573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d
573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d.exe
91KB
10-11-2020 15:29
457a4ba6896e15e132cc084cb6cd7a80
e79fc10dcf685be830578d09cb8ea2894b1d280d
573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d
Extracted
Path | C:\odt\8512B-Readme.txt |
Family | netwalker |
Ransom Note |
Hi!
Your files are encrypted.
All encrypted files for this computer has extension: .8512b
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised,
rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,
it could be files on the network belonging to other users, sure you want to take that responsibility?
--
Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.
The only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.
We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.
For us this is just business and to prove to you our seriousness, we will decrypt you some files for free,
but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.
Сontact us:
1.sevenoneone@cock.li
2.kavariusing@tutanota.com
Don't forget to include your code in the email:
{code_5f9d9c92_8512b:
i/4ev9P8VUQi+d5VrmK+kaw2VSnazs6yELdKkEyGyKIqLZ6eQM
h/XD2H5GFFdpBSU84/92j/SNsCg0XBw4qVtzHjIYXYOHwLkpyd
X/Xq1P72gbiJeA5QB/nh7SE7cGeF5JWi6CahDvWfTPqHEX0Xfq
pMuTtzYD0oT1jZyZh/TUHmMQla8q62o/4HCEHh4X0aN8eiU+Ts
RSFJHvdqk2pqGtn2loB9IdtLOqZtDUf5+xOmlgFfDS4tODTQOR
+HG3cKNfPki9T/e80DojnqXw9ULEqhUsE=}
|
Emails |
sevenoneone@cock.li kavariusing@tutanota.com |
Extracted
Path | C:\Users\Admin\Searches\8512B-Readme.txt |
Family | netwalker |
Ransom Note |
Hi!
Your files are encrypted.
All encrypted files for this computer has extension: .8512b
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised,
rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,
it could be files on the network belonging to other users, sure you want to take that responsibility?
--
Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.
The only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.
We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.
For us this is just business and to prove to you our seriousness, we will decrypt you some files for free,
but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.
Сontact us:
1.sevenoneone@cock.li
2.kavariusing@tutanota.com
Don't forget to include your code in the email:
{code_5f9d9c92_8512b:
i/4ev9P8VUQi+d5VrmK+kaw2VSnazs6yELdKkEyGyKIqLZ6eQM
h/XD2H5GFFdpBSU84/92j/SNsCg0XBw4qVtzHjIYXYOHwLkpyd
X/Xq1P72gbiJeA5QB/nh7SE7cGeF5JWi6CahDvWfTPqHEX0Xfq
pMuTtzYD0oT1jZyZh/TUHmMQla8q62o/4HCEHh4X0aN8eiU+Ts
RSFJHvdqk2pqGtn2loB9IdtLOqZtDUf5+xOmlgFfDS4tODTQOR
+HG3cKNfPki9T/e80DojnqXw9ULEqhUsE=}Hi!
Your files are encrypted.
All encrypted files for this computer has extension: .8512b
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised,
rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,
it could be files on the network belonging to other users, sure you want to take that responsibility?
--
Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.
The only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.
We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.
For us this is just business and to prove to you our seriousness, we will decrypt you some files for free,
but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.
Сontact us:
1.sevenoneone@cock.li
2.kavariusing@tutanota.com
Don't forget to include your code in the email:
{code_5f9d9c92_8512b:
i/4ev9P8VUQi+d5VrmK+kaw2VSnazs6yELdKkEyGyKIqLZ6eQM
h/XD2H5GFFdpBSU84/92j/SNsCg0XBw4qVtzHjIYXYOHwLkpyd
X/Xq1P72gbiJeA5QB/nh7SE7cGeF5JWi6CahDvWfTPqHEX0Xfq
pMuTtzYD0oT1jZyZh/TUHmMQla8q62o/4HCEHh4X0aN8eiU+Ts
RSFJHvdqk2pqGtn2loB9IdtLOqZtDUf5+xOmlgFfDS4tODTQOR
+HG3cKNfPki9T/e80DojnqXw9ULEqhUsE=}
|
Emails |
sevenoneone@cock.li kavariusing@tutanota.com |
Filter: none
-
Detected Netwalker Ransomware
Description
Detected unpacked Netwalker executable.
Reported IOCs
resource yara_rule behavioral2/memory/2484-1-0x0000000000140000-0x000000000015B000-memory.dmp netwalker_ransomware behavioral2/memory/2144-3-0x0000000001330000-0x000000000134B000-memory.dmp netwalker_ransomware -
Netwalker Ransomware
Description
Ransomware family with multiple versions. Also known as MailTo.
Tags
-
Deletes shadow copies
Description
Ransomware often targets backup files to inhibit system recovery.
Tags
TTPs
-
Modifies extensions of user filesexplorer.exe
Description
Ransomware generally changes the extension on encrypted files.
Tags
Reported IOCs
description ioc process File opened for modification C:\Users\Admin\Pictures\UpdateLimit.tiff explorer.exe File opened for modification C:\Users\Admin\Pictures\EnterUnprotect.tiff explorer.exe File opened for modification C:\Users\Admin\Pictures\CheckpointExpand.tiff explorer.exe File opened for modification C:\Users\Admin\Pictures\AssertImport.tiff explorer.exe -
Deletes itselfexplorer.exe
Reported IOCs
pid process 2144 explorer.exe -
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Adds Run key to start applicationexplorer.exe
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8512bd54 = "C:\\Program Files (x86)\\8512bd54\\8512bd54.exe" explorer.exe -
Modifies servicevssvc.exe
Tags
TTPs
Reported IOCs
description ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Suspicious use of SetThreadContext573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d.exe
Reported IOCs
description pid process target process PID 2484 set thread context of 2144 2484 573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d.exe explorer.exe -
Drops file in Program Files directoryexplorer.exe
Reported IOCs
description ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6100_32x32x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-400.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailBadge.scale-125.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\jmxremote.password.template explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\tripeaks\Expedition_Leader_Unearned_small.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-150.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSUIGHUR.TTF explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\8512B-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\images\OfficeHubLogo_150x150.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\3416_24x24x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\ui-strings.js explorer.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Info.plist explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20_altform-unplated.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ch_16x11.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\MedTile.scale-100.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sqlpdw.xsl explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-40.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\office.odf explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\ui-strings.js explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\4642_40x40x32.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main.css explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\8512B-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\aquarium_12h.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\8512B-Readme.txt explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare.HxS explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\classic_1h.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-400.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\PaintMedTile.scale-150.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OneConnectAppList.targetsize-256.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\bg_60x42.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\IconOpenInRefocus.contrast-white_scale-200.png explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\StarClub\Help_2_2.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\8512B-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\ui-strings.js explorer.exe File created C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\8512B-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\32.jpg explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteWideTile.scale-150.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeWideTile.scale-100.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-200.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac explorer.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\hu.pak explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Generic.xbf explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\MedTile.scale-100.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPageState2\awards_bp_920.jpg explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\coffee.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-black_scale-100.png explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-125_contrast-white.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5313_20x20x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\SmallTile.scale-200.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\nu_60x42.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js explorer.exe -
Interacts with shadow copiesvssadmin.exevssadmin.exe
Description
Shadow copies are often targeted by ransomware to inhibit system recovery.
Tags
TTPs
Reported IOCs
pid process 2260 vssadmin.exe 2972 vssadmin.exe -
Suspicious behavior: EnumeratesProcessesexplorer.exeexplorer.exe
Reported IOCs
pid process 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2144 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe 2856 explorer.exe -
Suspicious behavior: MapViewOfSection573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d.exeexplorer.exe
Reported IOCs
pid process 2484 573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d.exe 2144 explorer.exe -
Suspicious use of AdjustPrivilegeTokenexplorer.exeexplorer.exevssvc.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 2144 explorer.exe Token: SeDebugPrivilege 2856 explorer.exe Token: SeBackupPrivilege 3796 vssvc.exe Token: SeRestorePrivilege 3796 vssvc.exe Token: SeAuditPrivilege 3796 vssvc.exe -
Suspicious use of WriteProcessMemory573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d.exeexplorer.exeexplorer.exe
Reported IOCs
description pid process target process PID 2484 wrote to memory of 2144 2484 573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d.exe explorer.exe PID 2484 wrote to memory of 2144 2484 573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d.exe explorer.exe PID 2484 wrote to memory of 2144 2484 573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d.exe explorer.exe PID 2144 wrote to memory of 2260 2144 explorer.exe vssadmin.exe PID 2144 wrote to memory of 2260 2144 explorer.exe vssadmin.exe PID 2144 wrote to memory of 2856 2144 explorer.exe explorer.exe PID 2144 wrote to memory of 2856 2144 explorer.exe explorer.exe PID 2144 wrote to memory of 2856 2144 explorer.exe explorer.exe PID 2856 wrote to memory of 2972 2856 explorer.exe vssadmin.exe PID 2856 wrote to memory of 2972 2856 explorer.exe vssadmin.exe
-
C:\Users\Admin\AppData\Local\Temp\573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d.exe"C:\Users\Admin\AppData\Local\Temp\573873b7b2fbb390ff21bb4e986f69fa25a1f3eea2c5fe446d46c186ab92257d.exe"Suspicious use of SetThreadContextSuspicious behavior: MapViewOfSectionSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"Modifies extensions of user filesDeletes itselfAdds Run key to start applicationDrops file in Program Files directorySuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quietInteracts with shadow copies
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quietInteracts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exeModifies serviceSuspicious use of AdjustPrivilegeToken
-
memory/2144-0-0x0000000000000000-mapping.dmp
-
memory/2144-3-0x0000000001330000-0x000000000134B000-memory.dmp
-
memory/2260-2-0x0000000000000000-mapping.dmp
-
memory/2484-1-0x0000000000140000-0x000000000015B000-memory.dmp
-
memory/2856-4-0x0000000000000000-mapping.dmp
-
memory/2972-5-0x0000000000000000-mapping.dmp