Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2024, 12:39
Static task
static1
Behavioral task
behavioral1
Sample
0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe
Resource
win10v2004-20241007-en
General
-
Target
0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe
-
Size
612KB
-
MD5
412ce7c1f8dd5dcfafb5c3af08297c65
-
SHA1
fd98960ab8e7bfe92fc566237be4bc433332c3f3
-
SHA256
0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328
-
SHA512
10e654df43c193ae7786848093967092b0f7fc1bf61ef55e2edf77347acc029ee8dcce9c64a64922f846bcea0b33307e6dabd54ba196f0f2f027a88f3e213748
-
SSDEEP
12288:/lTMgGurXwc8Xq1m3fdjQU+v4PN/CnBMj5qJwhq92hyuZCZh06H4FCd:/lTMgBrXwc8Xq1Cfdj/PN/IWyuZ+h
Malware Config
Extracted
C:\#HowToRecover.txt
https://paxful.com
Signatures
-
Renames multiple (6530) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\background.bmp" 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\ui-strings.js 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\SmallTile.scale-125.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated_contrast-black.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-250.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\ui-strings.js 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_Full.aapp 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-64_altform-lightunplated.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-200.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30_altform-unplated.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-96.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailWideTile.scale-200.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-100.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupWideTile.scale-150.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-125.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\de-de\ui-strings.js 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinAgaveCommands.xml 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-24_altform-unplated_contrast-black.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\ControlStyles.xbf 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\WideTile.scale-125.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteWideTile.scale-125.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-64_contrast-white.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalLetter.dotx 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\THMBNAIL.PNG 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-256.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-16_altform-unplated_contrast-white.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-250.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\WinMetadata\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es_2x.gif 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\7px.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-125.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-black_scale-100.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-48_altform-unplated.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\9px.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-32_altform-unplated_contrast-black.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\#HowToRecover.txt 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-100.png 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\background.bmp" 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\Wallpaper = "C:\\background.bmp" 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\Wallpaper = "C:\\background.bmp" 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3176 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe 3176 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 1152 vssvc.exe Token: SeRestorePrivilege 1152 vssvc.exe Token: SeAuditPrivilege 1152 vssvc.exe Token: SeIncreaseQuotaPrivilege 756 WMIC.exe Token: SeSecurityPrivilege 756 WMIC.exe Token: SeTakeOwnershipPrivilege 756 WMIC.exe Token: SeLoadDriverPrivilege 756 WMIC.exe Token: SeSystemProfilePrivilege 756 WMIC.exe Token: SeSystemtimePrivilege 756 WMIC.exe Token: SeProfSingleProcessPrivilege 756 WMIC.exe Token: SeIncBasePriorityPrivilege 756 WMIC.exe Token: SeCreatePagefilePrivilege 756 WMIC.exe Token: SeBackupPrivilege 756 WMIC.exe Token: SeRestorePrivilege 756 WMIC.exe Token: SeShutdownPrivilege 756 WMIC.exe Token: SeDebugPrivilege 756 WMIC.exe Token: SeSystemEnvironmentPrivilege 756 WMIC.exe Token: SeRemoteShutdownPrivilege 756 WMIC.exe Token: SeUndockPrivilege 756 WMIC.exe Token: SeManageVolumePrivilege 756 WMIC.exe Token: 33 756 WMIC.exe Token: 34 756 WMIC.exe Token: 35 756 WMIC.exe Token: 36 756 WMIC.exe Token: SeIncreaseQuotaPrivilege 756 WMIC.exe Token: SeSecurityPrivilege 756 WMIC.exe Token: SeTakeOwnershipPrivilege 756 WMIC.exe Token: SeLoadDriverPrivilege 756 WMIC.exe Token: SeSystemProfilePrivilege 756 WMIC.exe Token: SeSystemtimePrivilege 756 WMIC.exe Token: SeProfSingleProcessPrivilege 756 WMIC.exe Token: SeIncBasePriorityPrivilege 756 WMIC.exe Token: SeCreatePagefilePrivilege 756 WMIC.exe Token: SeBackupPrivilege 756 WMIC.exe Token: SeRestorePrivilege 756 WMIC.exe Token: SeShutdownPrivilege 756 WMIC.exe Token: SeDebugPrivilege 756 WMIC.exe Token: SeSystemEnvironmentPrivilege 756 WMIC.exe Token: SeRemoteShutdownPrivilege 756 WMIC.exe Token: SeUndockPrivilege 756 WMIC.exe Token: SeManageVolumePrivilege 756 WMIC.exe Token: 33 756 WMIC.exe Token: 34 756 WMIC.exe Token: 35 756 WMIC.exe Token: 36 756 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3176 wrote to memory of 3056 3176 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe 85 PID 3176 wrote to memory of 3056 3176 0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe 85 PID 3056 wrote to memory of 756 3056 cmd.exe 87 PID 3056 wrote to memory of 756 3056 cmd.exe 87 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe"C:\Users\Admin\AppData\Local\Temp\0a5ba8d248080666c7ea5bd9c325452fad055a00e194989a34bd816c26a62328.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C34AFC3-3DC2-47A5-B6BD-87F57D084FBB}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C34AFC3-3DC2-47A5-B6BD-87F57D084FBB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
871B
MD583f8bacb8f86e7e33ce04386ce1c9228
SHA16812db951e3094ac5dd7ee9791c6b6b7dc07b003
SHA256b8ffd1c3f47e917c996bce4de87b4bc54f9f302366bbd84ab82af1631a778768
SHA512ebacb4c6702e00efe00be5fc79f76c73079801286c7b70a6cfaef08b591666854ca693113fa9e0b2a25f8ee62b7de13d937b9b7f5739023a498f2ef669e6ae28