Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24-07-2024 16:07
Static task
static1
Behavioral task
behavioral1
Sample
5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe
Resource
win10v2004-20240709-en
General
-
Target
5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe
-
Size
6.0MB
-
MD5
5559e9f5e1645f8554ea020a29a5a3ee
-
SHA1
d74bd70862707cd2c7ab946903f6fa0aab066151
-
SHA256
5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4
-
SHA512
56835d08f64887c4bd7b0fecd111f4b89411c45398618d815ed9652a0addbf25939fee9f40c4a0315e5e1539c0e87fcd5a9bd73cd7ad43d97d1484763abc5540
-
SSDEEP
98304:YqqGLqEfydHgelcdpKCEAlFcyXSbSOK8AvpDggzc8LeAf5pNR0N75E6:dpLqEWJcd0CEzyibGpDpRRpYtO
Malware Config
Extracted
C:\MSOCache\README-FILE-MVFYZPLM-1721837267.hta
Extracted
C:\Users\Public\ATOMSILO-README.hta
atomsilo
Email:[email protected]
http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion
Signatures
-
AtomSilo
Ransomware family first seen in September 2021.
-
AtomSilo Ransomware 5 IoCs
resource yara_rule behavioral1/memory/2816-11-0x000000013FC90000-0x00000001406CA000-memory.dmp family_atomsilo behavioral1/memory/2816-10-0x000000013FC90000-0x00000001406CA000-memory.dmp family_atomsilo behavioral1/memory/2816-1090-0x000000013FC90000-0x00000001406CA000-memory.dmp family_atomsilo behavioral1/memory/2816-1109-0x000000013FC90000-0x00000001406CA000-memory.dmp family_atomsilo behavioral1/memory/2816-3377-0x000000013FC90000-0x00000001406CA000-memory.dmp family_atomsilo -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Deletes itself 1 IoCs
pid Process 1928 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File created \??\c:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README-FILE-MVFYZPLM-1721837267.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\CHICAGO.XSL.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\TEAROFF.POC.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\THMBNAIL.PNG.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME24.CSS.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR42F.GIF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\README-FILE-MVFYZPLM-1721837267.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\README-FILE-MVFYZPLM-1721837267.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\ga\README-FILE-MVFYZPLM-1721837267.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105502.WMF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151047.WMF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\index.html 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\README-FILE-MVFYZPLM-1721837267.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198447.WMF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01627_.WMF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ENGDIC.DAT.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SUBMIT.JS.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\ta\README-FILE-MVFYZPLM-1721837267.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02094_.WMF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WITHCOMP.DPV.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\7-Zip\Lang\README-FILE-MVFYZPLM-1721837267.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00476_.WMF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Document Themes 14\Apothecary.thmx.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\README-FILE-MVFYZPLM-1721837267.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\va.txt.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Common Files\System\MSMAPI\README-FILE-MVFYZPLM-1721837267.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00127_.WMF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\README-FILE-MVFYZPLM-1721837267.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\README-FILE-MVFYZPLM-1721837267.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdater.cer.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.INF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01069_.WMF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Premium.gif.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14582_.GIF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\index.html 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\ICE.INF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285822.WMF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SlateBlue.css.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\DataSet.zip.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.EPS.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\BLUEPRNT.ELM.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01680_.WMF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG_K_COL.HXK.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1928 cmd.exe 1044 PING.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1044 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2144 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 32 PID 2816 wrote to memory of 2144 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 32 PID 2816 wrote to memory of 2144 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 32 PID 2816 wrote to memory of 1092 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 33 PID 2816 wrote to memory of 1092 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 33 PID 2816 wrote to memory of 1092 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 33 PID 2816 wrote to memory of 920 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 34 PID 2816 wrote to memory of 920 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 34 PID 2816 wrote to memory of 920 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 34 PID 2816 wrote to memory of 2092 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 35 PID 2816 wrote to memory of 2092 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 35 PID 2816 wrote to memory of 2092 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 35 PID 2816 wrote to memory of 2016 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 36 PID 2816 wrote to memory of 2016 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 36 PID 2816 wrote to memory of 2016 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 36 PID 2816 wrote to memory of 2012 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 37 PID 2816 wrote to memory of 2012 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 37 PID 2816 wrote to memory of 2012 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 37 PID 2816 wrote to memory of 760 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 38 PID 2816 wrote to memory of 760 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 38 PID 2816 wrote to memory of 760 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 38 PID 2816 wrote to memory of 1408 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 39 PID 2816 wrote to memory of 1408 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 39 PID 2816 wrote to memory of 1408 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 39 PID 2816 wrote to memory of 1524 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 40 PID 2816 wrote to memory of 1524 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 40 PID 2816 wrote to memory of 1524 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 40 PID 2816 wrote to memory of 2164 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 41 PID 2816 wrote to memory of 2164 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 41 PID 2816 wrote to memory of 2164 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 41 PID 2816 wrote to memory of 1928 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 42 PID 2816 wrote to memory of 1928 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 42 PID 2816 wrote to memory of 1928 2816 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 42 PID 1928 wrote to memory of 1044 1928 cmd.exe 44 PID 1928 wrote to memory of 1044 1928 cmd.exe 44 PID 1928 wrote to memory of 1044 1928 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe"C:\Users\Admin\AppData\Local\Temp\5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\system32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵
- Modifies Internet Explorer settings
PID:2144
-
-
C:\Windows\system32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵
- Modifies Internet Explorer settings
PID:1092
-
-
C:\Windows\system32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵
- Modifies Internet Explorer settings
PID:920
-
-
C:\Windows\system32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵
- Modifies Internet Explorer settings
PID:2092
-
-
C:\Windows\system32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵
- Modifies Internet Explorer settings
PID:2016
-
-
C:\Windows\system32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵
- Modifies Internet Explorer settings
PID:2012
-
-
C:\Windows\system32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵
- Modifies Internet Explorer settings
PID:760
-
-
C:\Windows\system32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵
- Modifies Internet Explorer settings
PID:1408
-
-
C:\Windows\system32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵
- Modifies Internet Explorer settings
PID:1524
-
-
C:\Windows\system32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵
- Modifies Internet Explorer settings
PID:2164
-
-
C:\Windows\system32\cmd.execmd /c ping 127.0.0.1 -n 6 && del "C:\Users\Admin\AppData\Local\Temp\5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe"2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 63⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1044
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD550b504cfe3ec7c904159ebc3db387274
SHA19356f88ff67dbdc3bdce75d595abe4c4d11eb70b
SHA2560eacc12448c7866cbfd229c0df516aa22c347e350b6a125fb356144c58c6784e
SHA512e8f14125cb470b5861539fd482786c6ae12f9e5b74b084edece94d5772fd6d7725aa9d2b99696f5fb4437d6155c524895aa08e5f04fa64b0da8146b29fb9cbc3
-
Filesize
6KB
MD55744127b4fb72acc81db2b912d590fdc
SHA12926eeafc7d15f51a12bc1199a514ace40f33dcb
SHA25602c3c7d8896ac0516bae1420bdacbd9d7fa1452bbefbed499048732da95d741b
SHA512031394da51882141ca3f718a21967288214194341bff1fa63f5cc97cb285205e69bb3c65c2df42993bfbf06740bf4858b3f9c13b7e1ba47739b260b66525ba65