Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2024, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe
Resource
win10v2004-20241007-en
General
-
Target
9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe
-
Size
612KB
-
MD5
d6b5b3d0a17b1f347665d4e55f8b3df0
-
SHA1
205749f118c2ca5cb822556e6f50ca86c3ee78b3
-
SHA256
9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cf
-
SHA512
6dccfca6772e302a4abbddaefcdaad718c106005b7d627a0a6ca91c3325355448ce43432bef8f3229c7c35bcb8c28b1bc8a8dbb670d53ba842b9430c4b2015df
-
SSDEEP
12288:k1XgVeBOuW1cLcOtoqSuL0xkpPc9EcgyCBUxaNH3bCdGP/g7i7s:k1XgVeBOuW1cLcOtoqmkpP91bCdk/Fs
Malware Config
Extracted
C:\#HowToRecover.txt
https://paxful.com
Signatures
-
Renames multiple (6480) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Desktop\Wallpaper = "C:\\background.bmp" 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsWideTile.scale-100.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-96_altform-lightunplated.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-100_contrast-white.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-200.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Sounds\SpeedLimitViolationAlert.wav 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ta.pak 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-48.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\SphereVertexShader.cso 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-200.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionLargeTile.scale-150.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\SmallTile.scale-200.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\ui-strings.js 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\dictation\SpeechOff.wav 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Google.scale-100.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-200_contrast-white.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_altform-unplated_contrast-black.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\bun.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\JumpListNewNote.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-72_altform-fullcolor.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\ui-strings.js 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Call_Ringing.m4a 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File created C:\Program Files\Mozilla Firefox\uninstall\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-150.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-200_contrast-white.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MUAUTH.CAB 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestDrive.ps1 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-200.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-80_altform-unplated_contrast-white.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\ui-strings.js 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\AppStore_icon.svg 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-64_altform-unplated.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\PREVIEW.GIF 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-80_altform-unplated_contrast-white.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Message_Sent.m4a 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\xaml\onenote\CaptureUI.xaml 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.schema.mfl 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\hu_get.svg 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\Keywords.HxK 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Tracing.jpg 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\shared.js 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ErrorControl.xaml 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\comment.svg 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\main-selector.css 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-125.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\AppxMetadata\#HowToRecover.txt 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-125.jpg 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\MedTile.scale-200.png 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\background.bmp" 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\Wallpaper = "C:\\background.bmp" 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\Wallpaper = "C:\\background.bmp" 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2212 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe 2212 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 4176 vssvc.exe Token: SeRestorePrivilege 4176 vssvc.exe Token: SeAuditPrivilege 4176 vssvc.exe Token: SeIncreaseQuotaPrivilege 2636 WMIC.exe Token: SeSecurityPrivilege 2636 WMIC.exe Token: SeTakeOwnershipPrivilege 2636 WMIC.exe Token: SeLoadDriverPrivilege 2636 WMIC.exe Token: SeSystemProfilePrivilege 2636 WMIC.exe Token: SeSystemtimePrivilege 2636 WMIC.exe Token: SeProfSingleProcessPrivilege 2636 WMIC.exe Token: SeIncBasePriorityPrivilege 2636 WMIC.exe Token: SeCreatePagefilePrivilege 2636 WMIC.exe Token: SeBackupPrivilege 2636 WMIC.exe Token: SeRestorePrivilege 2636 WMIC.exe Token: SeShutdownPrivilege 2636 WMIC.exe Token: SeDebugPrivilege 2636 WMIC.exe Token: SeSystemEnvironmentPrivilege 2636 WMIC.exe Token: SeRemoteShutdownPrivilege 2636 WMIC.exe Token: SeUndockPrivilege 2636 WMIC.exe Token: SeManageVolumePrivilege 2636 WMIC.exe Token: 33 2636 WMIC.exe Token: 34 2636 WMIC.exe Token: 35 2636 WMIC.exe Token: 36 2636 WMIC.exe Token: SeIncreaseQuotaPrivilege 2636 WMIC.exe Token: SeSecurityPrivilege 2636 WMIC.exe Token: SeTakeOwnershipPrivilege 2636 WMIC.exe Token: SeLoadDriverPrivilege 2636 WMIC.exe Token: SeSystemProfilePrivilege 2636 WMIC.exe Token: SeSystemtimePrivilege 2636 WMIC.exe Token: SeProfSingleProcessPrivilege 2636 WMIC.exe Token: SeIncBasePriorityPrivilege 2636 WMIC.exe Token: SeCreatePagefilePrivilege 2636 WMIC.exe Token: SeBackupPrivilege 2636 WMIC.exe Token: SeRestorePrivilege 2636 WMIC.exe Token: SeShutdownPrivilege 2636 WMIC.exe Token: SeDebugPrivilege 2636 WMIC.exe Token: SeSystemEnvironmentPrivilege 2636 WMIC.exe Token: SeRemoteShutdownPrivilege 2636 WMIC.exe Token: SeUndockPrivilege 2636 WMIC.exe Token: SeManageVolumePrivilege 2636 WMIC.exe Token: 33 2636 WMIC.exe Token: 34 2636 WMIC.exe Token: 35 2636 WMIC.exe Token: 36 2636 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2416 2212 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe 87 PID 2212 wrote to memory of 2416 2212 9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe 87 PID 2416 wrote to memory of 2636 2416 cmd.exe 89 PID 2416 wrote to memory of 2636 2416 cmd.exe 89 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe"C:\Users\Admin\AppData\Local\Temp\9befb88861ef0fed20aab3ba204ac8ca250f68930f685485898c7c18d262c0cfN.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2B3B0DD8-321D-4347-A3B9-6B53A3551943}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2B3B0DD8-321D-4347-A3B9-6B53A3551943}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
871B
MD5e6e8bd3a31703b45fbef54610e003704
SHA11aa559d72445e32dd99fb4e2e04bfa085bced575
SHA256275a641e27e9d67840dff6f0b759493a8abba39beb3a160c89ea50d260db25e4
SHA512bdc9ddd99f6166b6b1b40eb617344286beb64c896e2aad0aa1d6fc35c2bab3ae006c4b501742166b74fd178d12b0e7a660f2f0d4a7a176ff4908e92b905fa445