Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en -
submitted
10-09-2021 11:25
Static task
static1
Behavioral task
behavioral1
Sample
8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe
Resource
win10-en
General
-
Target
8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe
-
Size
164KB
-
MD5
f9e615d4e3265e067c10a86818f8d220
-
SHA1
1b71847d5f44d6e204938fdd0e082c88cea0b552
-
SHA256
8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f
-
SHA512
f1396b8d43b4a58156994fc23cfa0f3424450f3f7029c3753665dc91234793a4de01db09725dce3a65199fc2e266cccc535f6e215fd2c0b06d3ee46825a8d6c6
Malware Config
Extracted
C:\ncy729kz-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/15E0079A2C49A45E
http://decryptor.top/15E0079A2C49A45E
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\AddLock.crw => \??\c:\users\admin\pictures\AddLock.crw.ncy729kz 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File renamed C:\Users\Admin\Pictures\GetLimit.crw => \??\c:\users\admin\pictures\GetLimit.crw.ncy729kz 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File renamed C:\Users\Admin\Pictures\MergeConfirm.raw => \??\c:\users\admin\pictures\MergeConfirm.raw.ncy729kz 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File renamed C:\Users\Admin\Pictures\MountCheckpoint.tiff => \??\c:\users\admin\pictures\MountCheckpoint.tiff.ncy729kz 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File renamed C:\Users\Admin\Pictures\PopUnpublish.tiff => \??\c:\users\admin\pictures\PopUnpublish.tiff.ncy729kz 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File renamed C:\Users\Admin\Pictures\SearchSwitch.png => \??\c:\users\admin\pictures\SearchSwitch.png.ncy729kz 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\users\admin\pictures\EditStart.tiff 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\users\admin\pictures\MountCheckpoint.tiff 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File renamed C:\Users\Admin\Pictures\EditStart.tiff => \??\c:\users\admin\pictures\EditStart.tiff.ncy729kz 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File renamed C:\Users\Admin\Pictures\ExportSkip.raw => \??\c:\users\admin\pictures\ExportSkip.raw.ncy729kz 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\users\admin\pictures\PopUnpublish.tiff 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File renamed C:\Users\Admin\Pictures\CompareFormat.tif => \??\c:\users\admin\pictures\CompareFormat.tif.ncy729kz 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exedescription ioc process File opened (read-only) \??\A: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\F: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\G: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\Q: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\T: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\U: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\X: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\M: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\N: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\P: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\S: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\W: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\Y: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\Z: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\D: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\B: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\E: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\K: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\O: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\H: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\I: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\J: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\L: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\R: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened (read-only) \??\V: 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\k29f9o.bmp" 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe -
Drops file in Program Files directory 21 IoCs
Processes:
8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exedescription ioc process File opened for modification \??\c:\program files\CheckpointHide.dib 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\DisableSave.rtf 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\InitializeEnable.docx 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\SplitRedo.rm 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\BackupGroup.bmp 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\OutSwitch.js 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\ResetCompare.dotm 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\RestartOptimize.docx 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\SwitchBackup.vbs 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File created \??\c:\program files\ncy729kz-readme.txt 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\RenameUninstall.mp4 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\SaveUse.tmp 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\SearchRestart.search-ms 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\UnprotectRevoke.mp2 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File created \??\c:\program files (x86)\ncy729kz-readme.txt 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\DebugAssert.gif 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\EditSuspend.svg 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\EnableNew.wmv 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\MoveGrant.7z 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\ShowResize.htm 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification \??\c:\program files\TestConvertFrom.3g2 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe -
Drops file in Windows directory 64 IoCs
Processes:
8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_14abafaabdbd77f4_mofd.dll.mui_793ef98d 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-msxml60_31bf3856ad364e35_10.0.15063.0_none_a3d67fce0405ea82_msxml6r.dll_d8460bdb 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasbase-core_31bf3856ad364e35_10.0.15063.0_none_4d4efd223148f3f6.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_hid-user.resources_31bf3856ad364e35_10.0.15063.0_de-de_71a6f7b87cc5aa6a.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..geservice.resources_31bf3856ad364e35_10.0.15063.0_de-de_d808e8331a1020ea_storsvc.dll.mui_2fc7b1d3 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_cvgafix.fon_c20a9ed9 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_cga80737.fon_2e43d167 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi32full_31bf3856ad364e35_10.0.15063.0_none_66ff4ca96011b0ac.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-m..lecore-ras-base-vpn_31bf3856ad364e35_10.0.15063.0_none_a1af4bb1e5163dc9_vpntoasticon.png_e607ca23 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_10.0.15063.0_de-de_cedf17224e64925d_profsvc.dll.mui_32482e9e 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_c53b9c03c7b5d8af.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_10.0.15063.0_none_19203acea52963ba.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-coresystemminpnp_31bf3856ad364e35_10.0.15063.0_none_1b70ea73251f149e_drvcfg.exe_8370a674 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_sk-sk_bcb323d2ec813098.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.15063.0_none_69f7bd111ce467b4.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_e1f4fde2e2936fd2_vds.exe.mui_2268d934 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_en-us_a2d137bdfba7a703_mpssvc.dll.mui_4b194b5f 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_it-it_faf19848eb332211_comctl32.dll.mui_0da4e682 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_es-es_c7c88d7dc401c162_memtest.efi.mui_71e15c22 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..oexistencemigration_31bf3856ad364e35_10.0.15063.0_none_22f6ec0bb529250e_httpprxc.dll_53471021 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-keyiso.resources_31bf3856ad364e35_10.0.15063.0_en-us_1b9eda7aacdf6c87_keyiso.dll.mui_4bbf12ff 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_de-de_5be8d57b685c3b22_scfilter.sys.mui_cebab716 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_c74cd5a2848ce468.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_d1a17ff4b8eda663_firewallapi.dll.mui_43c7a05b 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-shlwapi_31bf3856ad364e35_10.0.15063.0_none_aeceefba2520337c_shlwapi.dll_1eec0a2e 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.i..utomation.proxystub_6595b64144ccf1df_1.0.15063.0_none_021b03263abb1b35.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base_31bf3856ad364e35_10.0.15063.0_none_1f020fb05f5437ab_combase.dll_a2567a6a 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_cga40woa.fon_3e9e1495 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_de-de_e3641786062c0973_mprdim.dll.mui_11b5ef08 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..gon-tools.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_5590b20187c8e1aa_wlrmdr.exe.mui_ee563c83 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-etw-ese.resources_31bf3856ad364e35_10.0.15063.0_en-us_0fbb5c7f4cac8478_etweseproviderresources.dll.mui_242b0636 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_b6139f14f6c955d6_apphelp.dll.mui_59096153 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-n..orkconnectionbroker_31bf3856ad364e35_10.0.15063.0_none_7817d3bd3211492c.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-twinapi_31bf3856ad364e35_10.0.15063.0_none_d6c5b2afd3cdeb43.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_hid-user.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_a586b16be14726c5_hidserv.dll.mui_561adfc8 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_en-us_8e4cd2143a97567e_sti.dll.mui_00a4f15b 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.15063.0_de-de_14888a056ad026a8.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_pl-pl_d19a26cc6665fb73.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-oleacc_31bf3856ad364e35_10.0.15063.0_none_85ed41598f9336e6.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_de-de_beb9e9f73d4f9ded_iscsidsc.dll.mui_6acb64a6 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_b007ff450adb462f_tcpipcfg.dll.mui_a5479fc1 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_app852.fon_e3869f49 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..y-biometrics-client_31bf3856ad364e35_10.0.15063.0_none_cd81442af1f7d6e1.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_14abafaabdbd77f4_wmiapres.dll.mui_c1b8803f 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_03474fa863a84227_bootmgr.exe.mui_c434701f 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ar-sa_0cba2b77c41367f9_comctl32.dll.mui_0da4e682 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_hr-hr_8a18fc5c61316794.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.gdiplus.systemcopy_31bf3856ad364e35_10.0.15063.0_none_9bcfd43a767ecc30_gdiplus.dll_423f7010 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.15063.0_none_5522510b24d3f7d4_fwremotesvr.dll_afaa5ea8 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_cga40857.fon_2c8aa2e4 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_a221761e9816d444.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.15063.0_de-de_2f549ff69030259d_rasautou.exe.mui_55686a97 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.15063.0_none_bcbd1290a09b9a77_rtm.dll_dbf434cd 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-uxtheme_31bf3856ad364e35_10.0.15063.0_none_b6f8740d3f5e547a.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_he-il_404f12a54e01d1c8.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_nl-nl_8b5dcc4a81438dbf_memtest.exe.mui_77b8cbcc 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..istration.resources_31bf3856ad364e35_10.0.15063.0_en-us_faa30aac00784952.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_f5dc2ec982476ba8_iscsi.psd1_8e91985d 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_en-us_0f2e55c68b9b08e2.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_en-us_f4603244510f9eba.manifest 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_en-gb_66be140125df80c7_comctl32.dll.mui_0da4e682 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_10.0.15063.0_none_e2690f59d7b4d715_msvcrt.dll_ee71f3d5 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_nl-nl_48f7bf74aac3a3de_bootmgr.efi.mui_be5d0075 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_h8514sys.fon_9da56372 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4048 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exepid process 3980 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe 3980 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 776 vssvc.exe Token: SeRestorePrivilege 776 vssvc.exe Token: SeAuditPrivilege 776 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.execmd.exedescription pid process target process PID 3980 wrote to memory of 3744 3980 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe cmd.exe PID 3980 wrote to memory of 3744 3980 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe cmd.exe PID 3980 wrote to memory of 3744 3980 8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe cmd.exe PID 3744 wrote to memory of 4048 3744 cmd.exe vssadmin.exe PID 3744 wrote to memory of 4048 3744 cmd.exe vssadmin.exe PID 3744 wrote to memory of 4048 3744 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\8c283ace779977a0642254ac184617c69943fecb7ef66bca1b8ab4136aa8ae9f.bin.sample.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:4048
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:424
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:776