excorsist.bin.zip

General
Target

excorsist.bin.exe

Filesize

68KB

Completed

01-10-2020 16:13

Score
10 /10
MD5

9e5c89c84cdbf460fc6857c4e32dafdf

SHA1

ee0a95846ce48c59261eda0fdd6b38dfc83d9f4d

SHA256

dfecb46078038bcfa9d0b8db18bdc0646f33bad55ee7dd5ee46e61c6cf399620

Malware Config
Signatures 12

Filter: none

Defense Evasion
Discovery
Impact
Persistence
  • Exorcist Ransomware

    Description

    Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.

  • Deletes shadow copies

    Description

    Ransomware often targets backup files to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery
  • Modifies extensions of user files
    excorsist.bin.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\Pictures\MeasureUninstall.tiffexcorsist.bin.exe
    File renamedC:\Users\Admin\Pictures\MeasureUninstall.tiff => C:\Users\Admin\Pictures\MeasureUninstall.tiff.bHkCYNexcorsist.bin.exe
    File opened for modificationC:\Users\Admin\Pictures\MeasureUninstall.tiff.bHkCYNexcorsist.bin.exe
    File createdC:\Users\Admin\Pictures\MeasureUninstall.tiff.bHkCYNkeyexcorsist.bin.exe
  • Drops desktop.ini file(s)
    excorsist.bin.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\$RECYCLE.BIN\S-1-5-18\desktop.iniexcorsist.bin.exe
    File opened for modification\??\Z:\$RECYCLE.BIN\S-1-5-18\desktop.iniexcorsist.bin.exe
  • Enumerates connected drives
    excorsist.bin.exe

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    File opened (read-only)\??\K:excorsist.bin.exe
    File opened (read-only)\??\I:excorsist.bin.exe
    File opened (read-only)\??\G:excorsist.bin.exe
    File opened (read-only)\??\R:excorsist.bin.exe
    File opened (read-only)\??\D:excorsist.bin.exe
    File opened (read-only)\??\B:excorsist.bin.exe
    File opened (read-only)\??\O:excorsist.bin.exe
    File opened (read-only)\??\N:excorsist.bin.exe
    File opened (read-only)\??\X:excorsist.bin.exe
    File opened (read-only)\??\W:excorsist.bin.exe
    File opened (read-only)\??\V:excorsist.bin.exe
    File opened (read-only)\??\T:excorsist.bin.exe
    File opened (read-only)\??\S:excorsist.bin.exe
    File opened (read-only)\??\Q:excorsist.bin.exe
    File opened (read-only)\??\M:excorsist.bin.exe
    File opened (read-only)\??\J:excorsist.bin.exe
    File opened (read-only)\??\H:excorsist.bin.exe
    File opened (read-only)\??\F:excorsist.bin.exe
    File opened (read-only)\??\E:excorsist.bin.exe
    File opened (read-only)\??\A:excorsist.bin.exe
    File opened (read-only)\??\Z:excorsist.bin.exe
    File opened (read-only)\??\Y:excorsist.bin.exe
    File opened (read-only)\??\U:excorsist.bin.exe
    File opened (read-only)\??\P:excorsist.bin.exe
    File opened (read-only)\??\L:excorsist.bin.exe
  • Modifies service
    vssvc.exe

    TTPs

    Modify RegistryModify Existing Service

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writervssvc.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writervssvc.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writervssvc.exe
    Key created\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writervssvc.exe
  • Interacts with shadow copies
    vssadmin.exe

    Description

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery

    Reported IOCs

    pidprocess
    1320vssadmin.exe
  • Modifies data under HKEY_USERS
    excorsist.bin.exe

    Reported IOCs

    descriptioniocprocess
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = f36b4d50242b71915dcceaf73045ec811d1d6b85949e0ea8b365becbcab587ceexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 045dae5e883b8f0e5575a2761a1b225d93582c220cb217c8f9d5043332f8dfd1excorsist.bin.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{9563bb1f-0000-0000-0000-100000000000}excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 66b97f8502769e4e4d0cbcd2e35489afcab4999a865c877402ba82b4db0b2a97excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 04af62fda022cf8e1053caa01c6cdf1cba13735473adcd0fd568e0b831ebd910excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = cc4416eac73eebbcef7ed6d9774d834180dc474d739f7ca02affd8009d74b3cbexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 1e581efe00a8c1b1275f39bc33fc8e998d10b8fc98fd70a5dfab9002cdc79619excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c0050006f00700055006e0064006f002e006d0070007600320000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c005200650073006f006c00760065004200610063006b00750070002e007000700073006d0000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0043006800650063006b0070006f0069006e0074004f00750074002e006d007000340000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = a86b4c2f64eb809706b0f4b550b01f43b8e0ac57ef26ed7946ba6b47a935dfdbexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c004700720061006e007400440069007300610062006c0065002e00740069006600660000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 07af2c8240bfb2e9f2eeb36c26748ad7c3a5fe47e50079362b3daae946a400baexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 704a7e988f22f191fa91dd000747d29f3ff5d742ad63f0c63ce6ba0cb8206bcbexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c0043006f006e00760065007200740054006f0055006e006c006f0063006b002e006b006900780000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c0053006100760065004100640064002e006a007000670000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 6b90ff377ed7d81e347d977bdc2955a1354951cadf4bde8ab8f3edbd2f3ca8d0excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 3d61073f4dd09eccda4dc18b9085ec4e52a470c97f7096163fcf957a85859a5cexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 9b6e4f366eeb56d00ba3cfc671eee8f93d0bb7943e79f343decc0fd20650038aexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c00530075007300700065006e006400530068006f0077002e0062006d00700000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c00530075007300700065006e00640041007000700072006f00760065002e006d00680074006d006c0000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 8e85eb17797e83afbab2e82e314a9b02268eb26a50e1bd2878de4f3d79735600excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c0055006e006c006f0063006b0055006e00720065006700690073007400650072002e006d006800740000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 36122184f5e598cffe626aa288964d8616d5ff3420dd4cfb7853c2c2fcfb5c8fexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = bb2fc102c415b29fadf7618a19bc500306771d0bd77b2408c11b2321ee7cd609excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 0875a82a0765f4607d530b83eb4cbcfb3697ab0dea466cbad61c6afcba7c0b78excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = cee670697f09f057305069c40aa587dc1dcc6358959dd5b48afaa5214e16ccccexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 96844074741c115cbdd392c077a88f77563ac17f46da558d11c7bd4469c2fcc5excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = da2ec336bf19c38244c6981057ae864bcb2a0ad1d9b6bfdcd0f53683213fa6d9excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 467fa5819b03495d2c070a9f34da86b5ab65493f0ad97ead0a5e7bd55f32ca32excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c004d0065006100730075007200650055006e0069006e007300740061006c006c002e00740069006600660000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 5fd82dd5f2891a65a7ec7d68523944e01393bd4f94accd0ff8434edd1029fe2bexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 94d90213f4d00d655c4954f00b36f957916dea47ecf3092b205f59a5059291c9excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = eb01026a680ed4a16b8802c5a41b65ba785e2059e036c021a0e64b155e194554excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 7d32f2280f0700e30533d9bf5b23680f2a29f4ff0f04250d9ff80cb998278b54excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = dbc5c204206dd4ef54ccffbf2cb33ffdf952f675e681ae3f75d27d578d2b0fa8excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 09402f42e86081d73480641336a55c205a39d6e652ebef5daed5cd735648429eexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c0054006500730074004e00650077002e006d00700065006700330000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c0052006500630065006e0074006c0079002e0064006f006300780000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = c9291fec2b6a6a2727dfa52fd9af748048b0ccd678c31111478d20d64f74719fexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 752a2f66978c430b40ea4e485e685a2bb7bff9559eebaa2897c96e1b810139e1excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = af7dda9f6eaf1a2e79e10608e4f6cccf425e59e16f0f20774fc4b17bd5a527dfexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 5f8359d51105007c0e6a24effaf34002bbeaa38c6dd0beeb4e1b7c6e9c98890eexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c004d00650072006700650043006f006e007600650072007400460072006f006d002e0073006e00640000000000excorsist.bin.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settingsexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 54080bc89fd2662ce0d441d53ca0b69802dd315581d8d17ef00441e8c9469d90excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c0052006500710075006500730074005300650061007200630068002e0078006c007300780000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 58b436c7d2f29efc1d07e9035684c336f071ee05625349b242ba458efb6bc3e0excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 42341b082fbf95e5e3fdb2356293ebeb4ea9fd8029ac4b8ce9285e90b89614e6excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c00500069006e0067005000750062006c006900730068002e0063007300760000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = de1fdec8ccb13594aa76e555c0520af66c867aef84e8e49d151e8c5dae095909excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = f5928aae7d913e9e9d72d0eaafad22b0781ea7ecd401de1a94b21cc12f9b6a01excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c0043006800650063006b0070006f0069006e00740052006500610064002e007300760067007a0000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c00520065007300740061007200740045006e00610062006c0065002e00680074006d006c0000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = b39c8515e4526aaff48427dfdcc2d85e22a0650ecfc52e0c175be5949aac83b7excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 13b28eba964b96093ebf84be121f0c3a249736506c12690c60913634051ef147excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 6a2114136ca7ef2a85d9fdbad7ecf3bf6999467da887a9486266e4fbe2af1911excorsist.bin.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{9563bb1f-0000-0000-0000-500600000000}\MaxCapacity = "15150"excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = a1dcf0ae86b16004160feaf798f11259a0afb7824cf1be64a96cffc31048208aexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = b4eb66a8e08e074dfa02a80ae5bec6158c74993aa055489f2071eacc8a4c4ba0excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = b82e054aec3120aba3e17959c62833721fe9fe5b25f124a1b13ffa03981b1478excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 77fbbfb22d5e294304cce4bfb0277927066f4721e2e7f3edc28c336f147585baexcorsist.bin.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0055006e0064006f005300650074002e006f006400730000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 3cbdc5d2a08fa6ba702c2eaa38329bafe02413e71fb7cb4837c3cce2a0531997excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 868958becbb4fdaa612a18049e36ce69658eae56e20c05e89ed32c3b4afd10aaexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 427fd2cb97064a21f2ce8a5c9a10f09b513de0658f8b57bb9deb90afe9660b64excorsist.bin.exe
    Key deleted\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c002e006f007200610063006c0065005f006a00720065005f00750073006100670065005c003900300037003300370064003300320065003300610062006100340062002e00740069006d0065007300740061006d00700000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 16d53853a25326901503201fa7627d820952b835abfaaf8f6275df8135e8ea30excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = c84f39d6c320be9e6295afb1dc1cc3b52de8f5b11b2c504fb16b0d60bb96e07eexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 08c37043be58d151cfa8fe89a5897539a9dca80bfb687a5ad8f15bc87472e570excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c0043006c006f00730065004200610063006b00750070002e007300760067007a0000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 79523f6f420f2e95ef85a4b5ba774916172466008e3563ba67b8008c8ec2b8feexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 5b7ae702337a3a4674d423418bef9d6cd4b0af85ec3e668e666e271dfbcd323fexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = c558a48184e4b06c9104777934ef3a3c234dbb85b6588a178a4a85b8b22c1c90excorsist.bin.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 96b52cca4d076cf6e86d2cd2ee3525253046aa8425a0eba7968cf5cac84ac5c4excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 892ab1cb71b7e377a0311754ae6145ba45c8da5d58e8774274c06d03d62287bbexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = f15068bf628ee2c40c3cf77549123aa7f2c98d53a0cfaf8e0e40e3cd2881c54eexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c007600630072006500640069007300740032003000310039005f007800360034005f003000300030005f0076006300520075006e00740069006d0065004d0069006e0069006d0075006d005f007800360034002e006c006f00670000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0052006500730069007a00650048006900640065002e0072006d00690000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 15223e68cacdc363c611502af4a6279e3b26b004568faf3153b6dfab102ccca5excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 42a8255a044346179f32112946e9126feef5106dc4e4384c4a3075dc2183f94bexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = dac7fc6a511618a49d664c4ff3748684005c314f94b8ba69e19cbd17dd3e4fddexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 5e42a2827a9503288ce343aea01679facf1898a1bb4e642b09ed0197caff7d2cexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 02ae68ef528879daecf1191094393a8f19a9f6a313c5b56d8fcefe1894e3f223excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c005200650073006f006c0076006500520065007300650074002e0078006d006c0000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 0023d4105bcf0528148f50315e16e4238ce29ca64cceea01669dca8267bd61e1excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c00540065007300740052006500630065006900760065002e00740069006600660000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 8874e980da696da662618ca7a8fe8e7acddf6b739cc1632b15a4c5f579db5376excorsist.bin.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c007600630072006500640069007300740032003000310039005f007800360034005f003000300031005f0076006300520075006e00740069006d0065004100640064006900740069006f006e0061006c005f007800360034002e006c006f00670000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 733218cd4a29ff9abba8c3e4ec75f2db5233070e94d09209c71013772da0d0ceexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = e7f1b98c8257166ec1349471908b6596e3f2f6dc7948abb8e25641398bfe7f39excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 1e94d7a4e4f0d2275385cf703b47adc98976900c86d409608340933de4e1d9d6excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004600610076006f00720069007400650073005c00420069006e0067002e00750072006c0000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c004500780070006f007200740045007800690074002e0063006600670000000000excorsist.bin.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c00540068006500730065002e0064006f006300780000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 272e88f1c8a616ae3fcb90029b82ec4dd8734801abebc3482fba6c14e615750cexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = b04be2479695dfbc238764d752f12887dd94d6dfd1c36baae5dff243e0b58d8fexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = d54f8c53dba1ceb05e660b2ceb40a4ded556108237d58bb8a693f556681a5d55excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 882694bd265d4aedee3f14d241aadae0a1b699ecda22535a5ecf263b4c11fe56excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 5814283295619f08a2127d5f39c976f3ef8b1aca7ccf05a6a22b458fbc1798b0excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c004400690073006d006f0075006e007400500069006e0067002e0061007300700000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c0053006500740045007800690074002e007600620000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c005200650061006400470072006f00750070002e0070006f00740000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = fa532a576cc6e31173819b1893e226cdebddfb0162ea33e8b85d4025af906033excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 0f403affbd29f8bb4cb7ab8441ec28aa14506b34cde1cd79d496b4d12d44dc17excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c00410064006400530065006c006500630074002e0065006d00660000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c0043006f006d00700061007200650048006900640065002e007600730074006d0000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 961b64b7f83aa8511784de1996441d638cf407abb7bcacccfb74ff8a44e7ddcbexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c0043006f006d0070006c0065007400650055006e007000750062006c006900730068002e0064007800660000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = bb2cd67206f9940f8cb8085f5b82e141b02799a639cd02fe2ccf1ee169a75c3fexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c00520065006e0061006d0065005500700064006100740065002e0070007500620000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = ae0a40a83791179693c66c6e5e2c13f76e337b21c3e7b8a63ccb82cd6aac21f7excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 306b75be12d0c2bd227f50a2d2f4a57b58961fa7917d7251c70e4ebc63b5089bexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 79ce143ef92b54d07eba12b450d5515630e754b76c40d1ba1154b4997315ff64excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c0049006e0069007400690061006c0069007a0065004f00750074002e0063007200320000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = c720ef721d0ca5195f31fbe69e390765060e76cf03cc636a187c3023012bbc6fexcorsist.bin.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volumeexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c0052006500730069007a0065004c006f0063006b002e0078006c00610000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 537f5584a463b5609718a8b29119bddb0a05ee2d6a54e891ae48772efd4e0abaexcorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c0046006f0072006d00610074005200650076006f006b0065002e0064006f006300780000000000excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 9185c6c0f36b9afce3a8a9e58ab7dca10faddb88880682e303ab07d3340cc4e2excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = b7b47fbfcdc40a84841130ac95963a4780d92d9ca1a85ee85512a74d2368eb37excorsist.bin.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c007600630072006500640069007300740032003000310033005f007800360034005f003000300031005f0076006300520075006e00740069006d0065004100640064006900740069006f006e0061006c005f007800360034002e006c006f00670000000000excorsist.bin.exe
  • NTFS ADS
    excorsist.bin.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\lVvwrn\windows.sys:dhpkxqkdunexcorsist.bin.exe
    File createdC:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\Stq6AP\windows.sys:qvqhfjkvnrdtqgttexcorsist.bin.exe
    File createdC:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\lVvwrn\windows.sys:dhpkxqkdunexcorsist.bin.exe
    File createdC:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\qhmHkZ\windows.sys:qxoyhxveerelbnrwgexcorsist.bin.exe
  • Suspicious behavior: EnumeratesProcesses
    excorsist.bin.exe

    Reported IOCs

    pidprocess
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
    2920excorsist.bin.exe
  • Suspicious use of AdjustPrivilegeToken
    excorsist.bin.exevssvc.exeWMIC.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege2920excorsist.bin.exe
    Token: SeRestorePrivilege2920excorsist.bin.exe
    Token: SeDebugPrivilege2920excorsist.bin.exe
    Token: SeSecurityPrivilege2920excorsist.bin.exe
    Token: SeRestorePrivilege2920excorsist.bin.exe
    Token: SeDebugPrivilege2920excorsist.bin.exe
    Token: SeBackupPrivilege424vssvc.exe
    Token: SeRestorePrivilege424vssvc.exe
    Token: SeAuditPrivilege424vssvc.exe
    Token: SeIncreaseQuotaPrivilege2556WMIC.exe
    Token: SeSecurityPrivilege2556WMIC.exe
    Token: SeTakeOwnershipPrivilege2556WMIC.exe
    Token: SeLoadDriverPrivilege2556WMIC.exe
    Token: SeSystemProfilePrivilege2556WMIC.exe
    Token: SeSystemtimePrivilege2556WMIC.exe
    Token: SeProfSingleProcessPrivilege2556WMIC.exe
    Token: SeIncBasePriorityPrivilege2556WMIC.exe
    Token: SeCreatePagefilePrivilege2556WMIC.exe
    Token: SeBackupPrivilege2556WMIC.exe
    Token: SeRestorePrivilege2556WMIC.exe
    Token: SeShutdownPrivilege2556WMIC.exe
    Token: SeDebugPrivilege2556WMIC.exe
    Token: SeSystemEnvironmentPrivilege2556WMIC.exe
    Token: SeRemoteShutdownPrivilege2556WMIC.exe
    Token: SeUndockPrivilege2556WMIC.exe
    Token: SeManageVolumePrivilege2556WMIC.exe
    Token: 332556WMIC.exe
    Token: 342556WMIC.exe
    Token: 352556WMIC.exe
    Token: 362556WMIC.exe
  • Suspicious use of WriteProcessMemory
    excorsist.bin.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2920 wrote to memory of 38562920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 38562920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 38562920excorsist.bin.execmd.exe
    PID 3856 wrote to memory of 13203856cmd.exevssadmin.exe
    PID 3856 wrote to memory of 13203856cmd.exevssadmin.exe
    PID 3856 wrote to memory of 13203856cmd.exevssadmin.exe
    PID 2920 wrote to memory of 12202920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 12202920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 12202920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 14642920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 14642920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 14642920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 18162920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 18162920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 18162920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 16642920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 16642920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 16642920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 21402920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 21402920excorsist.bin.execmd.exe
    PID 2920 wrote to memory of 21402920excorsist.bin.execmd.exe
    PID 2140 wrote to memory of 25562140cmd.exeWMIC.exe
    PID 2140 wrote to memory of 25562140cmd.exeWMIC.exe
    PID 2140 wrote to memory of 25562140cmd.exeWMIC.exe
Processes 10
  • C:\Users\Admin\AppData\Local\Temp\excorsist.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\excorsist.bin.exe"
    Drops desktop.ini file(s)
    Enumerates connected drives
    Modifies data under HKEY_USERS
    Modifies extensions of user files
    NTFS ADS
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C vssadmin Delete Shadows /All /Quiet
      Suspicious use of WriteProcessMemory
      PID:3856
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /All /Quiet
        Interacts with shadow copies
        PID:1320
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C bcdedit /set {default} recoveryenabled No
      PID:1220
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
      PID:1464
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C wbadmin DELETE SYSTEMSTATEBACKUP
      PID:1816
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      PID:1664
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C wmic SHADOWCOPY /nointeractive
      Suspicious use of WriteProcessMemory
      PID:2140
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic SHADOWCOPY /nointeractive
        Suspicious use of AdjustPrivilegeToken
        PID:2556
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Modifies service
    Suspicious use of AdjustPrivilegeToken
    PID:424
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Initial Access
              Lateral Movement
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads
                  • memory/1220-2-0x0000000000000000-mapping.dmp

                  • memory/1320-1-0x0000000000000000-mapping.dmp

                  • memory/1464-3-0x0000000000000000-mapping.dmp

                  • memory/1664-5-0x0000000000000000-mapping.dmp

                  • memory/1816-4-0x0000000000000000-mapping.dmp

                  • memory/2140-6-0x0000000000000000-mapping.dmp

                  • memory/2556-7-0x0000000000000000-mapping.dmp

                  • memory/2920-42-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-8-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-9-0x0000000005560000-0x0000000005561000-memory.dmp

                  • memory/2920-10-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-11-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-12-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-13-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-14-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-15-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-16-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-17-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-18-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-19-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-20-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-21-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-22-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-23-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-24-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-25-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-26-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-27-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-28-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-29-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-30-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-31-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-32-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-33-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-34-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-35-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-36-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-37-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-38-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-39-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-40-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-41-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-330-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-43-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-44-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-45-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-46-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-47-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-48-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-49-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-50-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-51-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-52-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-53-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-54-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-55-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-56-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-57-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-58-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-59-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-60-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-61-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-62-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-63-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-64-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-65-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-66-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-67-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-68-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-69-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-70-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-71-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-72-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-73-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-74-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-75-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-76-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-77-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-78-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-79-0x0000000004D40000-0x0000000004D41000-memory.dmp

                  • memory/2920-81-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-82-0x0000000005560000-0x0000000005561000-memory.dmp

                  • memory/2920-154-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-156-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-158-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-160-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-162-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-164-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-166-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-167-0x0000000005560000-0x0000000005561000-memory.dmp

                  • memory/2920-168-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-170-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-172-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-174-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-176-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-178-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-180-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-182-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-184-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-186-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-188-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-190-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-192-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-193-0x0000000005560000-0x0000000005561000-memory.dmp

                  • memory/2920-194-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-196-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-198-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-200-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-202-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-204-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-205-0x0000000005560000-0x0000000005561000-memory.dmp

                  • memory/2920-206-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-208-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-210-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-212-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-214-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-216-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-218-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-220-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-222-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-224-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-226-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-228-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-230-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-232-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-234-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-236-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-238-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-240-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-242-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-244-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-246-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-248-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-250-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-252-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-254-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-256-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-258-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-260-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-262-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-264-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-266-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-268-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-270-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-272-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-274-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-276-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-278-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-280-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-282-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-284-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-286-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-288-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-290-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-292-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-294-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-296-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-298-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-300-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-302-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-304-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-306-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-308-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-310-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-312-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-314-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-316-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-318-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-320-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-322-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-324-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-326-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-328-0x0000000004D60000-0x0000000004D61000-memory.dmp

                  • memory/2920-451-0x0000000001000000-0x00000000010C6000-memory.dmp

                  • memory/3856-0-0x0000000000000000-mapping.dmp