Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en -
submitted
07-09-2021 19:43
Static task
static1
Behavioral task
behavioral1
Sample
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe
Resource
win10-en
General
-
Target
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe
-
Size
143KB
-
MD5
a3749c66f65d247d8a6fae1be26d3ef9
-
SHA1
c394464bba56e62ddfe2c9073932fb656fb78b6c
-
SHA256
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c
-
SHA512
65bc1dba7e4de098e6b27b13b1e0723f703f645e4a4c6e53b7b03ec096a70d48ec2aca7e8bcd911ced61bab35e95983510604421ef35a593278414bfbb1cb01c
Malware Config
Extracted
C:\1zs87vun9-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/52AD0AA0ACAD8675
http://decryptor.top/52AD0AA0ACAD8675
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process File renamed C:\Users\Admin\Pictures\OpenResize.raw => \??\c:\users\admin\pictures\OpenResize.raw.1zs87vun9 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File renamed C:\Users\Admin\Pictures\RestartCopy.crw => \??\c:\users\admin\pictures\RestartCopy.crw.1zs87vun9 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File renamed C:\Users\Admin\Pictures\WatchEdit.tiff => \??\c:\users\admin\pictures\WatchEdit.tiff.1zs87vun9 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File renamed C:\Users\Admin\Pictures\WaitRename.raw => \??\c:\users\admin\pictures\WaitRename.raw.1zs87vun9 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File renamed C:\Users\Admin\Pictures\UseDebug.tiff => \??\c:\users\admin\pictures\UseDebug.tiff.1zs87vun9 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\users\admin\pictures\UseDebug.tiff d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\users\admin\pictures\WatchEdit.tiff d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File renamed C:\Users\Admin\Pictures\DisconnectRead.crw => \??\c:\users\admin\pictures\DisconnectRead.crw.1zs87vun9 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process File opened (read-only) \??\B: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\F: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\G: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\H: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\I: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\N: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\Q: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\S: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\V: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\Y: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\K: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\M: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\X: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\Z: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\D: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\A: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\E: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\J: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\L: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\O: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\P: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\R: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\T: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\U: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\W: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\987nq826n9b36.bmp" d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Drops file in Program Files directory 35 IoCs
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process File created \??\c:\program files (x86)\d60dff40.lock d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ConvertFromUpdate.au3 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\RestartInitialize.wma d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ShowPop.bmp d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\SkipEnter.cfg d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ExitInvoke.i64 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ResizeInvoke.xml d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ConvertTest.TTS d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\MoveOptimize.ppsx d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\OutGroup.wm d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\RestoreInstall.rtf d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\SelectLock.mpe d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File created \??\c:\program files (x86)\1zs87vun9-readme.txt d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ExportJoin.shtml d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ImportMeasure.shtml d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\UnprotectConvertTo.jpg d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\UnregisterGrant.rtf d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File created \??\c:\program files\d60dff40.lock d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\JoinInstall.pub d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\MountReset.asx d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\MoveSkip.crw d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\PushUnpublish.cfg d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\SetRequest.asx d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\SubmitMove.xlsm d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\TraceRestore.clr d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File created \??\c:\program files\1zs87vun9-readme.txt d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\GrantSplit.midi d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\GroupUse.xls d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ReceiveSelect.bmp d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ReceiveStep.tiff d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\SyncSwitch.TS d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\CompareInitialize.ppsm d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\PushSwitch.ppsm d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ResumeCompare.midi d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\SyncSend.wmv d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Drops file in Windows directory 64 IoCs
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_en-us_d4770771a66242c7_bootmgr.exe.mui_c434701f d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_hu-hu_8b4d2222606ec8fc.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_10.0.15063.0_none_332a24478e119029.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_uk-ua_b9f4fd2d4fd6d616.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-cryptdll-dll_31bf3856ad364e35_10.0.15063.0_none_16b25f1fe6942a8d.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_th-th_e25bed23d101e5a7.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-sens-service.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_552605701819ef98.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_8549b236009bfe6f.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_nl-nl_8d82f8d02f6a3ece.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_fr-fr_10c9a20214013c93.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_1164be3dcef90997_axinstui.exe.mui_aea34130 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-time-service_31bf3856ad364e35_10.0.15063.0_none_99bb3ce8a6195e97.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..sition-coreservices_31bf3856ad364e35_10.0.15063.0_none_43a8144aec22156f_wiaservc.dll_08fa1e78 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_eb8784774de6a9ad_iscsiwmi.dll_272dd9e6 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_0118bd0b66fae87a_gpapi.dll.mui_ef0a9748 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..gon-tools.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_c9433cadbd7bea51.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_10.0.15063.0_en-us_dc0c6ac43ce52ba2.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_uk-ua_83b5c737a2b4f712.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_en-us_96a997d1296ad733_mprdim.dll.mui_11b5ef08 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmpdui_31bf3856ad364e35_10.0.15063.0_none_783a13846f125051.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_03474fa863a84227.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_cga40850.fon_2c83a12b d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_hu-hu_8b4d2222606ec8fc_comctl32.dll.mui_0da4e682 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_lt-lt_4a7c585e4840d4da_bootmgr.exe.mui_c434701f d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ro-ro_9eee956fea195b3b_msimsg.dll.mui_72e8994f d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.15063.0_none_b1c695092fbfd7f6_wmiaprpl.dll_5d18a476 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.15063.0_none_f39dd1f571ccd621_memtest.exe_01d80391 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_hu-hu_be6a5a9c7dbb19ea.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sv-se_8675d120d143f7db_comctl32.dll.mui_0da4e682 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-provsvc.resources_31bf3856ad364e35_10.0.15063.0_de-de_db9cb62863cfdc98.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_5cfc9994b735544f.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_hu-hu_583a2249f8610baf.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ntosext_31bf3856ad364e35_10.0.15063.0_none_e5070f42682b7231_ntosext.sys_e9e096c6 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_sv-se_3d51cb70dfbd2866_msimsg.dll.mui_72e8994f d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.15063.0_none_5522510b24d3f7d4_polstore.mof_6cd3e826 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_e5db677400777894.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_zh-tw_35d482afdcce483a.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_10.0.15063.0_none_3d7ece99c2725224_schannel.dll_7364eaa8 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_lt-lt_175f1fe42af483ec_comctl32.dll.mui_0da4e682 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directmanipulation_31bf3856ad364e35_10.0.15063.0_none_5e2ff11ada5cd7a4.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lsa.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_c68bf5c18cb00fef_lsasrv.dll.mui_d47f7e1c d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-win32kbase.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_60a2bc9e6ffb13be.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.15063.0_none_e71b894d9eb700bd_wshtcpip.dll_7ee2ca52 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-errorreportingkernel_31bf3856ad364e35_10.0.15063.0_none_5fff332cae3dfdb7_werkernel.sys_bd06c194 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-webauthn.resources_31bf3856ad364e35_10.0.15063.0_en-us_324d9d52150f7e18_webauthn.dll.mui_acc69b8d d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_de-de_5be8d57b685c3b22_certprop.dll.mui_602eaab4 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.15063.0_none_dcc6defb6a563ec2_wship6.dll_db4127c3 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sl-si_40fad639bb52c987.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-etw-ese_31bf3856ad364e35_10.0.15063.0_none_eac35629f38bb48f_etweseproviderresources.dll_f21e8ea7 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-netio-infrastructure_31bf3856ad364e35_10.0.15063.0_none_7203f061227d02c2.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_qps-ploc_9312ff22e9ad2ec6.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_1a52bffe303ba629.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.15063.0_none_69f7bd111ce467b4.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_cga40woa.fon_3e9e1495 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_ega80850.fon_6087927d d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_eb8784774de6a9ad_iscsicli.exe_20e14d4f d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-time-service.resources_31bf3856ad364e35_10.0.15063.0_de-de_bb28d012de0e4fc3.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_dc9d1f26de15ab15_gpsvc.dll.mui_0c160ac2 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_en-us_7f2aa019e80ba70a_userdeviceregistration.ngc.dll.mui_d2c6ca95 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.15063.0_none_e94927a33d6c1426_memtest.efi_01d7fdbb d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-version_31bf3856ad364e35_10.0.15063.0_none_c9f38ce4d1570426_version.dll_406ddf44 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..e-ws2ifsl.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_699975e6c4d41a9e_ws2ifsl.sys.mui_b672c7b4 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_en-us_59ac98207499c8d3_comctl32.dll.mui_0da4e682 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_bg-bg_3839d6513809d2fd.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3736 vssadmin.exe -
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734\Blob = 030000000100000014000000247106a405b288a46e70a0262717162d0903e734140000000100000014000000b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea0400000001000000100000001a9a69a81f6da92d87f7694e16d8b8790f00000001000000300000009e9609372f45b5101548e8af9a20e0dbf5932dea9b9af86759c2029bc3b53e306e6491f6b15bf00b1e2dee3bb8d43d2219000000010000001000000043e6fa09a3b9d0de6fbe3aacd184c8fd5c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000ed050000308205e9308203d1a003020102021005e4dc3b9438ab3b8597cba6a19850e3300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3134303931323030303030305a170d3234303931313233353935395a305f310b3009060355040613024652310e300c060355040813055061726973310e300c060355040713055061726973310e300c060355040a130547616e64693120301e0603550403131747616e6469205374616e646172642053534c204341203230820122300d06092a864886f70d01010105000382010f003082010a028201010094042da6799574ffd5003cf5aed894b1297cc08f0b0b89b98283976e3728f5a21acfd2920b9ba8d387947384109fdc35cbc22d92ac21b9cb3bfc40c1c18321f0bff8f69cfa9c8210c0d08e4ee50d4cb0915c90b4a4405116dae484122d055ca11f17192451aa7aeae1071b868d0172f2e7d48323399ee0e14c1f6b22a3b41066b0ed8296d76e6ab4f23fb542fcdd8ab5abba2d1d3a759b31dc3e9dac5bd3410d6cb01bf53af579ea21a2f8f433524b242d1ea499b16d48bcb812fe72707cf7fb0275f48dded6dac0a0321a52df386b2e45383f3f049600fda1f4a2bbd517d6277c1b5859955e8a12fd9cab813e52284851856bf391b2863f29b56e0362eed6050203010001a382017530820171301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e04160414b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b2310102021a3008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201005867fd72b26ad77c6196197ed94346d1267dc853fa66b06b2da7d3aa56f73a88d03b72c950fdf759b2aa68f58c7303bb956517ce2f1cdd9813a291c9eea1406e3c98d65cf3b2223c2dee1ba4e1de202416f28c1173913af6face240287ca93ecb4b6c81617c572fc2740f613fe93a69d51ef3c2bd877579b8c653a352536b7b58a636f072793b1608d80db96d47a8f2dab1c88c96e7ed6651faf5dca163f2846dca035e5f9e9e5d596880c4fc6b77767488427b61fb068dbacbf77b090b8a2c91c325d02ba2543814247bbd8e18f0c0c465fee46336b031482d37ecd8faf90d68e247d4042b46a6a17c69597e1f238cda7edb4274093df72a9b8c666633738642230a23bf1b9c87bc8fb293aab1a72d206124ef682d4236f3ec393e5d8b6c0dedc2316d61330b7a09a0e2c5506007001cfea391d80db88f7a520b85bfd3126698f2d0a61833a47a613542c1ee3ed44cabc6a1f280e51d9de0e9f75cd0e0395caf9c5a92a2dfe41a4a147ae0dc2f93966334a5be18428596c7d941776e44582ad7020fdd26f63a8d7faa033fa37cbf7b2659eda506f3fe4a7f38e5d58329770232ee7fdc4159b9c278f32ed17ad58813129111a9bd4fc6c9528c74e0507a6fd1dbc19e2e8b7b9118a2d701252858d8c334a0ffc9992e06370daa594476307e758c7315f053d3655fe83b2e8a6add7e9e6027488745cda34db90d26d510a23d623 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exepid process 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1308 vssvc.exe Token: SeRestorePrivilege 1308 vssvc.exe Token: SeAuditPrivilege 1308 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.execmd.exedescription pid process target process PID 4020 wrote to memory of 2132 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe cmd.exe PID 4020 wrote to memory of 2132 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe cmd.exe PID 4020 wrote to memory of 2132 4020 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe cmd.exe PID 2132 wrote to memory of 3736 2132 cmd.exe vssadmin.exe PID 2132 wrote to memory of 3736 2132 cmd.exe vssadmin.exe PID 2132 wrote to memory of 3736 2132 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe"C:\Users\Admin\AppData\Local\Temp\d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2132-120-0x0000000000000000-mapping.dmp
-
memory/3736-121-0x0000000000000000-mapping.dmp
-
memory/4020-115-0x00000000004D0000-0x00000000004F3000-memory.dmpFilesize
140KB
-
memory/4020-117-0x0000000000510000-0x000000000065A000-memory.dmpFilesize
1.3MB
-
memory/4020-116-0x0000000000510000-0x000000000065A000-memory.dmpFilesize
1.3MB
-
memory/4020-118-0x0000000000510000-0x000000000065A000-memory.dmpFilesize
1.3MB
-
memory/4020-119-0x0000000000DA0000-0x0000000000DA6000-memory.dmpFilesize
24KB