Overview
overview
10Static
static
700FAEE82AB...AD.exe
windows7-x64
1001D2E2B398...A9.exe
windows7-x64
100B760ABF10...23.exe
windows7-x64
100B8E9BC319...20.exe
windows7-x64
100D0E7D8626...E5.exe
windows7-x64
100E9765528C...69.exe
windows7-x64
100c9fa52ace...7a.exe
windows7-x64
715f7ea290d...8c.exe
windows7-x64
101CB8203982...26.exe
windows7-x64
101CF69170F7...5E.exe
windows7-x64
101CFEDCBA10...0E.exe
windows7-x64
71DD70E8036...25.exe
windows7-x64
101E229029B2...DA.exe
windows7-x64
101F5FEB3211...6D.exe
windows7-x64
101FD11B5CBB...ED.exe
windows7-x64
1021977fc851...61.exe
windows7-x64
1021e1bc4340...01.exe
windows7-x64
72C3542B5D9...85.exe
windows7-x64
73ac7f91e37...38.exe
windows7-x64
103c0fe521f6...16.exe
windows7-x64
1041c53e90f0...4a.exe
windows7-x64
10467c2b23b7...be.exe
windows7-x64
105b79b6a814...b0.exe
windows7-x64
10712affaa8b...1).exe
windows7-x64
18b04af13b7...21.exe
windows7-x64
10Analysis
-
max time kernel
1791s -
max time network
1562s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 19:21
Behavioral task
behavioral1
Sample
00FAEE82AB5B800CF6DBE97AFD39790B856AD1EC25DC7ED8F798ACA702BEE7AD.exe
Resource
win7-20240704-en
windows7-x64
18 signatures
1800 seconds
Behavioral task
behavioral2
Sample
01D2E2B398D6017D5114464E39C40E9243AE492106CCA8B2D3EB1A95F9E228A9.exe
Resource
win7-20240704-en
windows7-x64
19 signatures
1800 seconds
Behavioral task
behavioral3
Sample
0B760ABF108DB9BF5EA14F96A53F6D8E1B36FCC28BC75114E923482157B89A23.exe
Resource
win7-20240705-en
windows7-x64
20 signatures
1800 seconds
Behavioral task
behavioral4
Sample
0B8E9BC31964C9433BD5CC20E556CFD0590C3B17B0DB23CDC3AD0547683F3820.exe
Resource
win7-20240705-en
windows7-x64
20 signatures
1800 seconds
Behavioral task
behavioral5
Sample
0D0E7D86268F7ACD51E9D4AC94F016034FB949B605B21405CBA0B5581E4532E5.exe
Resource
win7-20240705-en
windows7-x64
17 signatures
1800 seconds
Behavioral task
behavioral6
Sample
0E9765528C4E8FDCFF83FA07A78F5E73B41B3D9295159C823FE3B1F97C113469.exe
Resource
win7-20240708-en
windows7-x64
19 signatures
1800 seconds
Behavioral task
behavioral7
Sample
0c9fa52ace8019b43c91f4859ecddfde6705141b9283fef05c6c4c37a5c1777a.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
1800 seconds
Behavioral task
behavioral8
Sample
15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c.exe
Resource
win7-20240704-en
windows7-x64
21 signatures
1800 seconds
Behavioral task
behavioral9
Sample
1CB82039822CB89811F42B2C3BDBB4256D85D66E942CD69F38D3CB123596C926.exe
Resource
win7-20240705-en
windows7-x64
19 signatures
1800 seconds
Behavioral task
behavioral10
Sample
1CF69170F7419E097EB71B514C01D2A028C95D0605F8B91C90A2E28B3216775E.exe
Resource
win7-20240705-en
windows7-x64
21 signatures
1800 seconds
Behavioral task
behavioral11
Sample
1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
1800 seconds
Behavioral task
behavioral12
Sample
1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
1800 seconds
Behavioral task
behavioral13
Sample
1E229029B2D3FF00EDDE061B1AAF470EE437FA8196D97FAD2C2C6C9EDE5B44DA.exe
Resource
win7-20240708-en
windows7-x64
20 signatures
1800 seconds
Behavioral task
behavioral14
Sample
1F5FEB3211A640804B3951DE9EA2037EFCB0D6EE1019D8853F98DAFD6132A76D.exe
Resource
win7-20240705-en
windows7-x64
19 signatures
1800 seconds
Behavioral task
behavioral15
Sample
1FD11B5CBB32F4CD5E7947F25E900BB4E59C1C5A21922F0A842EC62C20FAF2ED.exe
Resource
win7-20240705-en
windows7-x64
20 signatures
1800 seconds
Behavioral task
behavioral16
Sample
21977fc851dfbcd7c5edcc24ef56750065fcd01e5c9fa4f270424f186a83b061.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
1800 seconds
Behavioral task
behavioral17
Sample
21e1bc4340221fbccee28d59333c20b20755e34e2f3391b90837172bd07fbf01.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
1800 seconds
Behavioral task
behavioral18
Sample
2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe
Resource
win7-20240705-en
windows7-x64
4 signatures
1800 seconds
Behavioral task
behavioral19
Sample
3ac7f91e37572c0d15de4de96ab4719531c30536409fda4acb3e0071ab726338.exe
Resource
win7-20240708-en
windows7-x64
20 signatures
1800 seconds
Behavioral task
behavioral20
Sample
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
Resource
win7-20240704-en
windows7-x64
15 signatures
1800 seconds
Behavioral task
behavioral21
Sample
41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe
Resource
win7-20240704-en
windows7-x64
16 signatures
1800 seconds
Behavioral task
behavioral22
Sample
467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe
Resource
win7-20240708-en
windows7-x64
20 signatures
1800 seconds
Behavioral task
behavioral23
Sample
5b79b6a81407caf12cf1894346a15e40c4dc017a35105119db3b23c7bf91c7b0.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
1800 seconds
Behavioral task
behavioral24
Sample
712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
Resource
win7-20240705-en
windows7-x64
2 signatures
1800 seconds
Behavioral task
behavioral25
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win7-20240704-en
windows7-x64
16 signatures
1800 seconds
General
-
Target
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
-
Size
1020KB
-
MD5
496f86f951e1dbd3c4534d51a5297668
-
SHA1
1199c5f30f5724841905cbdb9787649d15aae3d5
-
SHA256
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621
-
SHA512
382abc596081ca5d0fdea39b12afe433e446cd50f59e4abca818162d96e46465beb1cda631109083071e7c050af6bfcf867be41d02c1e2ebe5dd99f61f45d510
-
SSDEEP
24576:es0fVWVbd8fKT0KqTAFFCa/2yDEmdvAkomBbOsn51D:es0fVWVR8fKTeU1imBbl51D
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral25/memory/2584-3-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-6-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-11-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-13-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-15-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-16-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-17-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-20-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-21-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-22-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-23-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-24-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-25-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-26-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-27-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-28-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-29-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-30-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-31-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-32-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-33-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-34-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-35-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-36-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-37-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-38-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-39-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-40-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-41-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-42-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-43-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-44-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-45-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-46-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-47-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-48-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-49-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-50-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-51-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-52-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-53-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-54-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-55-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-56-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-57-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-58-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-59-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-60-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-61-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-62-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-63-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-64-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-65-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-66-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-67-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-68-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-69-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-70-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-71-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-72-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-73-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-74-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-75-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral25/memory/2584-76-0x0000000000400000-0x00000000005DE000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\47FCAED747FCAED7.bmp" 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\RedoConvert.docx 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\init.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\calendar.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_rest.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\calendar.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\weather.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\settings.css 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\currency.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_m.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\gadget.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\settings.css 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\highDpiImageSwap.js 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\3.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1708 vssadmin.exe 324 vssadmin.exe 2740 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe Token: SeShutdownPrivilege 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2584 wrote to memory of 1792 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 30 PID 2584 wrote to memory of 1792 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 30 PID 2584 wrote to memory of 1792 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 30 PID 2584 wrote to memory of 1792 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 30 PID 2584 wrote to memory of 324 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 32 PID 2584 wrote to memory of 324 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 32 PID 2584 wrote to memory of 324 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 32 PID 2584 wrote to memory of 324 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 32 PID 2584 wrote to memory of 2740 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 36 PID 2584 wrote to memory of 2740 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 36 PID 2584 wrote to memory of 2740 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 36 PID 2584 wrote to memory of 2740 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 36 PID 2584 wrote to memory of 1708 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 38 PID 2584 wrote to memory of 1708 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 38 PID 2584 wrote to memory of 1708 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 38 PID 2584 wrote to memory of 1708 2584 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe 38 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe"C:\Users\Admin\AppData\Local\Temp\8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1792
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:324
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2740
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:1708
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2836
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2