Analysis
-
max time kernel
151s -
max time network
10s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe
Resource
win10v20201028
General
-
Target
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe
-
Size
67KB
-
MD5
bde3ec20e9f8253524fa74aeb65681ba
-
SHA1
1ade5bf755530e16c631106bf266c4632c372c34
-
SHA256
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581
-
SHA512
1d152ab20b03cd74021810a9739dd0c1a03f2bcb87fde9f4926d07d330c9f8517a9fa5c16cb0046f59c13c92bfc7e23e9aeb6924dea66ae2a61eb50fb0daaf9d
Malware Config
Extracted
C:\Program Files (x86)\Common Files\Adobe AIR\E1638-Readme.txt
netwalker
priparipri@tuta.io
praparapra@cock.li
Extracted
C:\Users\Admin\Downloads\E1638-Readme.txt
netwalker
priparipri@tuta.io
praparapra@cock.li
Extracted
C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\E1638-Readme.txt
netwalker
priparipri@tuta.io
praparapra@cock.li
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe -
Drops file in Program Files directory 7480 IoCs
Processes:
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\TAB_OFF.GIF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Seoul 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02390_.WMF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Gaza 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00260_.WMF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00798_.WMF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\XMLSDK5.CHM 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Perspective.xml 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01742_.GIF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Apex.xml 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00760L.GIF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File created C:\Program Files\7-Zip\Lang\E1638-Readme.txt 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01329_.WMF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.UDT 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_GreenTea.gif 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\E1638-Readme.txt 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCOUPON.XML 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DVA.api 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FORM.JS 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_AutoMask.bmp 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis.css 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIconsMask.bmp 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01183_.WMF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01568_.WMF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN065.XML 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.XML 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\macroprogress.gif 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00014_.WMF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Grid.xml 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.GIF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RSSITEM.CFG 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285462.WMF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\E1638-Readme.txt 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\E1638-Readme.txt 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14757_.GIF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02757U.BMP 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1092 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 17889 IoCs
Processes:
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exepid process 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exevssvc.exedescription pid process Token: SeDebugPrivilege 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe Token: SeImpersonatePrivilege 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe Token: SeBackupPrivilege 7084 vssvc.exe Token: SeRestorePrivilege 7084 vssvc.exe Token: SeAuditPrivilege 7084 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exedescription pid process target process PID 1916 wrote to memory of 1092 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe vssadmin.exe PID 1916 wrote to memory of 1092 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe vssadmin.exe PID 1916 wrote to memory of 1092 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe vssadmin.exe PID 1916 wrote to memory of 1092 1916 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe"C:\Users\Admin\AppData\Local\Temp\882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1092-0-0x0000000000000000-mapping.dmp