Analysis
-
max time kernel
128s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
29-03-2021 10:57
Static task
static1
Behavioral task
behavioral1
Sample
4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe
-
Size
678KB
-
MD5
82143033173cbeee7f559002fb8ab8c5
-
SHA1
e03aedb8b9770f899a29f1939636db43825e95cf
-
SHA256
4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4
-
SHA512
77377c732c3fb944f56170e6382fbc25e8bbe1f2ffd42290c52da5f33f7301272c67356843464c89bba71b8c45e3d4222fe70bb7a1f80bbe89b3ce2dc498dcf1
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x00040000000130d5-9.dat family_medusalocker behavioral1/files/0x00040000000130d5-11.dat family_medusalocker -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid Process 1752 svhost.exe -
Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exedescription ioc Process File renamed C:\Users\Admin\Pictures\DismountDebug.raw => C:\Users\Admin\Pictures\DismountDebug.raw.nett 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File renamed C:\Users\Admin\Pictures\PublishWrite.tif => C:\Users\Admin\Pictures\PublishWrite.tif.nett 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File renamed C:\Users\Admin\Pictures\RepairStep.crw => C:\Users\Admin\Pictures\RepairStep.crw.nett 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File renamed C:\Users\Admin\Pictures\SearchInitialize.crw => C:\Users\Admin\Pictures\SearchInitialize.crw.nett 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File renamed C:\Users\Admin\Pictures\UnblockWrite.crw => C:\Users\Admin\Pictures\UnblockWrite.crw.nett 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File renamed C:\Users\Admin\Pictures\HideEdit.tif => C:\Users\Admin\Pictures\HideEdit.tif.nett 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened for modification C:\Users\Admin\Pictures\SendRedo.tiff 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File renamed C:\Users\Admin\Pictures\SendRedo.tiff => C:\Users\Admin\Pictures\SendRedo.tiff.nett 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File renamed C:\Users\Admin\Pictures\SetSearch.tif => C:\Users\Admin\Pictures\SetSearch.tif.nett 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened for modification C:\Users\Admin\Pictures\StepPush.tiff 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File renamed C:\Users\Admin\Pictures\StepPush.tiff => C:\Users\Admin\Pictures\StepPush.tiff.nett 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened for modification C:\Users\Admin\Pictures\UnpublishUnregister.tiff 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File renamed C:\Users\Admin\Pictures\UnpublishUnregister.tiff => C:\Users\Admin\Pictures\UnpublishUnregister.tiff.nett 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exedescription ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3825035466-2522850611-591511364-1000\desktop.ini 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exedescription ioc Process File opened (read-only) \??\I: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\J: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\L: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\R: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\S: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\T: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\B: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\N: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\O: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\Q: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\V: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\W: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\Y: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\Z: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\H: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\E: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\F: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\G: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\K: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\U: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\X: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\A: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\P: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe File opened (read-only) \??\M: 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid Process 976 vssadmin.exe 1204 vssadmin.exe 1536 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exepid Process 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
vssvc.exewmic.exewmic.exewmic.exedescription pid Process Token: SeBackupPrivilege 1972 vssvc.exe Token: SeRestorePrivilege 1972 vssvc.exe Token: SeAuditPrivilege 1972 vssvc.exe Token: SeIncreaseQuotaPrivilege 1780 wmic.exe Token: SeSecurityPrivilege 1780 wmic.exe Token: SeTakeOwnershipPrivilege 1780 wmic.exe Token: SeLoadDriverPrivilege 1780 wmic.exe Token: SeSystemProfilePrivilege 1780 wmic.exe Token: SeSystemtimePrivilege 1780 wmic.exe Token: SeProfSingleProcessPrivilege 1780 wmic.exe Token: SeIncBasePriorityPrivilege 1780 wmic.exe Token: SeCreatePagefilePrivilege 1780 wmic.exe Token: SeBackupPrivilege 1780 wmic.exe Token: SeRestorePrivilege 1780 wmic.exe Token: SeShutdownPrivilege 1780 wmic.exe Token: SeDebugPrivilege 1780 wmic.exe Token: SeSystemEnvironmentPrivilege 1780 wmic.exe Token: SeRemoteShutdownPrivilege 1780 wmic.exe Token: SeUndockPrivilege 1780 wmic.exe Token: SeManageVolumePrivilege 1780 wmic.exe Token: 33 1780 wmic.exe Token: 34 1780 wmic.exe Token: 35 1780 wmic.exe Token: SeIncreaseQuotaPrivilege 268 wmic.exe Token: SeSecurityPrivilege 268 wmic.exe Token: SeTakeOwnershipPrivilege 268 wmic.exe Token: SeLoadDriverPrivilege 268 wmic.exe Token: SeSystemProfilePrivilege 268 wmic.exe Token: SeSystemtimePrivilege 268 wmic.exe Token: SeProfSingleProcessPrivilege 268 wmic.exe Token: SeIncBasePriorityPrivilege 268 wmic.exe Token: SeCreatePagefilePrivilege 268 wmic.exe Token: SeBackupPrivilege 268 wmic.exe Token: SeRestorePrivilege 268 wmic.exe Token: SeShutdownPrivilege 268 wmic.exe Token: SeDebugPrivilege 268 wmic.exe Token: SeSystemEnvironmentPrivilege 268 wmic.exe Token: SeRemoteShutdownPrivilege 268 wmic.exe Token: SeUndockPrivilege 268 wmic.exe Token: SeManageVolumePrivilege 268 wmic.exe Token: 33 268 wmic.exe Token: 34 268 wmic.exe Token: 35 268 wmic.exe Token: SeIncreaseQuotaPrivilege 324 wmic.exe Token: SeSecurityPrivilege 324 wmic.exe Token: SeTakeOwnershipPrivilege 324 wmic.exe Token: SeLoadDriverPrivilege 324 wmic.exe Token: SeSystemProfilePrivilege 324 wmic.exe Token: SeSystemtimePrivilege 324 wmic.exe Token: SeProfSingleProcessPrivilege 324 wmic.exe Token: SeIncBasePriorityPrivilege 324 wmic.exe Token: SeCreatePagefilePrivilege 324 wmic.exe Token: SeBackupPrivilege 324 wmic.exe Token: SeRestorePrivilege 324 wmic.exe Token: SeShutdownPrivilege 324 wmic.exe Token: SeDebugPrivilege 324 wmic.exe Token: SeSystemEnvironmentPrivilege 324 wmic.exe Token: SeRemoteShutdownPrivilege 324 wmic.exe Token: SeUndockPrivilege 324 wmic.exe Token: SeManageVolumePrivilege 324 wmic.exe Token: 33 324 wmic.exe Token: 34 324 wmic.exe Token: 35 324 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exetaskeng.exedescription pid Process procid_target PID 1152 wrote to memory of 1204 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 26 PID 1152 wrote to memory of 1204 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 26 PID 1152 wrote to memory of 1204 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 26 PID 1152 wrote to memory of 1204 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 26 PID 1152 wrote to memory of 1780 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 29 PID 1152 wrote to memory of 1780 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 29 PID 1152 wrote to memory of 1780 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 29 PID 1152 wrote to memory of 1780 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 29 PID 1152 wrote to memory of 1536 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 32 PID 1152 wrote to memory of 1536 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 32 PID 1152 wrote to memory of 1536 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 32 PID 1152 wrote to memory of 1536 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 32 PID 1152 wrote to memory of 268 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 36 PID 1152 wrote to memory of 268 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 36 PID 1152 wrote to memory of 268 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 36 PID 1152 wrote to memory of 268 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 36 PID 1152 wrote to memory of 976 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 38 PID 1152 wrote to memory of 976 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 38 PID 1152 wrote to memory of 976 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 38 PID 1152 wrote to memory of 976 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 38 PID 1152 wrote to memory of 324 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 40 PID 1152 wrote to memory of 324 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 40 PID 1152 wrote to memory of 324 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 40 PID 1152 wrote to memory of 324 1152 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe 40 PID 1620 wrote to memory of 1752 1620 taskeng.exe 44 PID 1620 wrote to memory of 1752 1620 taskeng.exe 44 PID 1620 wrote to memory of 1752 1620 taskeng.exe 44 PID 1620 wrote to memory of 1752 1620 taskeng.exe 44 -
System policy modification 1 TTPs 3 IoCs
Processes:
4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe"C:\Users\Admin\AppData\Local\Temp\4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4.exe"1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1152 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1204
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1536
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:268
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:976
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:324
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
C:\Windows\system32\taskeng.exetaskeng.exe {C7E36BCB-DECD-46C6-A423-75883C805C61} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:1752
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
82143033173cbeee7f559002fb8ab8c5
SHA1e03aedb8b9770f899a29f1939636db43825e95cf
SHA2564ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4
SHA51277377c732c3fb944f56170e6382fbc25e8bbe1f2ffd42290c52da5f33f7301272c67356843464c89bba71b8c45e3d4222fe70bb7a1f80bbe89b3ce2dc498dcf1
-
MD5
82143033173cbeee7f559002fb8ab8c5
SHA1e03aedb8b9770f899a29f1939636db43825e95cf
SHA2564ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4
SHA51277377c732c3fb944f56170e6382fbc25e8bbe1f2ffd42290c52da5f33f7301272c67356843464c89bba71b8c45e3d4222fe70bb7a1f80bbe89b3ce2dc498dcf1