Analysis
-
max time kernel
92s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 16:07
Static task
static1
Behavioral task
behavioral1
Sample
5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe
Resource
win10v2004-20240709-en
General
-
Target
5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe
-
Size
6.0MB
-
MD5
5559e9f5e1645f8554ea020a29a5a3ee
-
SHA1
d74bd70862707cd2c7ab946903f6fa0aab066151
-
SHA256
5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4
-
SHA512
56835d08f64887c4bd7b0fecd111f4b89411c45398618d815ed9652a0addbf25939fee9f40c4a0315e5e1539c0e87fcd5a9bd73cd7ad43d97d1484763abc5540
-
SSDEEP
98304:YqqGLqEfydHgelcdpKCEAlFcyXSbSOK8AvpDggzc8LeAf5pNR0N75E6:dpLqEWJcd0CEzyibGpDpRRpYtO
Malware Config
Extracted
C:\PerfLogs\README-FILE-XZBQXJLF-1721837261.hta
Extracted
C:\Users\Public\ATOMSILO-README.hta
atomsilo
Email:[email protected]
http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion
Signatures
-
AtomSilo
Ransomware family first seen in September 2021.
-
AtomSilo Ransomware 3 IoCs
resource yara_rule behavioral2/memory/556-2-0x00007FF75C040000-0x00007FF75CA7A000-memory.dmp family_atomsilo behavioral2/memory/556-4016-0x00007FF75C040000-0x00007FF75CA7A000-memory.dmp family_atomsilo behavioral2/memory/556-4027-0x00007FF75C040000-0x00007FF75CA7A000-memory.dmp family_atomsilo -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created \??\c:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-left-pressed.gif.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\ui-strings.js.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\ui-strings.js.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\ui-strings.js.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons.png.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\ko.txt.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.INF.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\ui-strings.js.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\MSFT_PackageManagement.schema.mfl.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\ui-strings.js.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-white\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-focus_32.svg.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\ui-strings.js.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Close.png.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\hu.pak.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\VideoLAN\VLC\plugins\demux\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\en-us\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp.gif.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Windows Media Player\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main.css.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\es-es\ui-strings.js.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Edge.dat.LOG2.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_listview_18.svg.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoEditor.Common\Resources\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ui-strings.js.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\kaa.txt.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\README-FILE-XZBQXJLF-1721837261.hta 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.ATOMSILO 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4928 cmd.exe 4112 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4112 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 556 wrote to memory of 776 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 97 PID 556 wrote to memory of 776 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 97 PID 556 wrote to memory of 1828 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 98 PID 556 wrote to memory of 1828 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 98 PID 556 wrote to memory of 1752 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 99 PID 556 wrote to memory of 1752 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 99 PID 556 wrote to memory of 2608 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 100 PID 556 wrote to memory of 2608 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 100 PID 556 wrote to memory of 1104 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 101 PID 556 wrote to memory of 1104 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 101 PID 556 wrote to memory of 2936 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 102 PID 556 wrote to memory of 2936 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 102 PID 556 wrote to memory of 4568 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 103 PID 556 wrote to memory of 4568 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 103 PID 556 wrote to memory of 808 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 104 PID 556 wrote to memory of 808 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 104 PID 556 wrote to memory of 3920 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 105 PID 556 wrote to memory of 3920 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 105 PID 556 wrote to memory of 2216 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 106 PID 556 wrote to memory of 2216 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 106 PID 556 wrote to memory of 4928 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 107 PID 556 wrote to memory of 4928 556 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe 107 PID 4928 wrote to memory of 4112 4928 cmd.exe 109 PID 4928 wrote to memory of 4112 4928 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe"C:\Users\Admin\AppData\Local\Temp\5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SYSTEM32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵PID:776
-
-
C:\Windows\SYSTEM32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵PID:1828
-
-
C:\Windows\SYSTEM32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵PID:1752
-
-
C:\Windows\SYSTEM32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵PID:2608
-
-
C:\Windows\SYSTEM32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵PID:1104
-
-
C:\Windows\SYSTEM32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵PID:2936
-
-
C:\Windows\SYSTEM32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵PID:4568
-
-
C:\Windows\SYSTEM32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵PID:808
-
-
C:\Windows\SYSTEM32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵PID:3920
-
-
C:\Windows\SYSTEM32\mshta.exemshta "C:\Users\Public\ATOMSILO-README.hta"2⤵PID:2216
-
-
C:\Windows\SYSTEM32\cmd.execmd /c ping 127.0.0.1 -n 6 && del "C:\Users\Admin\AppData\Local\Temp\5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 63⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4112
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5e5666a886578f79fe7887090bf003753
SHA1d1632740b83121d087883eeb538cb26c50f88b63
SHA25655b61c4fac1f18591f00459c722cc8d554841d0bd79a3fdf1cbe6bbe2a02b627
SHA51232a6dc5f166fa3fbf66bcc874a8bf21e3cb868bf22087e6c70f060c4b84518c98164ebc3541612b06054a9cae5f9b6e5a6f1e64029b017410f89eea55e40be54
-
Filesize
6KB
MD55744127b4fb72acc81db2b912d590fdc
SHA12926eeafc7d15f51a12bc1199a514ace40f33dcb
SHA25602c3c7d8896ac0516bae1420bdacbd9d7fa1452bbefbed499048732da95d741b
SHA512031394da51882141ca3f718a21967288214194341bff1fa63f5cc97cb285205e69bb3c65c2df42993bfbf06740bf4858b3f9c13b7e1ba47739b260b66525ba65