cafe67023ec713f4227dad3040b08f90dc22235c1c45e1b6b6e0fd9fb6ebdf3b

General

Target

65ea49a50355ef7cca16d13478d48bd59a3e18305ccf9c3c25d174f979bf7b4b.exe
Size

2.1MB
MD5

d483bd9c3dec2b995b9047757962c448
SHA1

4769c4ea12faf9049e04196829f8e9117bf78f8a
SHA256

65ea49a50355ef7cca16d13478d48bd59a3e18305ccf9c3c25d174f979bf7b4b
SHA512

3cba348d7497577a946b98510179a241d42337dd93c69652e7db59e10aee39b77fc85869c5bab7fff81d42eab5c29d724a153af784bf85fbeaef9171b1750ca0

Score

9^/10

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

Inhibit System Recovery

pid	Process
2092	vssadmin.exe
836	vssadmin.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

Modify Existing Service

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3208	3068	65ea49a50355ef7cca16d13478d48bd59a3e18305ccf9c3c25d174f979bf7b4b.exe	68
PID 3068 wrote to memory of 3208	3068	65ea49a50355ef7cca16d13478d48bd59a3e18305ccf9c3c25d174f979bf7b4b.exe	68
PID 3068 wrote to memory of 752	3068	65ea49a50355ef7cca16d13478d48bd59a3e18305ccf9c3c25d174f979bf7b4b.exe	70
PID 3068 wrote to memory of 752	3068	65ea49a50355ef7cca16d13478d48bd59a3e18305ccf9c3c25d174f979bf7b4b.exe	70
PID 752 wrote to memory of 2344	752	powershell.exe	71
PID 752 wrote to memory of 2344	752	powershell.exe	71
PID 2344 wrote to memory of 2092	2344	cmd.exe	73
PID 2344 wrote to memory of 2092	2344	cmd.exe	73
PID 2344 wrote to memory of 836	2344	cmd.exe	76
PID 2344 wrote to memory of 836	2344	cmd.exe	76

Suspicious use of AdjustPrivilegeToken 5 IoCs

Suspicious behavior: EnumeratesProcesses 6 IoCs

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	powershell.exe

C:\Users\Admin\AppData\Local\Temp\65ea49a50355ef7cca16d13478d48bd59a3e18305ccf9c3c25d174f979bf7b4b.exe
"C:\Users\Admin\AppData\Local\Temp\65ea49a50355ef7cca16d13478d48bd59a3e18305ccf9c3c25d174f979bf7b4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" get-wmiobject win32_computersystem | "fl model"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Start-Process C:\ProgramData\cmdkey.bat -Verb runas
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Modifies registry class
  PID:752
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\ProgramData\cmdkey.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      Interacts with shadow copies
      PID:2092
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /For=C: /On=C: /MaxSize=300MB
      4⤵
      Interacts with shadow copies
      PID:836