e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4

General

Target

e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
Size

758KB
MD5

3a6551daf5dab06e71c14026ee84fd03
SHA1

cbb6763f76a926c2a0721664977fdbc6f205fff5
SHA256

e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4
SHA512

f092f2b791c6bf4d6817c5d325a1302a95da5336884fd91422aa446b8c918af439eee209009a18d36d81edee07b28055eae730efa834c9def40aef31bdc586a7

Score

10^/10

evasion ransomware trojan

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\mWHhV_readme_.txt

Ransom Note

-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bEADbcADDa You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MTA3OC0yVzRMazBORFBIbGVFQmVyMmVJeWpqY21RaDNMYno3a1Bic0RCaTlqK3dpampaVnJ6T3NaTmx5Tk1IbklsRDlwZkFFbGlrZEZmaGpjRGptU2hDYmZ4MFlXS2Uwc29HNUlxaEExZHBRN2tFYTJmbXhDTGg1dzJDdEVaVlFacjVtRXY4TW9NbGxZdFFmUmFkSmloRnZVMWhaSzdTb091K28xRmFiNnBGaVR3ZFRzeHdUOXFyMzFVb3AraVBzdzl2cU9UUUVvMW5lMFhaSEFTMUk1bHdBQ3VKTkRMWFVPWmZwN3hnVGQ1c2hFa2lVTmh0dVJyM3hCdXo1NUZLWmFUYlUyQitSZUJLOWh6V25yNjVLUTU3NXNTbzM1REpZR3hVaS9TczE4Z1FLMDJqc0ZnTE5WeHFsVzlvUWRzNFMvV2pNemhWV0hnMEN4ZVFQcjZidTJtTU9iN01vYU42RFlNSzdBR1ZzS0Jqa0RUVk9IUjh0KzRaZkZYcy9uR0t1SjY4YUs4VzZPajZNckh4YWN4TStDUHBmSnFSL2xSVy90R2tMRkFRenJsY3VLYmw2dnJpTU0yeHR5VnVjbXgyOUZSUVFHQzEvcENqamRBWmpaTlJXTEs4UXM4d2tWbVVLbmJGUThEdmd0MzQ3OG10MmlWTXAwNXdwNXl6UHI0Z1F5aWcyYXRUM3JEaTFaWm9Sdy9HSjlRWHloZFMxWnBTNzUwMWFOR2E2NEdsenBzZVF1dVVHQ2dWLzRVZVU1UzJtK3N3ZHE4clZoTUIyN1ZYR29wR2Z1dUJIQzUzUkNtSTgxOTFkSVhFOEtXTW5VTmJ6K2JqaTFsVUJ3Y2FxU29qMmJGNno0eXBwSG5nYlJKWmN6NnBpS0I2dlNMa2NucmlLZDFlVkF3WnRydDNSU0pHdEkzYURaL1YzNkRXS2NsUlE0bmFpbXNaZlBPRmpNWmhOZlhtcGFYRC95TnY5UGdWdjJMOE1neWtnM2RLSXpZYkZwM2VqVFEzd3lNRjB3aTZFVWpOb3NCb2JvVGpKSFRaL3gxdjlkd0lHekVFRm5weGF3RnJsUGM0S3Zac0VDUW04V2wvdWtSc2VvUC9KZXlrSlJYRTk3RG0vc1QyN3FKcnRrV3AwQjlKR0xUZ2lrL3dxdE9XYmc1d2pHUzc2ek5rL2hEbVF0bmpORGU1UFhUN0lmS01tb1NhSm1UMzZ5cnlTUGFTWWNmUGptRUozS243UFpabzZyeDBaVTVuSGJRR3FRNW1kRkFCdnVGcFBIY3FvcnI4ejNlbWZSTFJhaFZlaTI4Y1VjUVh2dytNbnJOS3o2MFE0UE5UNjNGT0lSdWRwckFiNnZjcVdzTllLK3dmeGkrWUg1eHhPT0J0S25EcjJzc0VGdDJackx4OVRDeVBWcmJUNWdHbHU5OHh6bUpFTmtvTU1uT0Q0ajU1SkhCQ2Y0Y3JQYVJLWXVIeHBrdUVHS3lwQjMzYWM2dktmMklSKzhMbHhXNFJ2SzEzc0FtdnJNU0I1Qy85ZDhwRXJZRjUyZzVWZDBNZEpVT1QxZVlXZVZsRTR6NElCT28rVTdJM0o4aUtQc3pHTlNlWFE5THI5RVYvSVpVV1RKOTdpbXRRR2FJV2ZJbENEOXJBY1lBTFVEeE95MzAyamVkdi8rV1MvYVRyWnRGYjRlcjh6OFRORWtTek5EMk9QdmF6NERkYW9XMkt0cGpkSzk3NkpvVXhZa0RFZ3c5dGlIK09KcFgyazBOQk5PT1h4SXVIVmZlMjYyWWpmRkhxU0g4QThzcEVCdFUyMFdaMjUrcTZBQk5PZ2t1bldqbGQvT0hOVER6QS9nY3NXd0lsTndGbmRTajM0NDhSbitSMzUwTUF4UGRqeWwrdkxlTEhRcjdxK1BBVGtKZFBubEl6Mkg4b2ZNdUNESHd4d2lMdUhySE85emR6OVM3d1FpZTVzUnhublpEeGk3ejBzZTgrMjVrVzIwczZlNm9Td3NNYTBiVlJNb0dMT1dobG5PaUsxVHB5Q2g5UlgxV0hjSDhxS0hBczRrRzd1a0VmTzlJNEpxNWt6aFNmWitXcGZHVXB3dnM0SkV5SkVMM2Ric1g3Y1BXT0tXb0xZPQ== -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * C1CeKrtR

URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Music\mWHhV_readme_.txt

Ransom Note

-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bEADbcADDa You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MTA3OC0yVzRMazBORFBIbGVFQmVyMmVJeWpqY21RaDNMYno3a1Bic0RCaTlqK3dpampaVnJ6T3NaTmx5Tk1IbklsRDlwZkFFbGlrZEZmaGpjRGptU2hDYmZ4MFlXS2Uwc29HNUlxaEExZHBRN2tFYTJmbXhDTGg1dzJDdEVaVlFacjVtRXY4TW9NbGxZdFFmUmFkSmloRnZVMWhaSzdTb091K28xRmFiNnBGaVR3ZFRzeHdUOXFyMzFVb3AraVBzdzl2cU9UUUVvMW5lMFhaSEFTMUk1bHdBQ3VKTkRMWFVPWmZwN3hnVGQ1c2hFa2lVTmh0dVJyM3hCdXo1NUZLWmFUYlUyQitSZUJLOWh6V25yNjVLUTU3NXNTbzM1REpZR3hVaS9TczE4Z1FLMDJqc0ZnTE5WeHFsVzlvUWRzNFMvV2pNemhWV0hnMEN4ZVFQcjZidTJtTU9iN01vYU42RFlNSzdBR1ZzS0Jqa0RUVk9IUjh0KzRaZkZYcy9uR0t1SjY4YUs4VzZPajZNckh4YWN4TStDUHBmSnFSL2xSVy90R2tMRkFRenJsY3VLYmw2dnJpTU0yeHR5VnVjbXgyOUZSUVFHQzEvcENqamRBWmpaTlJXTEs4UXM4d2tWbVVLbmJGUThEdmd0MzQ3OG10MmlWTXAwNXdwNXl6UHI0Z1F5aWcyYXRUM3JEaTFaWm9Sdy9HSjlRWHloZFMxWnBTNzUwMWFOR2E2NEdsenBzZVF1dVVHQ2dWLzRVZVU1UzJtK3N3ZHE4clZoTUIyN1ZYR29wR2Z1dUJIQzUzUkNtSTgxOTFkSVhFOEtXTW5VTmJ6K2JqaTFsVUJ3Y2FxU29qMmJGNno0eXBwSG5nYlJKWmN6NnBpS0I2dlNMa2NucmlLZDFlVkF3WnRydDNSU0pHdEkzYURaL1YzNkRXS2NsUlE0bmFpbXNaZlBPRmpNWmhOZlhtcGFYRC95TnY5UGdWdjJMOE1neWtnM2RLSXpZYkZwM2VqVFEzd3lNRjB3aTZFVWpOb3NCb2JvVGpKSFRaL3gxdjlkd0lHekVFRm5weGF3RnJsUGM0S3Zac0VDUW04V2wvdWtSc2VvUC9KZXlrSlJYRTk3RG0vc1QyN3FKcnRrV3AwQjlKR0xUZ2lrL3dxdE9XYmc1d2pHUzc2ek5rL2hEbVF0bmpORGU1UFhUN0lmS01tb1NhSm1UMzZ5cnlTUGFTWWNmUGptRUozS243UFpabzZyeDBaVTVuSGJRR3FRNW1kRkFCdnVGcFBIY3FvcnI4ejNlbWZSTFJhaFZlaTI4Y1VjUVh2dytNbnJOS3o2MFE0UE5UNjNGT0lSdWRwckFiNnZjcVdzTllLK3dmeGkrWUg1eHhPT0J0S25EcjJzc0VGdDJackx4OVRDeVBWcmJUNWdHbHU5OHh6bUpFTmtvTU1uT0Q0ajU1SkhCQ2Y0Y3JQYVJLWXVIeHBrdUVHS3lwQjMzYWM2dktmMklSKzhMbHhXNFJ2SzEzc0FtdnJNU0I1Qy85ZDhwRXJZRjUyZzVWZDBNZEpVT1QxZVlXZVZsRTR6NElCT28rVTdJM0o4aUtQc3pHTlNlWFE5THI5RVYvSVpVV1RKOTdpbXRRR2FJV2ZJbENEOXJBY1lBTFVEeE95MzAyamVkdi8rV1MvYVRyWnRGYjRlcjh6OFRORWtTek5EMk9QdmF6NERkYW9XMkt0cGpkSzk3NkpvVXhZa0RFZ3c5dGlIK09KcFgyazBOQk5PT1h4SXVIVmZlMjYyWWpmRkhxU0g4QThzcEVCdFUyMFdaMjUrcTZBQk5PZ2t1bldqbGQvT0hOVER6QS9nY3NXd0lsTndGbmRTajM0NDhSbitSMzUwTUF4UGRqeWwrdkxlTEhRcjdxK1BBVGtKZFBubEl6Mkg4b2ZNdUNESHd4d2lMdUhySE85emR6OVM3d1FpZTVzUnhublpEeGk3ejBzZTgrMjVrVzIwczZlNm9Td3NNYTBiVlJNb0dMT1dobG5PaUsxVHB5Q2g5UlgxV0hjSDhxS0hBczRrRzd1a0VmTzlJNEpxNWt6aFNmWitXcGZHVXB3dnM0SkV5SkVMM2Ric1g3Y1BXT0tXb0xZPQ== -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * YdJ0f4gFo85

URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

wmic.exewmic.exewmic.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	1972	wmic.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	1972	wmic.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	492	1972	wmic.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\RequestRegister.tiff	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File renamed	C:\Users\Admin\Pictures\RequestRegister.tiff => C:\Users\Admin\Pictures\RequestRegister.tiff.bEADbcADDa	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened for modification	C:\Users\Admin\Pictures\WaitRestart.tiff	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File renamed	C:\Users\Admin\Pictures\SyncConvertFrom.crw => C:\Users\Admin\Pictures\SyncConvertFrom.crw.bEADbcADDa	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File renamed	C:\Users\Admin\Pictures\WaitRestart.tiff => C:\Users\Admin\Pictures\WaitRestart.tiff.bEADbcADDa	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File renamed	C:\Users\Admin\Pictures\FindPublish.tif => C:\Users\Admin\Pictures\FindPublish.tif.bEADbcADDa	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File renamed	C:\Users\Admin\Pictures\JoinRepair.tif => C:\Users\Admin\Pictures\JoinRepair.tif.bEADbcADDa	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

description	ioc	process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

description	ioc	process
File opened (read-only)	\??\G:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\H:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\J:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\P:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\Y:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\Z:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\E:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\F:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\I:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\L:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\S:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\X:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\B:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\K:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\M:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\O:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\T:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\U:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\A:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\Q:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\R:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\V:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\W:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
File opened (read-only)	\??\N:	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

2004 vssadmin.exe
252 vssadmin.exe
1404 vssadmin.exe

pid	process
2004	vssadmin.exe
252	vssadmin.exe
1404	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 646 IoCs

Processes:

e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

pid	process
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

Suspicious use of AdjustPrivilegeToken 255 IoCs

Processes:

wmic.exewmic.exewmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	492	wmic.exe
Token: SeSecurityPrivilege	492	wmic.exe
Token: SeTakeOwnershipPrivilege	492	wmic.exe
Token: SeLoadDriverPrivilege	492	wmic.exe
Token: SeSystemProfilePrivilege	492	wmic.exe
Token: SeSystemtimePrivilege	492	wmic.exe
Token: SeProfSingleProcessPrivilege	492	wmic.exe
Token: SeIncBasePriorityPrivilege	492	wmic.exe
Token: SeCreatePagefilePrivilege	492	wmic.exe
Token: SeBackupPrivilege	492	wmic.exe
Token: SeRestorePrivilege	492	wmic.exe
Token: SeShutdownPrivilege	492	wmic.exe
Token: SeDebugPrivilege	492	wmic.exe
Token: SeSystemEnvironmentPrivilege	492	wmic.exe
Token: SeRemoteShutdownPrivilege	492	wmic.exe
Token: SeUndockPrivilege	492	wmic.exe
Token: SeManageVolumePrivilege	492	wmic.exe
Token: 33	492	wmic.exe
Token: 34	492	wmic.exe
Token: 35	492	wmic.exe
Token: 36	492	wmic.exe
Token: SeIncreaseQuotaPrivilege	3172	wmic.exe
Token: SeSecurityPrivilege	3172	wmic.exe
Token: SeTakeOwnershipPrivilege	3172	wmic.exe
Token: SeLoadDriverPrivilege	3172	wmic.exe
Token: SeSystemProfilePrivilege	3172	wmic.exe
Token: SeSystemtimePrivilege	3172	wmic.exe
Token: SeProfSingleProcessPrivilege	3172	wmic.exe
Token: SeIncBasePriorityPrivilege	3172	wmic.exe
Token: SeCreatePagefilePrivilege	3172	wmic.exe
Token: SeBackupPrivilege	3172	wmic.exe
Token: SeRestorePrivilege	3172	wmic.exe
Token: SeShutdownPrivilege	3172	wmic.exe
Token: SeDebugPrivilege	3172	wmic.exe
Token: SeSystemEnvironmentPrivilege	3172	wmic.exe
Token: SeRemoteShutdownPrivilege	3172	wmic.exe
Token: SeUndockPrivilege	3172	wmic.exe
Token: SeManageVolumePrivilege	3172	wmic.exe
Token: 33	3172	wmic.exe
Token: 34	3172	wmic.exe
Token: 35	3172	wmic.exe
Token: 36	3172	wmic.exe
Token: SeIncreaseQuotaPrivilege	4052	wmic.exe
Token: SeSecurityPrivilege	4052	wmic.exe
Token: SeTakeOwnershipPrivilege	4052	wmic.exe
Token: SeLoadDriverPrivilege	4052	wmic.exe
Token: SeSystemProfilePrivilege	4052	wmic.exe
Token: SeSystemtimePrivilege	4052	wmic.exe
Token: SeProfSingleProcessPrivilege	4052	wmic.exe
Token: SeIncBasePriorityPrivilege	4052	wmic.exe
Token: SeCreatePagefilePrivilege	4052	wmic.exe
Token: SeBackupPrivilege	4052	wmic.exe
Token: SeRestorePrivilege	4052	wmic.exe
Token: SeShutdownPrivilege	4052	wmic.exe
Token: SeDebugPrivilege	4052	wmic.exe
Token: SeSystemEnvironmentPrivilege	4052	wmic.exe
Token: SeRemoteShutdownPrivilege	4052	wmic.exe
Token: SeUndockPrivilege	4052	wmic.exe
Token: SeManageVolumePrivilege	4052	wmic.exe
Token: 33	4052	wmic.exe
Token: 34	4052	wmic.exe
Token: 35	4052	wmic.exe
Token: 36	4052	wmic.exe
Token: SeIncreaseQuotaPrivilege	1752	wmic.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

description	pid	process	target process
PID 984 wrote to memory of 4052	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	wmic.exe
PID 984 wrote to memory of 4052	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	wmic.exe
PID 984 wrote to memory of 4052	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	wmic.exe
PID 984 wrote to memory of 2004	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	vssadmin.exe
PID 984 wrote to memory of 2004	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	vssadmin.exe
PID 984 wrote to memory of 2004	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	vssadmin.exe
PID 984 wrote to memory of 496	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	wmic.exe
PID 984 wrote to memory of 496	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	wmic.exe
PID 984 wrote to memory of 496	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	wmic.exe
PID 984 wrote to memory of 252	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	vssadmin.exe
PID 984 wrote to memory of 252	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	vssadmin.exe
PID 984 wrote to memory of 252	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	vssadmin.exe
PID 984 wrote to memory of 3732	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	wmic.exe
PID 984 wrote to memory of 3732	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	wmic.exe
PID 984 wrote to memory of 3732	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	wmic.exe
PID 984 wrote to memory of 1404	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	vssadmin.exe
PID 984 wrote to memory of 1404	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	vssadmin.exe
PID 984 wrote to memory of 1404	984	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe	vssadmin.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe

C:\Users\Admin\AppData\Local\Temp\e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe
"C:\Users\Admin\AppData\Local\Temp\e73b749260028b1b6957978b54201f289c56743c201b3a6aa1d4743540df23f4.exe"
1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:984

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic SHADOWCOPY DELETE /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\SysWOW64\vssadmin.exe
vssadmin Delete Shadows /All /Quiet
2⤵
- Interacts with shadow copies
PID:2004

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic SHADOWCOPY DELETE /nointeractive
2⤵
PID:496

C:\Windows\SysWOW64\vssadmin.exe
vssadmin Delete Shadows /All /Quiet
2⤵
- Interacts with shadow copies
PID:252

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic SHADOWCOPY DELETE /nointeractive
2⤵
PID:3732

C:\Windows\SysWOW64\vssadmin.exe
vssadmin Delete Shadows /All /Quiet
2⤵
- Interacts with shadow copies
PID:1404

C:\Windows\system32\wbem\wmic.exe
wmic SHADOWCOPY DELETE /nointeractive
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\system32\wbem\wmic.exe
wmic SHADOWCOPY DELETE /nointeractive
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\system32\wbem\wmic.exe
wmic SHADOWCOPY DELETE /nointeractive
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:492