Malware Analysis Report

2024-10-16 03:03

Sample ID 240921-zdb1qasekl
Target 8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160
SHA256 8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160
Tags
cryptone packer netwalker defense_evasion discovery execution impact ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160

Threat Level: Known bad

The file 8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160 was found to be: Known bad.

Malicious Activity Summary

cryptone packer netwalker defense_evasion discovery execution impact ransomware spyware stealer

Netwalker Ransomware

Detected Netwalker Ransomware

Deletes shadow copies

Renames multiple (6663) files with added filename extension

CryptOne packer

Renames multiple (7383) files with added filename extension

Reads user/profile data of web browsers

Deletes itself

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Uses Volume Shadow Copy service COM API

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-21 20:35

Signatures

CryptOne packer

cryptone packer
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-21 20:35

Reported

2024-09-21 20:38

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe"

Signatures

Detected Netwalker Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwalker Ransomware

ransomware netwalker

Deletes shadow copies

ransomware defense_evasion impact execution

Renames multiple (7383) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\2FAF28-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14753_.GIF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107742.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR46B.GIF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107350.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\2FAF28-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN082.XML C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\2FAF28-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099157.JPG C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00910_.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21413_.GIF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00792_.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pl.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107748.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107712.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Andorra C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18193_.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Havana C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03331_.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGNAVBAR.XML C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103402.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.DEV_COL.HXT C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sq.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00058_.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKREQ.CFG C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0301050.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02291U.BMP C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0157995.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\2FAF28-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\2FAF28-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Lima C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02124_.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.HTM C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files\Java\jre7\lib\2FAF28-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImages.jpg C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\BG_ADOBE.GIF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105974.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241019.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14833_.GIF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0230558.WMF C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mr.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_F_COL.HXK C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIcons.jpg C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\notepad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 548 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\system32\vssadmin.exe
PID 548 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\system32\vssadmin.exe
PID 548 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\system32\vssadmin.exe
PID 548 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\system32\vssadmin.exe
PID 548 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\notepad.exe
PID 548 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\notepad.exe
PID 548 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\notepad.exe
PID 548 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\notepad.exe
PID 548 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\cmd.exe
PID 548 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\cmd.exe
PID 548 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\cmd.exe
PID 548 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\cmd.exe
PID 2904 wrote to memory of 5428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2904 wrote to memory of 5428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2904 wrote to memory of 5428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2904 wrote to memory of 5428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe

"C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe"

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\2FAF28-Readme.txt"

C:\Windows\SysWOW64\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\473D.tmp.bat"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /PID 548

Network

N/A

Files

memory/548-0-0x00000000002C0000-0x00000000002E6000-memory.dmp

memory/548-1-0x0000000000400000-0x0000000000414000-memory.dmp

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\2FAF28-Readme.txt

MD5 87d8824c9a6f302b3ef5d18d6acdee7a
SHA1 655e9a41d867c854856d3200b6b7df01e89516c8
SHA256 6111f2d1fab67db7af88a2d3774c7fc9bfe5f5f8983af1186ea4bc6296d98963
SHA512 b70f8d53814ed9514e618151805a8a26377645d477c6d5e43c49406df311f615e6afa0d402ab7ba80f7d68d21b3a9eabb3ee6f6342b0618c027bcee585f121b0

memory/548-1948-0x0000000000400000-0x0000000000414000-memory.dmp

memory/548-2276-0x0000000000400000-0x000000000044B000-memory.dmp

memory/548-6877-0x0000000000400000-0x000000000044B000-memory.dmp

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MTOC_help.H1H.2faf28

MD5 29e162eae22da9865e2bfc1f42e18b95
SHA1 c82d2f64222c3612f5e2410b46e2dceee84658ea
SHA256 9c32f5da741e9daf2f1ea644da007f41438b77cdf2d761890ae17b0cb093afc9
SHA512 966a7a7028312ad51122bc003131579dc5da64739b4271918620146bc182a032734db2fdae95922c3af9d9f9262a0146d6249b699461cd7d8e9291262bec465c

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_AssetId.H1W.2faf28

MD5 33d592dc4bef454dcfcc943404bff5c6
SHA1 c0e82a9999a8e95141fdeef7f6550d1b89339561
SHA256 d813dc2c2df2fe156e1f3eb69891f7045163cbb058bef99b5fb72bd1d1337f12
SHA512 b90f7e02d86a347a169a2c3a9af7430483607abfb8089c8a1c21eea6a432a3aa3905982fe737f0dfaef4391b05ba8f1e1b67af81f405ff528fed53d0824e4b4a

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help{E1E8F15E-8BEC-45DF-83BF-50FF84D0CAB5}.H1Q.2faf28

MD5 66dfd4b49ffcf7cdd48fe7ec9c5de49d
SHA1 cda02fe668988a285d7544ea99d89f411ae68d8f
SHA256 0aa4ee75ebe46172fda4e39cafb411c5ee0d3eb33afc8fdb84e1a1f48a410071
SHA512 d1fe26ddf586fce003435d3672a2980df11e7168a8b650655bab2baf96768918d906ffa5ce2c42799fffe05eff8a95a1aa4fea372bf43cc09b71f5e1b40b3678

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.Lck.2faf28

MD5 636efe0f5e9b28e7d3b9336ac7470ce5
SHA1 78ecd9112f178bd1b20d716c44c184d90132223e
SHA256 4f76a0c655c27a1b8bc4e71b7043ad288d07ca9f0e3616e184f8564dc11ea86e
SHA512 e31460be9c82acb5b755dbf2b981af727dcf64e4856228dd3da7d465cb48066393ea60b9d9fc17dbda6cb0b50343c5cd5490fe72d6ed8365b130991d8a60c02c

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_BestBet.H1W.2faf28

MD5 911bc9d755940bbb7c87a03e6a54c439
SHA1 8ae740547530b4e923a09272b6d24a37971024c4
SHA256 3cc0a18d2027bbedbd22d96d20eaad2b374a8429f42b5348b26b63d98ffed1d3
SHA512 851edcc6237bde74b391d7c37dd5ad1d9ca60790177fa7462e27462c338d334ef54c5b99bf2c74626382bf0d000b5740dda7e0b275ee5d46caf5f7a60098eb47

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.H1D.2faf28

MD5 2a5df62ebac1137a957759f1d1013233
SHA1 230306002558c4ca122997e1274415f2dd2c39b8
SHA256 f525f4ebbb3fa5ad946a31c442bce3962f97563de7b431360805d1950b30c7b6
SHA512 5b2cd8f0796ad49c934f57f685f7a04591a1254735faf3768e82e3bbdf9868d80e0979986ef98bc418abb8ab4252194ab3fae911ec73244216ff97ab5e38975a

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_BestBet.H1W.2faf28

MD5 5d205aeb2582bf4ab89dd70c29154ccd
SHA1 182619a9b8b9780ffb9433ada800a8bfba85c9ac
SHA256 d5845d396bbd1d1ca6c75a8bab6007a985acb38d0e9f8903f398c18a4449eb65
SHA512 7ea58c35c2ef4f81df85d3e717c32b57c75203fec5ae4b85411e7661258fb86e33b98a528892a1bdf87948feb0d6eaed9ae9708d930c8a012b70365e41a8c2c9

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_CValidator.H1D.2faf28

MD5 01514c62717f0636a3ccce6a9f036916
SHA1 fbf6438a73f27a6d453672d3e35a3c23ee8221e2
SHA256 5284b700de79afe5fa7d175e3681f5c67d1c576555b2bf0d44e3aba94e69dbf6
SHA512 78d8db13ee38e91cfbb49602477fd0d353b3cd0e7d4f7f81237f6c7f90379397fbfc45353b6cd5f09a170c13c4046980547e7c663a28dc098e506db822a93d74

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MTOC_help.H1H.2faf28

MD5 877687b1b04e9e1c87b5e91fa19576e2
SHA1 db82f730bde050578a80e290d45fa4553196cdeb
SHA256 2bf8a4adbdd0f39523efb9006fef9bcf3b50d3853334fa90d18ee73d2f8be4b7
SHA512 e129b854a8b53d753eb91b85adce40e75be584de5dd4d2c35e2c15d2cbbd6aa39e8bdfee1cd19e097819f8f2d2125d1aa62d29aac44365f94101b1ba3306bc36

C:\Users\Admin\AppData\Local\Temp\473D.tmp.bat

MD5 90e822212c4e1769a5ec347d90e574e6
SHA1 32d80ed19d13ac04958ea420b76a2849ee02598c
SHA256 5715b23eeeb9c46be3bd313454bc23d0b8d2f357a71e9e586b4fde24829095ae
SHA512 558811b1d3e1d55d2eabfbbe5c258e4adafb73b39959c87462c0ad6de9deff8db2a8d469de9ba0cbbe22efc207ff0b0f34ac1317afb6239be358db14877a9726

memory/548-8311-0x0000000000400000-0x000000000044B000-memory.dmp

memory/548-8312-0x0000000000400000-0x0000000000414000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-21 20:35

Reported

2024-09-21 20:38

Platform

win10v2004-20240802-en

Max time kernel

91s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe"

Signatures

Detected Netwalker Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwalker Ransomware

ransomware netwalker

Deletes shadow copies

ransomware defense_evasion impact execution

Renames multiple (6663) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessResume.dotx C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\amd64\C1DE0E-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\remixCTA_welcome.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-300.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\C1DE0E-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sq.pak.DATA C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\caution.svg C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sr.pak.DATA C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hu-hu\C1DE0E-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ne.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\lv.pak.DATA C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\C1DE0E-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\C1DE0E-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-20_contrast-black.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_agreement_filetype.svg C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-250.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-125.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\CommunityInterop.winmd C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.winmd C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Marble.dxt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Advertising C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-down.svg C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\C1DE0E-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_EyeLashEye.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppStoreLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\C1DE0E-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\C1DE0E-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\C1DE0E-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\RunningLate.scale-64.png C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\C1DE0E-Readme.txt C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\notepad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1448 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\system32\vssadmin.exe
PID 1448 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\system32\vssadmin.exe
PID 1448 wrote to memory of 6776 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\notepad.exe
PID 1448 wrote to memory of 6776 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\notepad.exe
PID 1448 wrote to memory of 6776 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\notepad.exe
PID 1448 wrote to memory of 5132 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\cmd.exe
PID 1448 wrote to memory of 5132 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\cmd.exe
PID 1448 wrote to memory of 5132 N/A C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe C:\Windows\SysWOW64\cmd.exe
PID 5132 wrote to memory of 100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 5132 wrote to memory of 100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 5132 wrote to memory of 100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe

"C:\Users\Admin\AppData\Local\Temp\8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160.exe"

C:\Windows\system32\vssadmin.exe

C:\Windows\system32\vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\C1DE0E-Readme.txt"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\40DC.tmp.bat"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /PID 1448

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/1448-1-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1448-0-0x00000000005F0000-0x0000000000616000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\C1DE0E-Readme.txt

MD5 ced5d1fd96cf65fdb887325a0d043836
SHA1 d6b28cbe625a552adbb301ec3b6a0bc9da49663a
SHA256 0357326e34a9592565db48dda9c866be08af827987be4d53f7f14680808aa1da
SHA512 caa755da171754e4995bb7e27cbedc04c14ed1baeb452faa6ef3780efa0bab8d8f01e4ad89ff7e10fb5c26d2b13112ef3ba76cab8f6f4576872feb9168e91eec

C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml

MD5 f28901b2e264545882d7011ae266792b
SHA1 6ca7ff375ab61de1388a4fd5e5db0a667326fbdc
SHA256 b53dfccff55cb569eb6bfb17d5b724ecf2f4a6d020cd21f9c07fbb71496e299c
SHA512 c3773c10413af21a5f5bc5479ca3773cbd04ae2237abacd2a3059e1bec40aa470f7e096191ccf72fa484d9c002329f07684c65ceae42f496e819c27c158d46db

memory/1448-3657-0x0000000000400000-0x000000000044B000-memory.dmp

memory/1448-4074-0x0000000000400000-0x0000000000414000-memory.dmp

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.c1de0e

MD5 939dbfdc0814ff798a823188918459e4
SHA1 9932dd4320d53b778647b8055de91e98ad1760b4
SHA256 c278f93b06ad0bd13bf7330a00e4025fa538881bc2e764bae8724aedcb5a88ed
SHA512 3213f958456010b630e1e37d18fa0afb979084e09c75532bd29533db2939fa66ef89c819b67689261b2960e81ce712dccbc1ef720a03e4bbcfa96d0d9785bcf0

C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml.c1de0e

MD5 23b8fc2ab4b2b318f1a65b53db9cd39a
SHA1 aaeffe19b365c4012e9d79e53151e13067256fb2
SHA256 f5da131481654861a9494399ee6b13270e756a6cd71755eda5de52f2b7b7a741
SHA512 7d5ed4b4625dda4fb8174a8589949e72893dd77ada063bdad4f450c64d86ba65b715fb961b16f6ab6dff2413342d1e9cd0c6ee94d94516bb42fd99e83ece460b

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.1.Crwl.c1de0e

MD5 db82d8b0bec41ac084b97141a883900f
SHA1 ca1d47d02e3250aa7e8d4417da0417493deb63a6
SHA256 0c8995db5466db6a0f4e3eeb0689c132a0b5f9f2cf48663548040e76743dddf7
SHA512 b9a1248526c33d4e84ea532ac8092d1019d849fcc1af1a91dfe92d86ab10fad9af59fc939f9b800245bb04451915d282d0e5ee44378b28e1390c26c032b19560

C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.c1de0e

MD5 28a1b3ce5d4633fc95f1e0de8089e52d
SHA1 934069abd14c6b300c6da585171a847b7897e292
SHA256 1248b274c793b33ad25c6b19113cdadc23419e44401a8c1b5cdd97844e2026ff
SHA512 85a9312208e418a9ce78226b11cbed99845b4e289eccf3b58e40f324775cc7023057439021679f8ce9698d132488339ac6e3dde2ec8b648b7f179fec8284636e

C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.c1de0e

MD5 e3f8bf7c158b3af651125ba5e6457f38
SHA1 721e603f5f88512da634cd8088b3ceec722fbf07
SHA256 5e2d9b6ba4f9bf528e74f3562ffbf4137e4be8a442f1a89305d9a56589c92a0a
SHA512 ddeb879549bdba8d3e5e16b3f13a085be12281c753dfc82054d20c1f9bb0206d2244020af90ca37a49f3d9153062c368c08948bda38d566401de4fd47aab7fe6

C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.c1de0e

MD5 e5b083cafa3b387f50cbe1797a48ec71
SHA1 2c500d2fbbec256f036fc757bd1139f2a2d0f1e1
SHA256 5ccda1f1806d535b7ab748dc019151b4dfa277cdb1672fa75a6ff8befeed3dee
SHA512 de40310a7c1f6e7161ee8c24c69bcb333b1301164c6f2051b5a9a8d2069d2250a90d7717b7a4b9a48e50c504361d291ccba1934b63b60a890592eb61742af94b

memory/1448-8844-0x0000000000400000-0x000000000044B000-memory.dmp

memory/1448-8855-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1448-8854-0x0000000000400000-0x000000000044B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\40DC.tmp.bat

MD5 1ae668f78ca5429b35d714fb0020f74d
SHA1 cce37d07d43171590c1af22ce0217dfdbe26ad61
SHA256 e02359d2ed3c7ae591a6789fb7d056ad320ae0179c5875fc654b5cbad03cdd16
SHA512 2956c231404c0d28b67e71003cb8f2f894f6ec570d507c8eb9f2b74ecfcbf4f41f9ad09235b2341459ce4f2ae3427c21d4d2d6b3c62a9fcdb2a0bda1db695a79