Analysis
-
max time kernel
117s -
max time network
17s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
31/08/2021, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe
-
Size
669KB
-
MD5
908e3b6aab0126ef4efcdc8c4805abd7
-
SHA1
2a9ac8a2a940e537a12ab17720b95d93815849ce
-
SHA256
ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74
-
SHA512
5006de1927f645826e033621540bf40ef26b018dbb17a055d1d2a7bf1d55439e0394354a06cad1e3efc9bfa3606a237f62b63d7051abab34f04bfcdd65c36438
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
resource yara_rule behavioral1/files/0x00040000000130c8-67.dat family_medusalocker behavioral1/files/0x00040000000130c8-69.dat family_medusalocker -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 1612 svhost.exe -
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DisableSuspend.tif => C:\Users\Admin\Pictures\DisableSuspend.tif.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\BackupEdit.tiff => C:\Users\Admin\Pictures\BackupEdit.tiff.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\CloseUnblock.raw => C:\Users\Admin\Pictures\CloseUnblock.raw.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\FindDebug.crw => C:\Users\Admin\Pictures\FindDebug.crw.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened for modification C:\Users\Admin\Pictures\SubmitSuspend.tiff ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened for modification C:\Users\Admin\Pictures\BackupEdit.tiff ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\CheckpointRestart.crw => C:\Users\Admin\Pictures\CheckpointRestart.crw.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\EnterRevoke.crw => C:\Users\Admin\Pictures\EnterRevoke.crw.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\StartUse.tif => C:\Users\Admin\Pictures\StartUse.tif.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\SubmitSuspend.tiff => C:\Users\Admin\Pictures\SubmitSuspend.tiff.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\UseFind.raw => C:\Users\Admin\Pictures\UseFind.raw.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\AssertPush.png => C:\Users\Admin\Pictures\AssertPush.png.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\CompleteRemove.tif => C:\Users\Admin\Pictures\CompleteRemove.tif.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\ExpandSuspend.crw => C:\Users\Admin\Pictures\ExpandSuspend.crw.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File renamed C:\Users\Admin\Pictures\InstallStop.crw => C:\Users\Admin\Pictures\InstallStop.crw.ReadInstructions ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\A: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\G: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\K: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\L: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\M: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\N: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\S: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\B: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\J: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\T: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\V: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\Y: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\O: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\P: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\Q: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\R: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\E: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\F: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\H: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\I: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\U: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\X: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe File opened (read-only) \??\Z: ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 616 vssadmin.exe 836 vssadmin.exe 1644 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 1764 vssvc.exe Token: SeRestorePrivilege 1764 vssvc.exe Token: SeAuditPrivilege 1764 vssvc.exe Token: SeIncreaseQuotaPrivilege 1684 wmic.exe Token: SeSecurityPrivilege 1684 wmic.exe Token: SeTakeOwnershipPrivilege 1684 wmic.exe Token: SeLoadDriverPrivilege 1684 wmic.exe Token: SeSystemProfilePrivilege 1684 wmic.exe Token: SeSystemtimePrivilege 1684 wmic.exe Token: SeProfSingleProcessPrivilege 1684 wmic.exe Token: SeIncBasePriorityPrivilege 1684 wmic.exe Token: SeCreatePagefilePrivilege 1684 wmic.exe Token: SeBackupPrivilege 1684 wmic.exe Token: SeRestorePrivilege 1684 wmic.exe Token: SeShutdownPrivilege 1684 wmic.exe Token: SeDebugPrivilege 1684 wmic.exe Token: SeSystemEnvironmentPrivilege 1684 wmic.exe Token: SeRemoteShutdownPrivilege 1684 wmic.exe Token: SeUndockPrivilege 1684 wmic.exe Token: SeManageVolumePrivilege 1684 wmic.exe Token: 33 1684 wmic.exe Token: 34 1684 wmic.exe Token: 35 1684 wmic.exe Token: SeIncreaseQuotaPrivilege 520 wmic.exe Token: SeSecurityPrivilege 520 wmic.exe Token: SeTakeOwnershipPrivilege 520 wmic.exe Token: SeLoadDriverPrivilege 520 wmic.exe Token: SeSystemProfilePrivilege 520 wmic.exe Token: SeSystemtimePrivilege 520 wmic.exe Token: SeProfSingleProcessPrivilege 520 wmic.exe Token: SeIncBasePriorityPrivilege 520 wmic.exe Token: SeCreatePagefilePrivilege 520 wmic.exe Token: SeBackupPrivilege 520 wmic.exe Token: SeRestorePrivilege 520 wmic.exe Token: SeShutdownPrivilege 520 wmic.exe Token: SeDebugPrivilege 520 wmic.exe Token: SeSystemEnvironmentPrivilege 520 wmic.exe Token: SeRemoteShutdownPrivilege 520 wmic.exe Token: SeUndockPrivilege 520 wmic.exe Token: SeManageVolumePrivilege 520 wmic.exe Token: 33 520 wmic.exe Token: 34 520 wmic.exe Token: 35 520 wmic.exe Token: SeIncreaseQuotaPrivilege 396 wmic.exe Token: SeSecurityPrivilege 396 wmic.exe Token: SeTakeOwnershipPrivilege 396 wmic.exe Token: SeLoadDriverPrivilege 396 wmic.exe Token: SeSystemProfilePrivilege 396 wmic.exe Token: SeSystemtimePrivilege 396 wmic.exe Token: SeProfSingleProcessPrivilege 396 wmic.exe Token: SeIncBasePriorityPrivilege 396 wmic.exe Token: SeCreatePagefilePrivilege 396 wmic.exe Token: SeBackupPrivilege 396 wmic.exe Token: SeRestorePrivilege 396 wmic.exe Token: SeShutdownPrivilege 396 wmic.exe Token: SeDebugPrivilege 396 wmic.exe Token: SeSystemEnvironmentPrivilege 396 wmic.exe Token: SeRemoteShutdownPrivilege 396 wmic.exe Token: SeUndockPrivilege 396 wmic.exe Token: SeManageVolumePrivilege 396 wmic.exe Token: 33 396 wmic.exe Token: 34 396 wmic.exe Token: 35 396 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1988 wrote to memory of 836 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 26 PID 1988 wrote to memory of 836 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 26 PID 1988 wrote to memory of 836 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 26 PID 1988 wrote to memory of 836 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 26 PID 1988 wrote to memory of 1684 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 29 PID 1988 wrote to memory of 1684 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 29 PID 1988 wrote to memory of 1684 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 29 PID 1988 wrote to memory of 1684 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 29 PID 1988 wrote to memory of 1644 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 33 PID 1988 wrote to memory of 1644 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 33 PID 1988 wrote to memory of 1644 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 33 PID 1988 wrote to memory of 1644 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 33 PID 1988 wrote to memory of 520 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 35 PID 1988 wrote to memory of 520 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 35 PID 1988 wrote to memory of 520 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 35 PID 1988 wrote to memory of 520 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 35 PID 1988 wrote to memory of 616 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 37 PID 1988 wrote to memory of 616 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 37 PID 1988 wrote to memory of 616 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 37 PID 1988 wrote to memory of 616 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 37 PID 1988 wrote to memory of 396 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 39 PID 1988 wrote to memory of 396 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 39 PID 1988 wrote to memory of 396 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 39 PID 1988 wrote to memory of 396 1988 ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe 39 PID 1672 wrote to memory of 1612 1672 taskeng.exe 45 PID 1672 wrote to memory of 1612 1672 taskeng.exe 45 PID 1672 wrote to memory of 1612 1672 taskeng.exe 45 PID 1672 wrote to memory of 1612 1672 taskeng.exe 45 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe"C:\Users\Admin\AppData\Local\Temp\ef1318ede7ab1a8e851f0e052630615daa5ad45002536b295763466d234b4e74.exe"1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1988 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:836
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1644
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:520
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:616
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
C:\Windows\system32\taskeng.exetaskeng.exe {DE6A9F91-276A-4797-A8C5-B887F6ED856B} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:1612
-