Analysis
-
max time kernel
97s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-11-2020 14:48
Static task
static1
Behavioral task
behavioral1
Sample
e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe
Resource
win10v20201028
General
-
Target
e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe
-
Size
532KB
-
MD5
76f547c793b5478b970c64caf04d01d4
-
SHA1
f9eb40f6d3d4c83852e3781886db762bef8564e0
-
SHA256
e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037
-
SHA512
91e91a8b693cb253f281411260611a221a113b342eaa642a9d6597aaf86c138ee2aa28ade10218a814ae34016e6d70824e36786497476ab704defddf60e33e17
Malware Config
Signatures
-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exedescription ioc process File renamed C:\Users\Admin\Pictures\RemoveStop.tiff => \??\c:\Users\Admin\Pictures\RemoveStop.tiff.ReadManual.5A595725 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File renamed C:\Users\Admin\Pictures\SetConvertFrom.raw => \??\c:\Users\Admin\Pictures\SetConvertFrom.raw.ReadManual.5A595725 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File renamed C:\Users\Admin\Pictures\WaitFind.tif => \??\c:\Users\Admin\Pictures\WaitFind.tif.ReadManual.5A595725 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Pictures\RemoveStop.tiff e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Pictures\BackupInvoke.tiff e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File renamed C:\Users\Admin\Pictures\BackupInvoke.tiff => \??\c:\Users\Admin\Pictures\BackupInvoke.tiff.ReadManual.5A595725 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File renamed C:\Users\Admin\Pictures\CompressStop.tif => \??\c:\Users\Admin\Pictures\CompressStop.tif.ReadManual.5A595725 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File renamed C:\Users\Admin\Pictures\PushMount.crw => \??\c:\Users\Admin\Pictures\PushMount.crw.ReadManual.5A595725 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File renamed C:\Users\Admin\Pictures\UninstallReceive.raw => \??\c:\Users\Admin\Pictures\UninstallReceive.raw.ReadManual.5A595725 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File renamed C:\Users\Admin\Pictures\AddUnlock.tif => \??\c:\Users\Admin\Pictures\AddUnlock.tif.ReadManual.5A595725 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1020 cmd.exe -
Drops desktop.ini file(s) 29 IoCs
Processes:
e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exedescription ioc process File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe -
Modifies service 2 TTPs 4 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe -
Drops file in Program Files directory 9143 IoCs
Processes:
e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exedescription ioc process File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\lua\http\RecoveryManual.html e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REMOTE.CFG e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0213449.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0300912.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\SAVE.GIF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jre7\lib\security\java.security e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\INFOMS.ICO e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MEDIA\BOMB.WAV e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01140_.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099169.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238927.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107158.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\RecoveryManual.html e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_dot.png e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\RecoveryManual.html e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\RecoveryManual.html e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File created \??\c:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\RecoveryManual.html e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_OffMask.bmp e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OutSyncPC.ico e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.jpg e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152696.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\RecoveryManual.html e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299611.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE.HXS e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\SPACER.GIF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Document Themes 14\Technic.thmx e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfoInternal.zip e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107500.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00238_.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115840.GIF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana.css e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH.HXS e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Civic.eftx e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Document Themes 14\Trek.thmx e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupiconsmask.bmp e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_left.png e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107492.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\BG_ADOBE.GIF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7EN.LEX e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195248.WMF e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\glow.png e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\lij.txt e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 576 vssadmin.exe -
Modifies registry class 5 IoCs
Processes:
e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\.5A595725\shell\Open\command e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\.5A595725 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\.5A595725\shell e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\.5A595725\shell\Open e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\.5A595725\shell\Open\command\ = "explorer.exe RecoveryManual.html" e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 740 powershell.exe 740 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exevssvc.exee7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exedescription pid process Token: SeDebugPrivilege 740 powershell.exe Token: SeBackupPrivilege 1532 vssvc.exe Token: SeRestorePrivilege 1532 vssvc.exe Token: SeAuditPrivilege 1532 vssvc.exe Token: SeTakeOwnershipPrivilege 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe Token: SeRestorePrivilege 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exepid process 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exepowershell.execmd.exedescription pid process target process PID 2036 wrote to memory of 1632 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe splwow64.exe PID 2036 wrote to memory of 1632 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe splwow64.exe PID 2036 wrote to memory of 1632 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe splwow64.exe PID 2036 wrote to memory of 1632 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe splwow64.exe PID 2036 wrote to memory of 740 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe powershell.exe PID 2036 wrote to memory of 740 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe powershell.exe PID 2036 wrote to memory of 740 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe powershell.exe PID 2036 wrote to memory of 740 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe powershell.exe PID 740 wrote to memory of 576 740 powershell.exe vssadmin.exe PID 740 wrote to memory of 576 740 powershell.exe vssadmin.exe PID 740 wrote to memory of 576 740 powershell.exe vssadmin.exe PID 740 wrote to memory of 576 740 powershell.exe vssadmin.exe PID 2036 wrote to memory of 1020 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe cmd.exe PID 2036 wrote to memory of 1020 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe cmd.exe PID 2036 wrote to memory of 1020 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe cmd.exe PID 2036 wrote to memory of 1020 2036 e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe cmd.exe PID 1020 wrote to memory of 1744 1020 cmd.exe attrib.exe PID 1020 wrote to memory of 1744 1020 cmd.exe attrib.exe PID 1020 wrote to memory of 1744 1020 cmd.exe attrib.exe PID 1020 wrote to memory of 1744 1020 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe"C:\Users\Admin\AppData\Local\Temp\e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe"
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 12288
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden -c $mypid='2036';[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~259264208.tmp')|iex
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /Quiet
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F757EC1.bat" "C:\Users\Admin\AppData\Local\Temp\e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe""
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037.exe"
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0F757EC1.batMD5
348cae913e496198548854f5ff2f6d1e
SHA1a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611
-
C:\Users\Admin\AppData\Local\Temp\~259264208.tmpMD5
4e1a1e3e715c291c71950d2fdc79e2be
SHA1dc2b3d20a9ec88e0d8d75c5097154687acc42983
SHA256acf88b9224ae067d92882d1c8ec1461a663e83f02848488ce125dc0538d87a39
SHA512d1be9f6459c248a93c95cc40a68e60ca2fe8068ff4ed5d442437a72bcc09ebf8568e3338d39abebbf3fe8e9e4e3a21a58e1ed6bdbcdd0a3b2ca46b6a81597d80
-
memory/576-28-0x0000000000000000-mapping.dmp
-
memory/740-18-0x0000000006150000-0x0000000006151000-memory.dmpFilesize
4KB
-
memory/740-26-0x00000000062E0000-0x00000000062E1000-memory.dmpFilesize
4KB
-
memory/740-7-0x00000000048B0000-0x00000000048B1000-memory.dmpFilesize
4KB
-
memory/740-8-0x0000000002580000-0x0000000002581000-memory.dmpFilesize
4KB
-
memory/740-9-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/740-5-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6MB
-
memory/740-13-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/740-4-0x0000000000000000-mapping.dmp
-
memory/740-19-0x0000000006190000-0x0000000006191000-memory.dmpFilesize
4KB
-
memory/740-6-0x0000000002110000-0x0000000002111000-memory.dmpFilesize
4KB
-
memory/740-27-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/1020-29-0x0000000000000000-mapping.dmp
-
memory/1632-2-0x0000000000000000-mapping.dmp
-
memory/1744-33-0x0000000000000000-mapping.dmp
-
memory/2036-30-0x0000000000330000-0x0000000000334000-memory.dmpFilesize
16KB
-
memory/2036-31-0x0000000002780000-0x0000000002784000-memory.dmpFilesize
16KB
-
memory/2036-3-0x00000000003F0000-0x00000000003FF000-memory.dmpFilesize
60KB