Analysis
-
max time kernel
116s -
max time network
53s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
08-08-2021 17:01
Static task
static1
Behavioral task
behavioral1
Sample
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe
Resource
win10v20210410
General
-
Target
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe
-
Size
669KB
-
MD5
6da9c76a6e319c17f1d39e0ae2eaf2af
-
SHA1
d8743d22c816de1b1807a64d2bdde6baea838cd0
-
SHA256
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078
-
SHA512
70c3e123f887556ac42bb58d730b59d8d2df1cca4d3e895f79fb6cfa5c1a63a64d46bc6fdc23c711be7b966aaf80d2fb7e83f52bdf4c096cbc946f5a6c976db0
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\svhost.exe family_medusalocker C:\Users\Admin\AppData\Roaming\svhost.exe family_medusalocker -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 1064 svhost.exe -
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exedescription ioc process File renamed C:\Users\Admin\Pictures\ExpandSuspend.crw => C:\Users\Admin\Pictures\ExpandSuspend.crw.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\FindDebug.crw => C:\Users\Admin\Pictures\FindDebug.crw.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened for modification C:\Users\Admin\Pictures\SubmitSuspend.tiff 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\UseFind.raw => C:\Users\Admin\Pictures\UseFind.raw.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\AssertPush.png => C:\Users\Admin\Pictures\AssertPush.png.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\BackupEdit.tiff => C:\Users\Admin\Pictures\BackupEdit.tiff.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\CheckpointRestart.crw => C:\Users\Admin\Pictures\CheckpointRestart.crw.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\CompleteRemove.tif => C:\Users\Admin\Pictures\CompleteRemove.tif.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\DisableSuspend.tif => C:\Users\Admin\Pictures\DisableSuspend.tif.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\InstallStop.crw => C:\Users\Admin\Pictures\InstallStop.crw.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\SubmitSuspend.tiff => C:\Users\Admin\Pictures\SubmitSuspend.tiff.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened for modification C:\Users\Admin\Pictures\BackupEdit.tiff 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\CloseUnblock.raw => C:\Users\Admin\Pictures\CloseUnblock.raw.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\EnterRevoke.crw => C:\Users\Admin\Pictures\EnterRevoke.crw.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File renamed C:\Users\Admin\Pictures\StartUse.tif => C:\Users\Admin\Pictures\StartUse.tif.L54 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exedescription ioc process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exedescription ioc process File opened (read-only) \??\M: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\S: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\B: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\L: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\I: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\Z: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\A: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\F: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\J: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\K: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\N: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\O: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\U: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\W: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\G: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\H: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\Q: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\R: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\T: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\V: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\X: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\Y: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\E: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe File opened (read-only) \??\P: 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 1344 vssadmin.exe 1084 vssadmin.exe 1268 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exepid process 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
vssvc.exewmic.exewmic.exewmic.exedescription pid process Token: SeBackupPrivilege 1704 vssvc.exe Token: SeRestorePrivilege 1704 vssvc.exe Token: SeAuditPrivilege 1704 vssvc.exe Token: SeIncreaseQuotaPrivilege 1732 wmic.exe Token: SeSecurityPrivilege 1732 wmic.exe Token: SeTakeOwnershipPrivilege 1732 wmic.exe Token: SeLoadDriverPrivilege 1732 wmic.exe Token: SeSystemProfilePrivilege 1732 wmic.exe Token: SeSystemtimePrivilege 1732 wmic.exe Token: SeProfSingleProcessPrivilege 1732 wmic.exe Token: SeIncBasePriorityPrivilege 1732 wmic.exe Token: SeCreatePagefilePrivilege 1732 wmic.exe Token: SeBackupPrivilege 1732 wmic.exe Token: SeRestorePrivilege 1732 wmic.exe Token: SeShutdownPrivilege 1732 wmic.exe Token: SeDebugPrivilege 1732 wmic.exe Token: SeSystemEnvironmentPrivilege 1732 wmic.exe Token: SeRemoteShutdownPrivilege 1732 wmic.exe Token: SeUndockPrivilege 1732 wmic.exe Token: SeManageVolumePrivilege 1732 wmic.exe Token: 33 1732 wmic.exe Token: 34 1732 wmic.exe Token: 35 1732 wmic.exe Token: SeIncreaseQuotaPrivilege 1880 wmic.exe Token: SeSecurityPrivilege 1880 wmic.exe Token: SeTakeOwnershipPrivilege 1880 wmic.exe Token: SeLoadDriverPrivilege 1880 wmic.exe Token: SeSystemProfilePrivilege 1880 wmic.exe Token: SeSystemtimePrivilege 1880 wmic.exe Token: SeProfSingleProcessPrivilege 1880 wmic.exe Token: SeIncBasePriorityPrivilege 1880 wmic.exe Token: SeCreatePagefilePrivilege 1880 wmic.exe Token: SeBackupPrivilege 1880 wmic.exe Token: SeRestorePrivilege 1880 wmic.exe Token: SeShutdownPrivilege 1880 wmic.exe Token: SeDebugPrivilege 1880 wmic.exe Token: SeSystemEnvironmentPrivilege 1880 wmic.exe Token: SeRemoteShutdownPrivilege 1880 wmic.exe Token: SeUndockPrivilege 1880 wmic.exe Token: SeManageVolumePrivilege 1880 wmic.exe Token: 33 1880 wmic.exe Token: 34 1880 wmic.exe Token: 35 1880 wmic.exe Token: SeIncreaseQuotaPrivilege 1144 wmic.exe Token: SeSecurityPrivilege 1144 wmic.exe Token: SeTakeOwnershipPrivilege 1144 wmic.exe Token: SeLoadDriverPrivilege 1144 wmic.exe Token: SeSystemProfilePrivilege 1144 wmic.exe Token: SeSystemtimePrivilege 1144 wmic.exe Token: SeProfSingleProcessPrivilege 1144 wmic.exe Token: SeIncBasePriorityPrivilege 1144 wmic.exe Token: SeCreatePagefilePrivilege 1144 wmic.exe Token: SeBackupPrivilege 1144 wmic.exe Token: SeRestorePrivilege 1144 wmic.exe Token: SeShutdownPrivilege 1144 wmic.exe Token: SeDebugPrivilege 1144 wmic.exe Token: SeSystemEnvironmentPrivilege 1144 wmic.exe Token: SeRemoteShutdownPrivilege 1144 wmic.exe Token: SeUndockPrivilege 1144 wmic.exe Token: SeManageVolumePrivilege 1144 wmic.exe Token: 33 1144 wmic.exe Token: 34 1144 wmic.exe Token: 35 1144 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exetaskeng.exedescription pid process target process PID 1100 wrote to memory of 1344 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1344 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1344 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1344 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1732 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1100 wrote to memory of 1732 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1100 wrote to memory of 1732 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1100 wrote to memory of 1732 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1100 wrote to memory of 1084 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1084 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1084 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1084 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1880 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1100 wrote to memory of 1880 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1100 wrote to memory of 1880 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1100 wrote to memory of 1880 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1100 wrote to memory of 1268 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1268 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1268 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1268 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe vssadmin.exe PID 1100 wrote to memory of 1144 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1100 wrote to memory of 1144 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1100 wrote to memory of 1144 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1100 wrote to memory of 1144 1100 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe wmic.exe PID 1400 wrote to memory of 1064 1400 taskeng.exe svhost.exe PID 1400 wrote to memory of 1064 1400 taskeng.exe svhost.exe PID 1400 wrote to memory of 1064 1400 taskeng.exe svhost.exe PID 1400 wrote to memory of 1064 1400 taskeng.exe svhost.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe"C:\Users\Admin\AppData\Local\Temp\461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078.bin.exe"1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {B35D30AF-A1F2-4DDC-A049-CD41CDAB0E2B} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\svhost.exeMD5
6da9c76a6e319c17f1d39e0ae2eaf2af
SHA1d8743d22c816de1b1807a64d2bdde6baea838cd0
SHA256461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078
SHA51270c3e123f887556ac42bb58d730b59d8d2df1cca4d3e895f79fb6cfa5c1a63a64d46bc6fdc23c711be7b966aaf80d2fb7e83f52bdf4c096cbc946f5a6c976db0
-
C:\Users\Admin\AppData\Roaming\svhost.exeMD5
6da9c76a6e319c17f1d39e0ae2eaf2af
SHA1d8743d22c816de1b1807a64d2bdde6baea838cd0
SHA256461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078
SHA51270c3e123f887556ac42bb58d730b59d8d2df1cca4d3e895f79fb6cfa5c1a63a64d46bc6fdc23c711be7b966aaf80d2fb7e83f52bdf4c096cbc946f5a6c976db0
-
memory/1064-68-0x0000000000000000-mapping.dmp
-
memory/1084-63-0x0000000000000000-mapping.dmp
-
memory/1100-60-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB
-
memory/1144-66-0x0000000000000000-mapping.dmp
-
memory/1268-65-0x0000000000000000-mapping.dmp
-
memory/1344-61-0x0000000000000000-mapping.dmp
-
memory/1732-62-0x0000000000000000-mapping.dmp
-
memory/1880-64-0x0000000000000000-mapping.dmp