Overview
overview
10Static
static
80323b4326b...02.exe
windows7_x64
100323b4326b...02.exe
windows10_x64
100898a80dc2...92.exe
windows7_x64
100898a80dc2...92.exe
windows10_x64
100aaecf7f77...91.exe
windows7_x64
100aaecf7f77...91.exe
windows10_x64
10150e8ef3f1...02.exe
windows7_x64
10150e8ef3f1...02.exe
windows10_x64
1023e95ba676...7f.exe
windows7_x64
1023e95ba676...7f.exe
windows10_x64
1028e7dc4aeb...33.exe
windows7_x64
28e7dc4aeb...33.exe
windows10_x64
10350b0d6ae2...d7.exe
windows7_x64
1350b0d6ae2...d7.exe
windows10_x64
13a6ebac4f8...ca.exe
windows7_x64
103a6ebac4f8...ca.exe
windows10_x64
103fe801df14...4f.exe
windows7_x64
83fe801df14...4f.exe
windows10_x64
841367ad447...00.exe
windows7_x64
1041367ad447...00.exe
windows10_x64
1048f4749f13...77.exe
windows7_x64
148f4749f13...77.exe
windows10_x64
1499d936c22...82.exe
windows7_x64
10499d936c22...82.exe
windows10_x64
104b5a6926ab...d1.exe
windows7_x64
14b5a6926ab...d1.exe
windows10_x64
14bb0d8eb6b...81.exe
windows7_x64
104bb0d8eb6b...81.exe
windows10_x64
105de3d5a337...ed.exe
windows7_x64
105de3d5a337...ed.exe
windows10_x64
105e2b2fe65d...20.exe
windows7_x64
15e2b2fe65d...20.exe
windows10_x64
3Analysis
-
max time kernel
152s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
30-03-2021 11:28
Behavioral task
behavioral1
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral2
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral4
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral6
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral8
Sample
150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral10
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral12
Sample
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral14
Sample
350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral16
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral18
Sample
3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral20
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral22
Sample
48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral24
Sample
499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral26
Sample
4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral27
Sample
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral28
Sample
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral29
Sample
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral30
Sample
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral31
Sample
5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral32
Sample
5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe
Resource
win10v20201028
windows10_x64
General
-
Target
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
-
Size
143KB
-
MD5
b77cc8a1ede23a80a4a4c9d0a8b40735
-
SHA1
254c97abab837687c779b57c7ef1bec4c1e2351a
-
SHA256
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581
-
SHA512
f94546161808210ada027d03465f88336de4f2d24581801566f7ff17a9641b389c43946a98275ed637759a0205b8d09f9028d26bb75ab44e3f7038c5b4667ffd
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe" reg.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.bfc 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RSSITEMS.ICO 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02369_.WMF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.HTM 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_F_COL.HXK 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHigh.jpg 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105530.WMF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198025.WMF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImagesMask.bmp 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\GRAY.pf 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\THMBNAIL.PNG 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\SPRING.ELM 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00117_.WMF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107750.WMF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.MMW 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDEBARVERTBB.POC 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\RyukReadMe.txt 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\RyukReadMe.txt 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\RyukReadMe.txt 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV.HXS 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14655_.GIF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01235U.BMP 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR44B.GIF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\MMSL.ICO 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00241_.WMF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\ELPHRG01.WAV 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\RyukReadMe.txt 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\RyukReadMe.txt 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\RyukReadMe.txt 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105396.WMF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Aspect.thmx 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL086.XML 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\RyukReadMe.txt 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-api.xml 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chicago 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen.css 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090149.WMF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21313_.GIF 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 70104 vssadmin.exe 70436 vssadmin.exe 70468 vssadmin.exe 69968 vssadmin.exe 70068 vssadmin.exe 70168 vssadmin.exe 70272 vssadmin.exe 70036 vssadmin.exe 70500 vssadmin.exe 70136 vssadmin.exe 70200 vssadmin.exe 70320 vssadmin.exe 70404 vssadmin.exe 70532 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe Token: SeBackupPrivilege 69996 vssvc.exe Token: SeRestorePrivilege 69996 vssvc.exe Token: SeAuditPrivilege 69996 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 1740 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe 29 PID 1900 wrote to memory of 1740 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe 29 PID 1900 wrote to memory of 1740 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe 29 PID 1900 wrote to memory of 1740 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe 29 PID 1900 wrote to memory of 1116 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe 13 PID 1740 wrote to memory of 532 1740 cmd.exe 31 PID 1740 wrote to memory of 532 1740 cmd.exe 31 PID 1740 wrote to memory of 532 1740 cmd.exe 31 PID 1740 wrote to memory of 532 1740 cmd.exe 31 PID 1900 wrote to memory of 1192 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe 12 PID 1900 wrote to memory of 69932 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe 33 PID 1900 wrote to memory of 69932 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe 33 PID 1900 wrote to memory of 69932 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe 33 PID 1900 wrote to memory of 69932 1900 4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe 33 PID 69932 wrote to memory of 69968 69932 cmd.exe 35 PID 69932 wrote to memory of 69968 69932 cmd.exe 35 PID 69932 wrote to memory of 69968 69932 cmd.exe 35 PID 69932 wrote to memory of 69968 69932 cmd.exe 35 PID 69932 wrote to memory of 70036 69932 cmd.exe 37 PID 69932 wrote to memory of 70036 69932 cmd.exe 37 PID 69932 wrote to memory of 70036 69932 cmd.exe 37 PID 69932 wrote to memory of 70036 69932 cmd.exe 37 PID 69932 wrote to memory of 70068 69932 cmd.exe 38 PID 69932 wrote to memory of 70068 69932 cmd.exe 38 PID 69932 wrote to memory of 70068 69932 cmd.exe 38 PID 69932 wrote to memory of 70068 69932 cmd.exe 38 PID 69932 wrote to memory of 70104 69932 cmd.exe 39 PID 69932 wrote to memory of 70104 69932 cmd.exe 39 PID 69932 wrote to memory of 70104 69932 cmd.exe 39 PID 69932 wrote to memory of 70104 69932 cmd.exe 39 PID 69932 wrote to memory of 70136 69932 cmd.exe 40 PID 69932 wrote to memory of 70136 69932 cmd.exe 40 PID 69932 wrote to memory of 70136 69932 cmd.exe 40 PID 69932 wrote to memory of 70136 69932 cmd.exe 40 PID 69932 wrote to memory of 70168 69932 cmd.exe 41 PID 69932 wrote to memory of 70168 69932 cmd.exe 41 PID 69932 wrote to memory of 70168 69932 cmd.exe 41 PID 69932 wrote to memory of 70168 69932 cmd.exe 41 PID 69932 wrote to memory of 70200 69932 cmd.exe 42 PID 69932 wrote to memory of 70200 69932 cmd.exe 42 PID 69932 wrote to memory of 70200 69932 cmd.exe 42 PID 69932 wrote to memory of 70200 69932 cmd.exe 42 PID 69932 wrote to memory of 70272 69932 cmd.exe 43 PID 69932 wrote to memory of 70272 69932 cmd.exe 43 PID 69932 wrote to memory of 70272 69932 cmd.exe 43 PID 69932 wrote to memory of 70272 69932 cmd.exe 43 PID 69932 wrote to memory of 70320 69932 cmd.exe 44 PID 69932 wrote to memory of 70320 69932 cmd.exe 44 PID 69932 wrote to memory of 70320 69932 cmd.exe 44 PID 69932 wrote to memory of 70320 69932 cmd.exe 44 PID 69932 wrote to memory of 70404 69932 cmd.exe 45 PID 69932 wrote to memory of 70404 69932 cmd.exe 45 PID 69932 wrote to memory of 70404 69932 cmd.exe 45 PID 69932 wrote to memory of 70404 69932 cmd.exe 45 PID 69932 wrote to memory of 70436 69932 cmd.exe 46 PID 69932 wrote to memory of 70436 69932 cmd.exe 46 PID 69932 wrote to memory of 70436 69932 cmd.exe 46 PID 69932 wrote to memory of 70436 69932 cmd.exe 46 PID 69932 wrote to memory of 70468 69932 cmd.exe 47 PID 69932 wrote to memory of 70468 69932 cmd.exe 47 PID 69932 wrote to memory of 70468 69932 cmd.exe 47 PID 69932 wrote to memory of 70468 69932 cmd.exe 47 PID 69932 wrote to memory of 70500 69932 cmd.exe 48 PID 69932 wrote to memory of 70500 69932 cmd.exe 48
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1192
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe"C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe" /f /reg:642⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe" /f /reg:643⤵
- Adds Run key to start application
PID:532
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69932 -
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69968
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:70036
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:70068
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70104
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70136
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70168
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70200
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70272
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70320
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70404
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70436
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70468
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70500
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70532
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:69996