba56bdde524a81394f442d67ab6493b08400bd931ac51a61d19f7c8882b83ff762fd472de74b51576ac75a7