Overview
overview
9Static
static
830bc4934d7...f0.exe
windows7-x64
630bc4934d7...f0.exe
windows10-2004-x64
6338fdf3626...13.exe
windows7-x64
1338fdf3626...13.exe
windows10-2004-x64
1342933cb4c...20.exe
windows7-x64
7342933cb4c...20.exe
windows10-2004-x64
9343ace5874...03.exe
windows7-x64
3343ace5874...03.exe
windows10-2004-x64
834818CE171...49.dll
windows7-x64
834818CE171...49.dll
windows10-2004-x64
8360390_crypt.exe
windows7-x64
1360390_crypt.exe
windows10-2004-x64
3360390_tree.cmd
windows7-x64
7360390_tree.cmd
windows10-2004-x64
73896f8a370...e_.exe
windows7-x64
83896f8a370...e_.exe
windows10-2004-x64
73a061ee07d...8c.dll
windows7-x64
33a061ee07d...8c.dll
windows10-2004-x64
33af4fa2bff...d1.dll
windows7-x64
33af4fa2bff...d1.dll
windows10-2004-x64
33bb691982d...21.exe
windows7-x64
13bb691982d...21.exe
windows10-2004-x64
93e3f980ab6...95.exe
windows7-x64
73e3f980ab6...95.exe
windows10-2004-x64
73e3f980ab6...26.exe
windows7-x64
73e3f980ab6...26.exe
windows10-2004-x64
33e75e8238a..._2.exe
windows7-x64
63e75e8238a..._2.exe
windows10-2004-x64
6400cad56ff...9a.exe
windows7-x64
9400cad56ff...9a.exe
windows10-2004-x64
940b3cb2a21...0c.exe
windows7-x64
740b3cb2a21...0c.exe
windows10-2004-x64
9Analysis
-
max time kernel
112s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 16:52
Behavioral task
behavioral1
Sample
30bc4934d7e29c8c4c4c9be0510fc7558fddf8db666a0343784c5cf1587b3af0.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
30bc4934d7e29c8c4c4c9be0510fc7558fddf8db666a0343784c5cf1587b3af0.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
34818CE171EA150B91429AC1DD6FBE49.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
34818CE171EA150B91429AC1DD6FBE49.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
360390_crypt.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
360390_crypt.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
360390_tree.cmd
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
360390_tree.cmd
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral17
Sample
3a061ee07d87a6bb13e613e000e9f685cbffb96bd7024a9e7b4cb0be9a4af38c.dll
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
3a061ee07d87a6bb13e613e000e9f685cbffb96bd7024a9e7b4cb0be9a4af38c.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
3af4fa2bffaab37fd557ae8146ae0a29ba0faf6d99ad8a1a8d5bf598ac9a23d1.dll
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
3af4fa2bffaab37fd557ae8146ae0a29ba0faf6d99ad8a1a8d5bf598ac9a23d1.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe
Resource
win7-20250207-en
Behavioral task
behavioral22
Sample
3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral23
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_TDS=4FBADA26.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_TDS=4FBADA26.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
3e75e8238a6bbd8817164658696198af_72889f61171de37d6b4d59016c55ec52__2.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
3e75e8238a6bbd8817164658696198af_72889f61171de37d6b4d59016c55ec52__2.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral29
Sample
400cad56ff3d210346cf6c4795aeb607e5b211b3dc4a8421b9437621c254239a.exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
400cad56ff3d210346cf6c4795aeb607e5b211b3dc4a8421b9437621c254239a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
40b3cb2a210fafdaabdebefe1430862bd1192a80fcde84f51ceb387136d1410c.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
40b3cb2a210fafdaabdebefe1430862bd1192a80fcde84f51ceb387136d1410c.exe
Resource
win10v2004-20250314-en
General
-
Target
3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe
-
Size
205KB
-
MD5
458c1cbd0ff849119214e739d8815f37
-
SHA1
64d26b1614693f15bed6bd4f4d2a6a35b2c4bc9f
-
SHA256
3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421
-
SHA512
695f17ca034f7c894bb87bf04db20a2387f144ade77188f497870d3711d0871c721b86327769cd393366b162229ad649671e111aa5b5b80d676156f47ededd08
-
SSDEEP
6144:JJOIZvsEy+fDjKSGXwLfjFU/coiqilMi:JJOIKEy+ffKerjFtoiLMi
Malware Config
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe -
Executes dropped EXE 1 IoCs
pid Process 3104 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421 = "C:\\Windows\\System32\\3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe" 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Public\Music\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Public\Documents\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3446877943-4095308722-756223633-1000\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\Links\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\Music\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3446877943-4095308722-756223633-1000\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Public\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Public\Videos\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\wp.jpg" 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256.png 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Entertainment.winmd 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons.png 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\virgo_mycomputer_folder_icon.svg.ID1B6CA5C2.cyber_baba2@aol.com.xtbl 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.ID1B6CA5C2.cyber_baba2@aol.com.xtbl 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SmallTile.scale-100_contrast-black.png 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20_altform-unplated.png 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\Microsoft.PowerShell.PackageManagement.resources.dll 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.ID1B6CA5C2.cyber_baba2@aol.com.xtbl 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\ui-strings.js 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons2x.png 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\MSB1CACH.LEX 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Text.Encoding.Extensions.dll 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\ExploreModel.dll 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\VisualElements\SmallLogo.png 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.ID1B6CA5C2.cyber_baba2@aol.com.xtbl 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.ID1B6CA5C2.cyber_baba2@aol.com.xtbl 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.ID1B6CA5C2.cyber_baba2@aol.com.xtbl 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top [email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-400_contrast-white.png 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line_2x.png 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.ID1B6CA5C2.cyber_baba2@aol.com.xtbl 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\PREVIEW.GIF 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.ID1B6CA5C2.cyber_baba2@aol.com.xtbl 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-24_contrast-black.png 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Microsoft.AnalysisServices.AzureClient.dll.ID1B6CA5C2.cyber_baba2@aol.com.xtbl 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-72.png 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.ID1B6CA5C2.cyber_baba2@aol.com.xtbl 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File created C:\Program Files\Microsoft Office\root\Licenses16\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.winmd 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\[email protected] 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Northwoods.Go.dll 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteReplayCrossHairIcon-2.png 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 6084 vssadmin.exe 6364 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 4740 vssvc.exe Token: SeRestorePrivilege 4740 vssvc.exe Token: SeAuditPrivilege 4740 vssvc.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 5872 wrote to memory of 3984 5872 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe 87 PID 5872 wrote to memory of 3984 5872 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe 87 PID 4516 wrote to memory of 3104 4516 cmd.exe 90 PID 4516 wrote to memory of 3104 4516 cmd.exe 90 PID 4516 wrote to memory of 3104 4516 cmd.exe 90 PID 3984 wrote to memory of 5560 3984 cmd.exe 91 PID 3984 wrote to memory of 5560 3984 cmd.exe 91 PID 3984 wrote to memory of 6084 3984 cmd.exe 92 PID 3984 wrote to memory of 6084 3984 cmd.exe 92 PID 5872 wrote to memory of 7552 5872 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe 105 PID 5872 wrote to memory of 7552 5872 3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe 105 PID 7552 wrote to memory of 2948 7552 cmd.exe 107 PID 7552 wrote to memory of 2948 7552 cmd.exe 107 PID 7552 wrote to memory of 6364 7552 cmd.exe 108 PID 7552 wrote to memory of 6364 7552 cmd.exe 108 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe"C:\Users\Admin\AppData\Local\Temp\3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:5560
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:6084
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:7552 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2948
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:6364
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe1⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\System32\3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exeC:\Windows\System32\3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3104
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4740
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205KB
MD5458c1cbd0ff849119214e739d8815f37
SHA164d26b1614693f15bed6bd4f4d2a6a35b2c4bc9f
SHA2563bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421
SHA512695f17ca034f7c894bb87bf04db20a2387f144ade77188f497870d3711d0871c721b86327769cd393366b162229ad649671e111aa5b5b80d676156f47ededd08