Analysis
-
max time kernel
153s -
max time network
55s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 12:41
Static task
static1
Behavioral task
behavioral1
Sample
63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe
Resource
win10v20210410
General
-
Target
63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe
-
Size
42KB
-
MD5
0fbbc59d4fe280a55c1fb6f5502c1e73
-
SHA1
af53890ed1d4753e7493d48862bdd7d18a2b11f6
-
SHA256
63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059
-
SHA512
20b87ac354cefa2b75e8edbe30b903c51e4f2c2cb49f59dd40732d964612a69b149cb10274feab5c6971c8adfc91fba11f1ebeba38e1b2d45c6b1b4d3dd37633
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_F540D252.txt
ragnarlocker
http://mykgoj7uvqtgl367.onion/client/?61bcbDc31F1c894054C3B84aF53C35cF3005e1A69366A6e857a5a4fd60fb7184
Signatures
-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exedescription ioc process File opened (read-only) \??\E: 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exedescription ioc process File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PNG32.FLT 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\mip.exe.mui 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\THMBNAIL.PNG 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_sun.png 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\PREVIEW.GIF 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.htm 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files\Java\jre7\lib\images\cursors\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Makassar 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\psfontj2d.properties 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\km\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_hov.png 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\STRTEDGE.ELM 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\WPGIMP32.FLT 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\PREVIEW.GIF 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\21.png 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\PHONE.XML 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\br\RGNR_F540D252.txt 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe File opened for modification C:\Program Files\Windows Sidebar\en-US\Sidebar.exe.mui 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1764 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exepid process 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
vssvc.exewmic.exedescription pid process Token: SeBackupPrivilege 1696 vssvc.exe Token: SeRestorePrivilege 1696 vssvc.exe Token: SeAuditPrivilege 1696 vssvc.exe Token: SeIncreaseQuotaPrivilege 1780 wmic.exe Token: SeSecurityPrivilege 1780 wmic.exe Token: SeTakeOwnershipPrivilege 1780 wmic.exe Token: SeLoadDriverPrivilege 1780 wmic.exe Token: SeSystemProfilePrivilege 1780 wmic.exe Token: SeSystemtimePrivilege 1780 wmic.exe Token: SeProfSingleProcessPrivilege 1780 wmic.exe Token: SeIncBasePriorityPrivilege 1780 wmic.exe Token: SeCreatePagefilePrivilege 1780 wmic.exe Token: SeBackupPrivilege 1780 wmic.exe Token: SeRestorePrivilege 1780 wmic.exe Token: SeShutdownPrivilege 1780 wmic.exe Token: SeDebugPrivilege 1780 wmic.exe Token: SeSystemEnvironmentPrivilege 1780 wmic.exe Token: SeRemoteShutdownPrivilege 1780 wmic.exe Token: SeUndockPrivilege 1780 wmic.exe Token: SeManageVolumePrivilege 1780 wmic.exe Token: 33 1780 wmic.exe Token: 34 1780 wmic.exe Token: 35 1780 wmic.exe Token: SeIncreaseQuotaPrivilege 1780 wmic.exe Token: SeSecurityPrivilege 1780 wmic.exe Token: SeTakeOwnershipPrivilege 1780 wmic.exe Token: SeLoadDriverPrivilege 1780 wmic.exe Token: SeSystemProfilePrivilege 1780 wmic.exe Token: SeSystemtimePrivilege 1780 wmic.exe Token: SeProfSingleProcessPrivilege 1780 wmic.exe Token: SeIncBasePriorityPrivilege 1780 wmic.exe Token: SeCreatePagefilePrivilege 1780 wmic.exe Token: SeBackupPrivilege 1780 wmic.exe Token: SeRestorePrivilege 1780 wmic.exe Token: SeShutdownPrivilege 1780 wmic.exe Token: SeDebugPrivilege 1780 wmic.exe Token: SeSystemEnvironmentPrivilege 1780 wmic.exe Token: SeRemoteShutdownPrivilege 1780 wmic.exe Token: SeUndockPrivilege 1780 wmic.exe Token: SeManageVolumePrivilege 1780 wmic.exe Token: 33 1780 wmic.exe Token: 34 1780 wmic.exe Token: 35 1780 wmic.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exedescription pid process target process PID 320 wrote to memory of 1780 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe wmic.exe PID 320 wrote to memory of 1780 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe wmic.exe PID 320 wrote to memory of 1780 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe wmic.exe PID 320 wrote to memory of 1780 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe wmic.exe PID 320 wrote to memory of 1764 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe vssadmin.exe PID 320 wrote to memory of 1764 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe vssadmin.exe PID 320 wrote to memory of 1764 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe vssadmin.exe PID 320 wrote to memory of 1764 320 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe"C:\Users\Admin\AppData\Local\Temp\63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059.sample.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken