Analysis
-
max time kernel
154s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe
Resource
win10v20201028
General
-
Target
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe
-
Size
67KB
-
MD5
bde3ec20e9f8253524fa74aeb65681ba
-
SHA1
1ade5bf755530e16c631106bf266c4632c372c34
-
SHA256
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581
-
SHA512
1d152ab20b03cd74021810a9739dd0c1a03f2bcb87fde9f4926d07d330c9f8517a9fa5c16cb0046f59c13c92bfc7e23e9aeb6924dea66ae2a61eb50fb0daaf9d
Malware Config
Extracted
C:\odt\D3C95-Readme.txt
netwalker
priparipri@tuta.io
praparapra@cock.li
Extracted
C:\Users\Admin\Downloads\D3C95-Readme.txt
netwalker
priparipri@tuta.io
praparapra@cock.li
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\D3C95-Readme.txt
netwalker
priparipri@tuta.io
praparapra@cock.li
Extracted
C:\Users\Admin\Documents\D3C95-Readme.txt
netwalker
priparipri@tuta.io
praparapra@cock.li
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ConfirmRedo.tiff 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Drops file in Program Files directory 11676 IoCs
Processes:
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\Solve\autosolve_button_over.mobile.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\PrizeHistory\badges_diamond.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-200.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\D3C95-Readme.txt 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-150.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\ui-strings.js 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\dismiss.contrast-white.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5313_48x48x32.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\classic_11s.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\PrizeHistory\badges_silver.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxMediumTile.scale-100.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\HelpIcon_contrast-white.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_AR-SA.respack 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-200.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-125.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\ui-strings.js 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\604_40x40x32.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\PrizeHistory\badges_none.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\SwipeTeachingCalloutImage.layoutdir-LTR.gif 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\DashboardDefaultThumbnail.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-150.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_altform-unplated_contrast-black.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-unplated.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-125_contrast-white.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\162.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_contrast-black.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-36.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\WideTile.scale-125.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-400.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-100.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-400.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-60_altform-unplated.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\ui-strings.js 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\AppxManifest.xml 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\fr-FR.PhoneNumber.SMS.model 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-fullcolor.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\resources.pri 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-40_altform-unplated.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLargeTile.scale-200.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\VBE6EXT.OLB 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\ui-strings.js 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\microsoft.system.package.metadata\S-1-5-21-1985363256-3005190890-1182679451-1000-MergedResources-0.pri 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosWideTile.scale-200.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\sunshine.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\5601_48x48x32.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-150.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\10911_20x20x32.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\mask\11h.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\D3C95-Readme.txt 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-white_scale-100.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleLargeTile.scale-125.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-36_altform-unplated.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-125_contrast-black.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1937_36x36x32.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2584 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 41714 IoCs
Processes:
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exepid process 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exevssvc.exedescription pid process Token: SeDebugPrivilege 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe Token: SeImpersonatePrivilege 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe Token: SeBackupPrivilege 188 vssvc.exe Token: SeRestorePrivilege 188 vssvc.exe Token: SeAuditPrivilege 188 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exedescription pid process target process PID 2432 wrote to memory of 2584 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe vssadmin.exe PID 2432 wrote to memory of 2584 2432 882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe"C:\Users\Admin\AppData\Local\Temp\882e89ea1b8d70646bdf6476d8cb46991b950f27e03e93bf49ea3209c2d69581.bin.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2584-0-0x0000000000000000-mapping.dmp