Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en -
submitted
08-09-2021 23:35
Static task
static1
Behavioral task
behavioral1
Sample
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe
Resource
win10-en
General
-
Target
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe
-
Size
143KB
-
MD5
a3749c66f65d247d8a6fae1be26d3ef9
-
SHA1
c394464bba56e62ddfe2c9073932fb656fb78b6c
-
SHA256
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c
-
SHA512
65bc1dba7e4de098e6b27b13b1e0723f703f645e4a4c6e53b7b03ec096a70d48ec2aca7e8bcd911ced61bab35e95983510604421ef35a593278414bfbb1cb01c
Malware Config
Extracted
C:\2c194iz695-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3EA697EA12EEE7FB
http://decryptor.top/3EA697EA12EEE7FB
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process File renamed C:\Users\Admin\Pictures\CompleteUndo.tiff => \??\c:\users\admin\pictures\CompleteUndo.tiff.2c194iz695 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File renamed C:\Users\Admin\Pictures\ResizeBackup.tiff => \??\c:\users\admin\pictures\ResizeBackup.tiff.2c194iz695 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File renamed C:\Users\Admin\Pictures\RepairWait.tiff => \??\c:\users\admin\pictures\RepairWait.tiff.2c194iz695 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File renamed C:\Users\Admin\Pictures\UnblockNew.tiff => \??\c:\users\admin\pictures\UnblockNew.tiff.2c194iz695 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\users\admin\pictures\CompleteUndo.tiff d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\users\admin\pictures\RepairWait.tiff d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\users\admin\pictures\ResizeBackup.tiff d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\users\admin\pictures\UnblockNew.tiff d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process File opened (read-only) \??\R: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\U: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\W: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\O: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\K: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\L: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\M: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\N: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\Q: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\D: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\B: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\G: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\I: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\J: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\S: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\T: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\Y: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\Z: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\A: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\F: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\H: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\P: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\V: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\X: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened (read-only) \??\E: d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1m02u.bmp" d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Drops file in Program Files directory 22 IoCs
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process File opened for modification \??\c:\program files\AddRead.pub d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\DenyMeasure.dotm d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ImportOpen.tif d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\NewLock.xlsb d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\UnregisterTrace.aifc d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File created \??\c:\program files\2c194iz695-readme.txt d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File created \??\c:\program files\d60dff40.lock d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File created \??\c:\program files (x86)\d60dff40.lock d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\SetCompare.jpg d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\TraceApprove.css d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File created \??\c:\program files (x86)\2c194iz695-readme.txt d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\EditUnprotect.rmi d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\FormatUnprotect.TS d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ShowLock.3gp d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\UseClear.mpeg2 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\RemoveNew.3gpp d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\AssertConvertFrom.vdx d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ClearInvoke.vsdx d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ClearResolve.xps d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\CloseInvoke.asf d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\CompleteExit.vbs d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification \??\c:\program files\ConvertFromPush.wmv d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Drops file in Windows directory 64 IoCs
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.15063.0_de-de_2f0789d5a19c2218.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_11ae3d61e1691e19_kmddsp.tsp.mui_80ddeedb d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_10.0.15063.0_none_03cb89fc0724bf2c.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.15063.0_none_58d42528ff7de282.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_pt-pt_d6f50d621285b042.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_eb8784774de6a9ad_iscsiwmiv2.dll_daf801c2 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_sv-se_0bb59a7154ba1188_comctl32.dll.mui_0da4e682 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_c579e007e6b0d693_mprdim.dll.mui_11b5ef08 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_de-de_d639ca20f92d9b45_userdeviceregistration.dll.mui_22ab8f29 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_lv-lv_72e9ed34808e8431_msimsg.dll.mui_72e8994f d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.15063.0_none_e819281ea9bc03bf_axinstui.exe_eba3b15b d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_ega80852.fon_608992fb d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_pt-br_5b48cea4e14dc672.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_en-us_269998480c8c0b86.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-c..temminpnp.resources_31bf3856ad364e35_10.0.15063.0_en-us_030818d8b79b4c05_umpnpmgr.dll.mui_d66aed17 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_a9e168871c09e689.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.15063.0_none_8f74af7c219a26c7_smss.exe_d7209c3a d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_10.0.15063.0_none_e8fc1bcb973bd8b8_afd.sys_084af4a8 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.15063.0_none_d8c07703ded57c9e.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_cs-cz_2af083c33a0dd82e_comctl32.dll.mui_0da4e682 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.15063.0_en-us_87ac933f1cd28fdb_winload.efi.mui_35ee487d d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_85775.fon_f144fe91 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_de-de_29579edbbad6dd55_gpsvc.dll.mui_0c160ac2 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_10.0.15063.0_en-us_ff9ea33ba51dcc3d_appinfo.dll.mui_cfd93456 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_42611468c1164d2f_apphelp.dll.mui_59096153 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.15063.0_none_e71b894d9eb700bd.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-atl_31bf3856ad364e35_10.0.15063.0_none_60157d7bda23b519_atl.dll_0c7220db d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_zh-cn_33fd71df8d841cd9_bootmgr.exe.mui_c434701f d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-branding-engine_31bf3856ad364e35_10.0.15063.0_none_9e5f1652e5d5551c.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_s8514fix.fon_2d5cdf27 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.15063.0_none_a4d1be7a8f1a4216_kernel32.dll_ef9eca7e d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-m..ntmanager.resources_31bf3856ad364e35_10.0.15063.0_en-us_4e210a027815c2f3.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.15063.0_none_20edd7ef9e21d8cb.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.15063.0_de-de_14888a056ad026a8.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_06c8a8054dc02d3d_wudfhost.exe.mui_1fc689ff d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_he-il_0d3c12cce5f4147b_comctl32.dll.mui_0da4e682 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_2b6c8e7c08218e26.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_2856dfb73a0bd794_dnsapi.dll.mui_97465f8a d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directcomposition_31bf3856ad364e35_10.0.15063.0_none_ae887af47a91ddcd.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_vgafixe.fon_dea8b251 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_vga861.fon_0763ad86 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_74d4adceeb3499bf.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_et-ee_ce022fe5aa8f10fb_bootmgr.exe.mui_c434701f d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-dui70_31bf3856ad364e35_10.0.15063.0_none_0ca9ed867e8c0f29_dui70.dll_5f097b0b d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.i..utomation.proxystub_6595b64144ccf1df_1.0.15063.0_none_021b03263abb1b35_sxsoaps.tlb_7db2712b d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..opactivitymoderator_31bf3856ad364e35_10.0.15063.0_none_1afe75a2a51438fe.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directory-services-sam_31bf3856ad364e35_10.0.15063.0_none_c3023296d9c347cc_samsrv.dll_b7a400ca d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.15063.0_none_f30c8be8f4be0687.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_10.0.15063.0_none_09f516f85c9523f2.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_de-de_beb9e9f73d4f9ded_iscsicli.exe.mui_64c0a23c d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.15063.0_de-de_b5e75281cfb7be19_mpsdrv.sys.mui_b2aea3b6 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_015afb5db18ed1e5_mpsdrv.sys.mui_b2aea3b6 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.15063.0_none_c3056a4fc9207495_d2d1.dll_ef77984b d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-msauditevtlog_31bf3856ad364e35_10.0.15063.0_none_e2aafdd9e59cf01f_msaudite.dll_9eacd00a d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_fr-fr_10c9a20214013c93.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_de-de_e6faf81d32dd9c12.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_10.0.15063.0_de-de_7a7bbe6b4471ea21.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.15063.0_en-us_d7f85fce907a2ddd_wudfplatform.dll.mui_d815d31a d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_85f1255.fon_77ccac39 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_156aa3a91701e260.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_0bafa5afe5ef93e0.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_1164be3dcef90997.manifest d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msasn1_31bf3856ad364e35_10.0.15063.0_none_d86def03de301c93_msasn1.dll_e56dbc57 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ncrypt-dll_31bf3856ad364e35_10.0.15063.0_none_6ef22ecb2a6ac80b_ncrypt.dll_0f36c580 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1252 vssadmin.exe -
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734\Blob = 030000000100000014000000247106a405b288a46e70a0262717162d0903e734140000000100000014000000b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea0400000001000000100000001a9a69a81f6da92d87f7694e16d8b8790f00000001000000300000009e9609372f45b5101548e8af9a20e0dbf5932dea9b9af86759c2029bc3b53e306e6491f6b15bf00b1e2dee3bb8d43d2219000000010000001000000043e6fa09a3b9d0de6fbe3aacd184c8fd5c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000ed050000308205e9308203d1a003020102021005e4dc3b9438ab3b8597cba6a19850e3300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3134303931323030303030305a170d3234303931313233353935395a305f310b3009060355040613024652310e300c060355040813055061726973310e300c060355040713055061726973310e300c060355040a130547616e64693120301e0603550403131747616e6469205374616e646172642053534c204341203230820122300d06092a864886f70d01010105000382010f003082010a028201010094042da6799574ffd5003cf5aed894b1297cc08f0b0b89b98283976e3728f5a21acfd2920b9ba8d387947384109fdc35cbc22d92ac21b9cb3bfc40c1c18321f0bff8f69cfa9c8210c0d08e4ee50d4cb0915c90b4a4405116dae484122d055ca11f17192451aa7aeae1071b868d0172f2e7d48323399ee0e14c1f6b22a3b41066b0ed8296d76e6ab4f23fb542fcdd8ab5abba2d1d3a759b31dc3e9dac5bd3410d6cb01bf53af579ea21a2f8f433524b242d1ea499b16d48bcb812fe72707cf7fb0275f48dded6dac0a0321a52df386b2e45383f3f049600fda1f4a2bbd517d6277c1b5859955e8a12fd9cab813e52284851856bf391b2863f29b56e0362eed6050203010001a382017530820171301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e04160414b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b2310102021a3008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201005867fd72b26ad77c6196197ed94346d1267dc853fa66b06b2da7d3aa56f73a88d03b72c950fdf759b2aa68f58c7303bb956517ce2f1cdd9813a291c9eea1406e3c98d65cf3b2223c2dee1ba4e1de202416f28c1173913af6face240287ca93ecb4b6c81617c572fc2740f613fe93a69d51ef3c2bd877579b8c653a352536b7b58a636f072793b1608d80db96d47a8f2dab1c88c96e7ed6651faf5dca163f2846dca035e5f9e9e5d596880c4fc6b77767488427b61fb068dbacbf77b090b8a2c91c325d02ba2543814247bbd8e18f0c0c465fee46336b031482d37ecd8faf90d68e247d4042b46a6a17c69597e1f238cda7edb4274093df72a9b8c666633738642230a23bf1b9c87bc8fb293aab1a72d206124ef682d4236f3ec393e5d8b6c0dedc2316d61330b7a09a0e2c5506007001cfea391d80db88f7a520b85bfd3126698f2d0a61833a47a613542c1ee3ed44cabc6a1f280e51d9de0e9f75cd0e0395caf9c5a92a2dfe41a4a147ae0dc2f93966334a5be18428596c7d941776e44582ad7020fdd26f63a8d7faa033fa37cbf7b2659eda506f3fe4a7f38e5d58329770232ee7fdc4159b9c278f32ed17ad58813129111a9bd4fc6c9528c74e0507a6fd1dbc19e2e8b7b9118a2d701252858d8c334a0ffc9992e06370daa594476307e758c7315f053d3655fe83b2e8a6add7e9e6027488745cda34db90d26d510a23d623 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exepid process 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2824 vssvc.exe Token: SeRestorePrivilege 2824 vssvc.exe Token: SeAuditPrivilege 2824 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.execmd.exedescription pid process target process PID 3332 wrote to memory of 3860 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe cmd.exe PID 3332 wrote to memory of 3860 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe cmd.exe PID 3332 wrote to memory of 3860 3332 d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe cmd.exe PID 3860 wrote to memory of 1252 3860 cmd.exe vssadmin.exe PID 3860 wrote to memory of 1252 3860 cmd.exe vssadmin.exe PID 3860 wrote to memory of 1252 3860 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe"C:\Users\Admin\AppData\Local\Temp\d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1252-121-0x0000000000000000-mapping.dmp
-
memory/3332-115-0x0000000000600000-0x00000000006AE000-memory.dmpFilesize
696KB
-
memory/3332-116-0x00000000006D0000-0x000000000081A000-memory.dmpFilesize
1.3MB
-
memory/3332-117-0x00000000006D0000-0x000000000081A000-memory.dmpFilesize
1.3MB
-
memory/3332-118-0x00000000006D0000-0x000000000081A000-memory.dmpFilesize
1.3MB
-
memory/3332-119-0x00000000006D0000-0x000000000081A000-memory.dmpFilesize
1.3MB
-
memory/3860-120-0x0000000000000000-mapping.dmp