Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
86s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2024, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe
Resource
win10v2004-20241007-en
General
-
Target
1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe
-
Size
88KB
-
MD5
921a82bd0fe814e8c9a529e8c1d3ae40
-
SHA1
7aabea2c09e17f31d3d5ce8b7134c25ecebcca97
-
SHA256
1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6
-
SHA512
62600508aa8e687abb160bb2ffbe01f6dbe07598309c8a8e1c97d5ebe8d650db76d144d38c67ec1e045e918e22ed881b1be19c539d7e3699558181b1e7c28647
-
SSDEEP
768:VEQospn+18nOeTmI2G1VT6lnKCJaLVgJITFzEJ+y0cdGinm1ZzdBoEb+:wF18nOebn+baL0wisoES
Malware Config
Signatures
-
Renames multiple (1294) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yesenia = "C:\\Windows\\MSIEXEC32.EXE" 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinExec = "C:\\Windows\\WinExec.exe.vbs" 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WinExec = "C:\\Windows\\Winexec.exe.vbs" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\MSIEXEC = "C:\\Windows\\MSIEXEC32.EXE" WScript.exe -
Drops file in System32 directory 46 IoCs
description ioc Process File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\prnmngr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\prnmngr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\prnport.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\prnqctl.vbs WScript.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\MPDW-constraints.js.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\prnjobs.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\prnqctl.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\pubprn.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\prnmngr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\prncnfg.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\pubprn.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\prncnfg.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\prncnfg.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\prnport.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\prnmngr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\prncnfg.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\prnqctl.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\pubprn.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\prndrvr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\prnqctl.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\prnqctl.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\prndrvr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\prnqctl.vbs WScript.exe File created C:\Windows\SysWOW64\winrm.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\prnjobs.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\prnport.vbs WScript.exe File created C:\Windows\SysWOW64\slmgr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\prnport.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\prncnfg.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\prnport.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\pubprn.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\prnjobs.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\pubprn.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\prndrvr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\prnmngr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\prnport.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\pubprn.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\prnmngr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\prndrvr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\prndrvr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\prndrvr.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\prnjobs.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\prncnfg.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\prnjobs.vbs WScript.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\prnjobs.vbs WScript.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\MPDW-constraints.js WScript.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\ui-strings.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\ui-strings.js WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\main.css.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\main.css.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\ui-strings.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\ui-strings.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\ui-strings.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\ui-strings.js WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nl-nl\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\ui-strings.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ui-strings.js WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\ui-strings.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\ui-strings.js WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\plugin.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\ui-strings.js WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\ui-strings.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\rna-main.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\ui-strings.js WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ru-ru\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\ui-strings.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\ui-strings.js.vbs WScript.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\fabric.min.css WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\ui-strings.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\ui-strings.js WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\ui-strings.js WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\ui-strings.js WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main-selector.css.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\ui-strings.js.vbs WScript.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js.vbs WScript.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\main.css WScript.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\monaco-editor\min\vs\basic-languages\src\xml.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\SlickGrid\slick.dataview.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-light-footer-vm.js.vbs WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\OobeCloudContentHydrant.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\ui-dark.css.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\Formatter\formatWorker.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\monaco-editor\min\vs\basic-languages\src\coffee.js WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\ErrorPageStyles.css.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\js\appLaunchers\HostedApplication.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\js\appLaunchers\OobeEnterpriseProvisioningAfterConnectivity.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\scoobeoutro-page.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\storage.js.vbs WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\cortana.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\devicereactivation.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\helloEnrollmentPage.js.vbs WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobeprovisioningstatus-page.js WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\network\styles\networkGrid.css.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\navmesh.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Microsoft.WinJS-reduced\js\base.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\autopilot\autopilotespprogress-vm.js.vbs WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\cortanaPage.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-footer-vm.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\hololensWorkAccount.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\RetailDemo\retailDemoSecurityInclusive.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeerror-page.js WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\button.css WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\Formatter\FormattedTextMapping.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\OEMRegistrationPage.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\autopilot\accountsetupcategoryviewmodel.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\Formatter\typescript\formatterTypescriptServices.nls.keys.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\monaco-editor\min\vs\editor\editor.main.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\js\sspr-frame-vm.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\hololensWorkAccount.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\autopilot\autopilotespprogress-vm.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\deviceDisplayNameSetup.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\unifiedEnrollmentDiscoveryPage.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\js\oobe-chrome-breadcrumb-vm.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\css\oobe-desktop.css.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeautopilotreboot-page.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobenetworklossaversion-page.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveSspr\js\ssprerror-vm.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Local\Desktop\5.css.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\storage\remote\storageRemote.bundle.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\navigationManager.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobezdp-helpers.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\retailDemoSecurity.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\ooberegion-page.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\deviceUserPage.js.vbs WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobelanguage-vm.js WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\common\GifSequencePlayer.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\appObjectFactory.js WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\storage\storage.css.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\resources.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Local\Desktop\8.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-chrome-contentview-vm.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobeerror-vm.js WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\Formatter\Formatter.js WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\perftools\commonPlugin.css.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\retailDemo.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\lib\require.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeeula-vm.js.vbs WScript.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Local\Desktop\21.js WScript.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\scoobeoutro-page.js WScript.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\perftools\TokenExtractor.css.vbs WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Regedit.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe -
Runs .reg file with regedit 6 IoCs
pid Process 3604 Regedit.exe 3316 Regedit.exe 3728 Regedit.exe 2540 Regedit.exe 1804 Regedit.exe 3724 Regedit.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 624 wrote to memory of 3604 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 96 PID 624 wrote to memory of 3604 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 96 PID 624 wrote to memory of 3604 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 96 PID 624 wrote to memory of 3316 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 97 PID 624 wrote to memory of 3316 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 97 PID 624 wrote to memory of 3316 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 97 PID 624 wrote to memory of 3728 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 98 PID 624 wrote to memory of 3728 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 98 PID 624 wrote to memory of 3728 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 98 PID 624 wrote to memory of 2540 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 99 PID 624 wrote to memory of 2540 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 99 PID 624 wrote to memory of 2540 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 99 PID 624 wrote to memory of 1804 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 100 PID 624 wrote to memory of 1804 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 100 PID 624 wrote to memory of 1804 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 100 PID 624 wrote to memory of 3724 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 101 PID 624 wrote to memory of 3724 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 101 PID 624 wrote to memory of 3724 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 101 PID 624 wrote to memory of 4772 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 102 PID 624 wrote to memory of 4772 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 102 PID 624 wrote to memory of 4772 624 1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe"C:\Users\Admin\AppData\Local\Temp\1d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\Regedit.exeRegedit.exe /s C:\Users\Admin\AppData\Local\Temp\1.reg2⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:3604
-
-
C:\Windows\SysWOW64\Regedit.exeRegedit.exe /s C:\Users\Admin\AppData\Local\Temp\2.reg2⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:3316
-
-
C:\Windows\SysWOW64\Regedit.exeRegedit.exe /s C:\Users\Admin\AppData\Local\Temp\3.reg2⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:3728
-
-
C:\Windows\SysWOW64\Regedit.exeRegedit.exe /s C:\Users\Admin\AppData\Local\Temp\4.reg2⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:2540
-
-
C:\Windows\SysWOW64\Regedit.exeRegedit.exe /s C:\Users\Admin\AppData\Local\Temp\5.reg2⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:1804
-
-
C:\Windows\SysWOW64\Regedit.exeRegedit.exe /s C:\Users\Admin\AppData\Local\Temp\6.reg2⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:3724
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\WinExec.exe.vbs"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4772
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169B
MD51b8aa9c4579e695f722c7efeb62b1ceb
SHA1efd42acaefecbabbad2712c61b499c86cf587ed9
SHA2566f5d42baf0d55a215ee384479a8881e8781eb4302893abc85ae8b2219dbfc87e
SHA51285947a9a2c9aa0eeb2b13f1e1dfd8cee0c3c584ecadfde981ca8c6876afcf4b493872520138b0f172ab5875e2a655a9e2880cb72b9ed7bcf205b9fb8d7a6473d
-
Filesize
170B
MD53cf886f68272009e51bf760ff02f2fd1
SHA11c8d1db4f21738cf3345a5f8934920282d8aaf27
SHA25669a21a0cd503689fc61f0aef1803a4addf742ca55e6c1c60595a3dc435eb275c
SHA512c98169b4e3ad37339b6e465c436c8f67413e6c2ea32a1ce44c75ee6d39947b3ac9ac3e8ee06cda962e22484c1fe52f5242f197155975ab94c15ad8700392fe2f
-
Filesize
175B
MD5c0a6a61f9509d470195892991d17f51f
SHA1db566bf2c08894eaf3032e7c0aff68d01d99b382
SHA256ad94ca231b24a4d7cd6f34fd009e8eddf9d09114fbfd7bab287c2e88479ad700
SHA51293680d6353ead2899c6070deeef60d57ec67323bad090fcae2b9c47e0748640345379ed4607646068772e11487f1915851809de0245a29263a50dd0755ccfb69
-
Filesize
139B
MD57ff9ca1a78edea205480a199f18c3c52
SHA139ce114f5ce61f5de55485d953d7194e377f80ad
SHA256bf70e43d27eb1e179e22f22721060a162d28f202ffaa09848d68bb36d15e1dcb
SHA51280b89528a49716d1215da373a8d84c68c2acf29ff085f3a8694f4d3294f16e7238e3f41c63eae481596de58f772dbfe8ef10f300cc58c75eb748c195364e1c94
-
Filesize
140B
MD53e3b711f00fddb7bd82e6ca38be79af9
SHA1a3c9ee6e8e8d9617c3814c9f3f31c50a2ca80e42
SHA256776c84a44d9c7da404aae26d8238b242b4ec8a49c66bddf564104fec4e126acf
SHA512c403865f368333a1f849c5ae379c36fdc8f96bc8e235d8e5680d1866d65ba4eeed402292aeb8f8ed7891a91081db8b1721bc3647e7e07b74f3590ebe5c44e8b2
-
Filesize
145B
MD5605e06f594a02d384a023169fd6da5e6
SHA1c61c8ab826851d808ee55fbc90073da44c1efa99
SHA25692f0a278cf25a44853b5af65f54f29cb62c4c3c1cf9d368e4ac90f70f0d79a28
SHA512fc5be0eccb6100c1280f351b53dd39930f2731751d67d253d2623029f49f0d9f931b43b3e2072ad11c7db2b944b579d03ef761801dae02d240ac7c8d643cf79d
-
Filesize
88KB
MD5921a82bd0fe814e8c9a529e8c1d3ae40
SHA17aabea2c09e17f31d3d5ce8b7134c25ecebcca97
SHA2561d9f0e5240f25cc5c277a66e4c63597bce8c7c89821944b2cb42a8ece39167b6
SHA51262600508aa8e687abb160bb2ffbe01f6dbe07598309c8a8e1c97d5ebe8d650db76d144d38c67ec1e045e918e22ed881b1be19c539d7e3699558181b1e7c28647
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\ErrorPageStyles.css.vbs
Filesize57KB
MD50acb2045c25d91efe3d67166b650101a
SHA176c503ec1d87b8358eb8e226086baef23eb298cc
SHA256deb9bfc6d236a35310eaa6c23cebb1542fbc2eab801285b87c4b828f22627091
SHA512d9fbcab6ed8840e9b83fb83012db2d6895749ebd999a3676791c84449e9cbb0089ef111ad2a2aa1fe87a8a320cf52cf9df3b3f6ca9ac266f39cc290f95a3c466
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\PhishSiteStyles.css.vbs
Filesize5KB
MD53517207921bc421e52b64ede4226134f
SHA167da2033c4b3eddf347433ac4e79e4a1379eaf81
SHA256c34a78268a7338d1e5d1c0f0c44e5a8cc78f670d8c871261b6f8d302e0b29176
SHA512713cd6ad7d14252ff9ed43898c1132968a306933c6b4c46327d07a945c1989ba8f5d149bbd8ffb59c211979e7c783e9c22bf6dec6c08e0bd46517411ddf0a546
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\TridentErrorPageStyles.css.vbs
Filesize4KB
MD5559a66b58cf5163690ab75559c8801fb
SHA1b334704e65d0b492e78e71f65f455383060ac067
SHA256807ebc19ab4a95f4f03096c7e6acca70d263fdf256d62484270a7ce539443272
SHA5122a57029f8957a47a1d873c8e08c283c929c43e21e8c18764c8ca2ff812eaf999aabd9f28574f69d0a70437912c2a7d90909745c0b590a927fb5c73aa98c52a6f
-
Filesize
215KB
MD541cea5604b6bd6971deca5227766eaee
SHA1b4f1fe5c9f56ffe92e9aae018ee7146b5b1d6c51
SHA256595d16fada5b5b80331b1b49ee39dba522cf17cf111be920ba596d01f85fa93d
SHA5120b15fca5c5761c3c489c419f01dd8c918385ea837b5fb10db184c8cd08e8811c0547f00a90f7dd8ccb73e1907f55f2b4c7574547dd8a35a4d46bcc37575ab6a0