Analysis
-
max time kernel
130s -
resource
win10v191014 -
submitted
16-12-2019 10:54
Task
task1
Sample
06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe
Resource
win7v191014
Task
task2
Sample
06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe
Resource
win10v191014
General
-
Target
06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe
-
Sample
191216-4zdx1n374x
-
SHA256
06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851
Malware Config
Extracted
C:\39y4ps-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/081AC0D763E84FAE
http://decryptor.top/081AC0D763E84FAE
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality
-
Drops file in Program Files directory 52 IoCs
Processes:
06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exedescription ioc process File created \??\c:\program files (x86)\39y4ps-readme.txt 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\ConfirmHide.xml 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\ConfirmHide.xml => \??\c:\program files\ConfirmHide.xml.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\PingSubmit.txt 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\SearchConnect.pps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\SetSubmit.m1v 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File created \??\c:\program files\39y4ps-readme.txt 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File created \??\c:\program files (x86)\d60dff40.lock 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\TestCheckpoint.vsdm => \??\c:\program files\TestCheckpoint.vsdm.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\UseWatch.asx 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\WatchAdd.rtf 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\ReadRedo.reg => \??\c:\program files\ReadRedo.reg.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\SuspendTrace.xlsx => \??\c:\program files\SuspendTrace.xlsx.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\DisablePush.M2V 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\MoveProtect.3g2 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\OptimizeWrite.pptx 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\SuspendTrace.xlsx 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\MoveProtect.3g2 => \??\c:\program files\MoveProtect.3g2.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\SearchConnect.pps => \??\c:\program files\SearchConnect.pps.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\SetSubmit.m1v => \??\c:\program files\SetSubmit.m1v.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File created \??\c:\program files\d60dff40.lock 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\AddInitialize.emf 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\MergeWatch.pps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\DisableDisconnect.asx => \??\c:\program files\DisableDisconnect.asx.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\PublishComplete.ppsx 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\TestCheckpoint.vsdm 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\UseWatch.asx => \??\c:\program files\UseWatch.asx.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\DismountGet.css => \??\c:\program files\DismountGet.css.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\WatchAdd.rtf => \??\c:\program files\WatchAdd.rtf.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\ConfirmMerge.asx 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\AddAssert.emz => \??\c:\program files\AddAssert.emz.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\MeasureDisconnect.mp2v => \??\c:\program files\MeasureDisconnect.mp2v.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\OutUnpublish.tiff 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\DisablePush.M2V => \??\c:\program files\DisablePush.M2V.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\PublishComplete.ppsx => \??\c:\program files\PublishComplete.ppsx.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\AddAssert.emz 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\DisableDisconnect.asx 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\ImportPop.mpg 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\AddInitialize.emf => \??\c:\program files\AddInitialize.emf.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\MeasureDisconnect.mp2v 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\ReadRedo.reg 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\RepairHide.zip => \??\c:\program files\RepairHide.zip.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\GroupMove.vbe => \??\c:\program files\GroupMove.vbe.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\OutUnpublish.tiff => \??\c:\program files\OutUnpublish.tiff.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\OptimizeWrite.pptx => \??\c:\program files\OptimizeWrite.pptx.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\DismountGet.css 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\GroupMove.vbe 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\ConfirmMerge.asx => \??\c:\program files\ConfirmMerge.asx.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\ImportPop.mpg => \??\c:\program files\ImportPop.mpg.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification \??\c:\program files\RepairHide.zip 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\MergeWatch.pps => \??\c:\program files\MergeWatch.pps.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File renamed C:\Program Files\PingSubmit.txt => \??\c:\program files\PingSubmit.txt.39y4ps 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SppExtComObj.exe06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.execmd.exedescription pid process target process PID 1528 wrote to memory of 1708 1528 SppExtComObj.exe SLUI.exe PID 4996 wrote to memory of 4448 4996 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe cmd.exe PID 4448 wrote to memory of 4116 4448 cmd.exe vssadmin.exe -
Discovering connected drives 3 TTPs 6 IoCs
Processes:
06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exesvchost.exedescription ioc process File opened (read-only) \??\A: 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened (read-only) \??\B: 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened (read-only) \??\E: 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened (read-only) \??\C: 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened (read-only) \??\C: svchost.exe File opened (read-only) \??\F: 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe -
Deletes shadow copies 2 TTPs 1 IoCs
Processes:
vssadmin.exepid process 4116 vssadmin.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
description ioc Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\33f0e86kh.bmp" -
Processes:
description ioc Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exepid process 4996 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 4568 vssvc.exe Token: SeRestorePrivilege 4568 vssvc.exe Token: SeAuditPrivilege 4568 vssvc.exe -
Drops file in Windows directory 2109 IoCs
Processes:
06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-f..eelawadeeui_regular_31bf3856ad364e35_10.0.15063.0_none_70a7191ccd7e3047_leelawui.ttf_ce0cc416 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_8514oem.fon_c20e1190 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasrtutils_31bf3856ad364e35_10.0.15063.0_none_1e296d4a23494905_rtutils.dll_243724ab 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_he-il_e2b9a848b899ba23.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lsa_31bf3856ad364e35_10.0.15063.0_none_b75e63fb9599f19e_offlinelsa.dll_26ff60c5 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.15063.0_none_20edd7ef9e21d8cb_rasacd.sys_43640ee7 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.15063.0_none_685fe984eaf6056e_appidcertstorecheck.exe_03352f5f 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-cryptsp-dll_31bf3856ad364e35_10.0.15063.0_none_3a7147463f9b3bd0.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-netapi32_31bf3856ad364e35_10.0.15063.0_none_9e47f44c3a5e979a_netapi32.dll_8b1e859a 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.15063.0_none_1ef4411ab33dfe81_rasdiag.dll_341d4299 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.15063.0_en-us_60ce145177b6c10a.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..gon-tools.resources_31bf3856ad364e35_10.0.15063.0_en-us_26c069caca82e24a_wlrmdr.exe.mui_ee563c83 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base_31bf3856ad364e35_10.0.15063.0_none_1f020fb05f5437ab_wintypes.dll_96e015b1 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-cryptbase_31bf3856ad364e35_10.0.15063.0_none_7679aeb1e6c8b09d_cryptbase.dll_83e36053 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_cvgasys.fon_a23acca1 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_vgasysr.fon_af0ffe9e 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_hu-hu_8b4d2222606ec8fc_comctl32.dll.mui_0da4e682 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..sition-coreservices_31bf3856ad364e35_10.0.15063.0_none_43a8144aec22156f.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-netapi32_31bf3856ad364e35_10.0.15063.0_none_a89c9e9e6ebf5995_netapi32.dll_8b1e859a 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_lt-lt_175f1fe42af483ec.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_uk-ua_cb62fe0eb7312018_comctl32.dll.mui_0da4e682 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.i..utomation.proxystub_6595b64144ccf1df_1.0.15063.0_none_021b03263abb1b35_sxsoaps.tlb_7db2712b 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_es-es_8fb72afa21e2997c_bootmgr.efi.mui_be5d0075 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_en-gb_50ad0e299c666e9f.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-network-security_31bf3856ad364e35_10.0.15063.0_none_de38492263599171_fwpuclnt.dll_d0a74ee5 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.15063.0_none_1ef4411ab33dfe81_switch.inf_4b9b5a3f 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..ty-cng-keyisolation_31bf3856ad364e35_10.0.15063.0_none_d55075a52ee8912b_keyiso.dll_897976dc 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_156aa3a91701e260_wuaueng.dll.mui_297f975d 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..wmanager-compositor_31bf3856ad364e35_10.0.15063.0_none_16962c30782ca7e5_dwmcore.dll_523baf47 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_sk-sk_bcb323d2ec813098_bootmgr.exe.mui_c434701f 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.15063.0_none_a69f8cf95bf4534e_dnsrslvr.dll_faf65b7a 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..onmanager.resources_31bf3856ad364e35_10.0.15063.0_en-us_0f3f9edc83750aba_partmgr.sys.mui_b800c491 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.15063.0_en-us_d84575ef7f0e3162_rasauto.dll.mui_12fa2c50 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_c53b9c03c7b5d8af_lpk.dll_ebdc1de9 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-lsa_31bf3856ad364e35_10.0.15063.0_none_c1b30e4dc9fab399_offlinelsa.dll_26ff60c5 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_fi-fi_71383c7ced7c7587_memtest.exe.mui_77b8cbcc 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_hr-hr_8a18fc5c61316794.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.15063.0_en-us_87ac933f1cd28fdb_winload.efi.mui_35ee487d 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_f5dc2ec982476ba8_iscsidsc.dll_20ed5065 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-profapi_31bf3856ad364e35_10.0.15063.0_none_19b189889e364052.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-windowsuiimmersive_31bf3856ad364e35_10.0.15063.0_none_4d3856ac4138ba33_windows.ui.immersive.dll_549e9b42 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-efs-service.resources_31bf3856ad364e35_10.0.15063.0_en-us_5df6e82b85a049fd.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-kernelstreaming_31bf3856ad364e35_10.0.15063.0_none_68949b90ceb2d4b5.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.15063.0_none_bcbd1290a09b9a77.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.15063.0_en-us_71c1f73248e2ec42_listsvc.dll.mui_27f0fc85 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..oexistencemigration_31bf3856ad364e35_10.0.15063.0_none_22f6ec0bb529250e_httpprxm.dll_53511297 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.15063.0_none_ce6bccb1aa74baa3.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..rservice-extensions_31bf3856ad364e35_10.0.15063.0_none_dda2d70f5ef170e7.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sv-se_3ec89a49bcc7ced5.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.15063.0_none_4a395d1c23946704.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ui-xaml-phone_31bf3856ad364e35_10.0.15063.0_none_e1ba3e11e8d4dde4_windows.ui.xaml.phone.dll_f3375243 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_sr-..-rs_61f5adcf622ceaac.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_pl-pl_8f3419f68fe61192_bootmgfw.efi.mui_a6e78cfa 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directory-services-sam_31bf3856ad364e35_10.0.15063.0_none_c3023296d9c347cc.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_s8514fix.fon_2d5cdf27 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_8514sys.fon_bcc6c556 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_10.0.15063.0_none_de44366355bc504a_shsvcs.dll_f8739230 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-themeservice_31bf3856ad364e35_10.0.15063.0_none_bb1659e5012b4fbe.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_hu-hu_be6a5a9c7dbb19ea.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_sk-sk_4071e5a8ddae1035.manifest 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_en-us_c3c95b73e48b1ae8_iscsicli.exe.mui_64c0a23c 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.15063.0_none_feca243ea9e4c6cb_msvcp110_win.dll_397cf9b6 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_en-us_04d9ab74573a46e7_scarddlg.dll.mui_300ae9df 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.15063.0_none_460932e9ff0c93bd_setupapi.dll_8d9de2e7 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe -
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
description ioc Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName
Processes
-
C:\Users\Admin\AppData\Local\Temp\06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe"C:\Users\Admin\AppData\Local\Temp\06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Discovering connected drives
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Deletes shadow copies
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Discovering connected drives
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4996-0-0x00000000005F4000-0x0000000000616000-memory.dmpFilesize
136KB