Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-07-2021 12:59
Static task
static1
Behavioral task
behavioral1
Sample
9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe
Resource
win10v20210408
General
-
Target
9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe
-
Size
54KB
-
MD5
420a63c216ee218f00a224cd9f16d6c7
-
SHA1
092d20014ed9e28cd4faf092dd2947ed11808ee4
-
SHA256
9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983
-
SHA512
94c6c7a70aff9bc193c198b127deab3835c7c3a0eb27b8c52d69e1b383152554d9f925bc7a653600b700c58fc2601794c1994479e4e8c26a08429290a311652a
Malware Config
Extracted
C:\Users\Public\Documents\!!!_READ_ME_B408CE06_!!!.txt
ragnarlocker
https://prnt.sc/v36ygd
https://prnt.sc/v37089
https://prnt.sc/v36yxt
https://prnt.sc/v36zio
https://prnt.sc/v36xi8
https://prnt.sc/v370oi
http://p6o7m73ujalhgkiv.onion/?38KP4j2zYlWcWRm6zsLg
http://rgnar43spcnsocswaw22lmk7jnget5f6vow7kqmnf4jc6hfwpiwoajid.onion/client/?384fAE1DDC9DE3D3b670f7961AEEAA6DBDaCfb972D6Fff48Baf0bcc6c1da2FAc
http://p6o7m73ujalhgkiv.onion/?http://p6o7m73ujalhgkiv.onion/?38KP4j2zYlWcWRm6zsLg
Signatures
-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exepid process 2192 bcdedit.exe 3476 bcdedit.exe 2152 bcdedit.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exedescription ioc process File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-1594587808-2047097707-2163810515-1000\desktop.ini 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exedescription ioc process File opened (read-only) \??\E: 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaTypewriterRegular.ttf 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\!!!_READ_ME_B408CE06_!!!.txt 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCalls.h 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\content-types.properties 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_fr.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunjce_provider.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\!!!_READ_ME_B408CE06_!!!.txt 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\ij 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\derby_common.bat 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File created C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\!!!_READ_ME_B408CE06_!!!.txt 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\!!!_READ_ME_B408CE06_!!!.txt 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\classfile_constants.h 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\LINEAR_RGB.pf 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\charsets.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\classlist 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\plugin.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunpkcs11.jar 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\!!!_READ_ME_B408CE06_!!!.txt 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\Xusage.txt 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exepid process 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exewmic.exevssvc.exedescription pid process Token: SeTakeOwnershipPrivilege 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe Token: SeRestorePrivilege 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe Token: SeIncreaseQuotaPrivilege 200 wmic.exe Token: SeSecurityPrivilege 200 wmic.exe Token: SeTakeOwnershipPrivilege 200 wmic.exe Token: SeLoadDriverPrivilege 200 wmic.exe Token: SeSystemProfilePrivilege 200 wmic.exe Token: SeSystemtimePrivilege 200 wmic.exe Token: SeProfSingleProcessPrivilege 200 wmic.exe Token: SeIncBasePriorityPrivilege 200 wmic.exe Token: SeCreatePagefilePrivilege 200 wmic.exe Token: SeBackupPrivilege 200 wmic.exe Token: SeRestorePrivilege 200 wmic.exe Token: SeShutdownPrivilege 200 wmic.exe Token: SeDebugPrivilege 200 wmic.exe Token: SeSystemEnvironmentPrivilege 200 wmic.exe Token: SeRemoteShutdownPrivilege 200 wmic.exe Token: SeUndockPrivilege 200 wmic.exe Token: SeManageVolumePrivilege 200 wmic.exe Token: 33 200 wmic.exe Token: 34 200 wmic.exe Token: 35 200 wmic.exe Token: 36 200 wmic.exe Token: SeIncreaseQuotaPrivilege 200 wmic.exe Token: SeSecurityPrivilege 200 wmic.exe Token: SeTakeOwnershipPrivilege 200 wmic.exe Token: SeLoadDriverPrivilege 200 wmic.exe Token: SeSystemProfilePrivilege 200 wmic.exe Token: SeSystemtimePrivilege 200 wmic.exe Token: SeProfSingleProcessPrivilege 200 wmic.exe Token: SeIncBasePriorityPrivilege 200 wmic.exe Token: SeCreatePagefilePrivilege 200 wmic.exe Token: SeBackupPrivilege 200 wmic.exe Token: SeRestorePrivilege 200 wmic.exe Token: SeShutdownPrivilege 200 wmic.exe Token: SeDebugPrivilege 200 wmic.exe Token: SeSystemEnvironmentPrivilege 200 wmic.exe Token: SeRemoteShutdownPrivilege 200 wmic.exe Token: SeUndockPrivilege 200 wmic.exe Token: SeManageVolumePrivilege 200 wmic.exe Token: 33 200 wmic.exe Token: 34 200 wmic.exe Token: 35 200 wmic.exe Token: 36 200 wmic.exe Token: SeBackupPrivilege 2804 vssvc.exe Token: SeRestorePrivilege 2804 vssvc.exe Token: SeAuditPrivilege 2804 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exedescription pid process target process PID 856 wrote to memory of 200 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe wmic.exe PID 856 wrote to memory of 200 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe wmic.exe PID 856 wrote to memory of 2192 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe bcdedit.exe PID 856 wrote to memory of 2192 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe bcdedit.exe PID 856 wrote to memory of 3476 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe bcdedit.exe PID 856 wrote to memory of 3476 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe bcdedit.exe PID 856 wrote to memory of 2152 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe bcdedit.exe PID 856 wrote to memory of 2152 856 9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe"C:\Users\Admin\AppData\Local\Temp\9b62cdb57f4c34924333dfa3baefd993efeab68109580b682b074f0e73b63983.sample.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:200
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:2192
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵
- Modifies boot configuration data using bcdedit
PID:3476
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {globalsettings} advancedoptions false2⤵
- Modifies boot configuration data using bcdedit
PID:2152
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804