Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
29-11-2021 07:51
Static task
static1
Behavioral task
behavioral1
Sample
46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
-
Target
46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe
-
Size
669KB
-
MD5
f3f4909771e23ec301ae2a2c5945f25c
-
SHA1
0cbbc30d64966d7108f3404979058285d8ed250c
-
SHA256
46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd
-
SHA512
fd928762c0ddc8301092504874b0ff4ad81a65c4cd385a493db2a5dcce786bcb2f915869958a6618ba10ac443ac6af6a458fed5ec2aedc52e0c649d9d72c27ad
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">0D08F365613CDA2B8F26107E2898494D35843956EABFF152F28719B3FDD3E01E7F8F31979BCD58130BC514640DB859AE73EA1A2FD2A00A690AD7B97272D17A8C<br>1A9939F96BF88B4FC0DC72F2F3E8D05682EA853E0DC471D7971BB946B3A76F892093C4110620E8292A336E678A6FD9BC45C36D4F0209DBE3E42E85533847<br>63D9CA5A1A262120246A5953D6A87865FADFDADCD16244D1DABB80FE7B83205C859A32654839BC950E9E3B4C8772C91D57C16E402945DDA4D98B0D8E900A<br>0A29C8E0B1686D989646CC929651F90C473254A08C1068382719D79952152FAB34FCBF6494302469B9E573B4CA62DE5BEFDDA50F7E5126C1F58D41D0D5F4<br>08FCA0CDD8A5129D518DB4FF101B725B22107CF4D01375F0B9C846152576238C5528CF2129F3B212817FABC608DE2A9C9D152623E43A9D7CC34E9477B55B<br>669887A1437EDB7D8CBC153FD87DCA879081C95ECC07172401C548345A609073DE3141284C76710658751DFFD94AEEE9EFA520855A35901DB5AC6D6E30BA<br>9F778C2C2364B2D23EC5B2EC6BD90893E43966E6DE4BCCF9EFBE9CFDD63898937FCC6B6EC96883FEDBEFA1BE2748D5B15B6F3245F4D0C62E124A75CAB9B9<br>0BB0151078BB2E68FAD13FA40CD046F242E1D1404A28C05D0C26C16CAA46F581EC9FC851FD3E2091CAAC0FEFC6E813BA716E2784E8630C8A13CDC561E562<br>985F5C5E8DF635E125B34F5A858A</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x00060000000125f0-64.dat family_medusalocker behavioral1/files/0x00060000000125f0-62.dat family_medusalocker -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid Process 1192 svhost.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exedescription ioc Process File renamed C:\Users\Admin\Pictures\CheckpointUnpublish.png => C:\Users\Admin\Pictures\CheckpointUnpublish.png.fileslock 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File renamed C:\Users\Admin\Pictures\DismountSkip.raw => C:\Users\Admin\Pictures\DismountSkip.raw.fileslock 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File renamed C:\Users\Admin\Pictures\FindMove.tif => C:\Users\Admin\Pictures\FindMove.tif.fileslock 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File renamed C:\Users\Admin\Pictures\InitializeAssert.png => C:\Users\Admin\Pictures\InitializeAssert.png.fileslock 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File renamed C:\Users\Admin\Pictures\InstallRegister.tif => C:\Users\Admin\Pictures\InstallRegister.tif.fileslock 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File renamed C:\Users\Admin\Pictures\ShowSearch.crw => C:\Users\Admin\Pictures\ShowSearch.crw.fileslock 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File renamed C:\Users\Admin\Pictures\WriteDisconnect.png => C:\Users\Admin\Pictures\WriteDisconnect.png.fileslock 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File renamed C:\Users\Admin\Pictures\ImportExit.crw => C:\Users\Admin\Pictures\ImportExit.crw.fileslock 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File renamed C:\Users\Admin\Pictures\RenameMerge.crw => C:\Users\Admin\Pictures\RenameMerge.crw.fileslock 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File renamed C:\Users\Admin\Pictures\TraceFind.raw => C:\Users\Admin\Pictures\TraceFind.raw.fileslock 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exedescription ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2955169046-2371869340-1800780948-1000\desktop.ini 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exedescription ioc Process File opened (read-only) \??\J: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\M: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\N: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\W: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\E: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\L: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\P: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\Q: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\R: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\S: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\T: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\V: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\F: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\Z: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\X: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\B: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\G: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\H: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\I: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\K: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\O: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\U: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\A: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe File opened (read-only) \??\Y: 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid Process 892 vssadmin.exe 864 vssadmin.exe 1748 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exepid Process 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
vssvc.exewmic.exewmic.exewmic.exedescription pid Process Token: SeBackupPrivilege 1668 vssvc.exe Token: SeRestorePrivilege 1668 vssvc.exe Token: SeAuditPrivilege 1668 vssvc.exe Token: SeIncreaseQuotaPrivilege 1068 wmic.exe Token: SeSecurityPrivilege 1068 wmic.exe Token: SeTakeOwnershipPrivilege 1068 wmic.exe Token: SeLoadDriverPrivilege 1068 wmic.exe Token: SeSystemProfilePrivilege 1068 wmic.exe Token: SeSystemtimePrivilege 1068 wmic.exe Token: SeProfSingleProcessPrivilege 1068 wmic.exe Token: SeIncBasePriorityPrivilege 1068 wmic.exe Token: SeCreatePagefilePrivilege 1068 wmic.exe Token: SeBackupPrivilege 1068 wmic.exe Token: SeRestorePrivilege 1068 wmic.exe Token: SeShutdownPrivilege 1068 wmic.exe Token: SeDebugPrivilege 1068 wmic.exe Token: SeSystemEnvironmentPrivilege 1068 wmic.exe Token: SeRemoteShutdownPrivilege 1068 wmic.exe Token: SeUndockPrivilege 1068 wmic.exe Token: SeManageVolumePrivilege 1068 wmic.exe Token: 33 1068 wmic.exe Token: 34 1068 wmic.exe Token: 35 1068 wmic.exe Token: SeIncreaseQuotaPrivilege 1404 wmic.exe Token: SeSecurityPrivilege 1404 wmic.exe Token: SeTakeOwnershipPrivilege 1404 wmic.exe Token: SeLoadDriverPrivilege 1404 wmic.exe Token: SeSystemProfilePrivilege 1404 wmic.exe Token: SeSystemtimePrivilege 1404 wmic.exe Token: SeProfSingleProcessPrivilege 1404 wmic.exe Token: SeIncBasePriorityPrivilege 1404 wmic.exe Token: SeCreatePagefilePrivilege 1404 wmic.exe Token: SeBackupPrivilege 1404 wmic.exe Token: SeRestorePrivilege 1404 wmic.exe Token: SeShutdownPrivilege 1404 wmic.exe Token: SeDebugPrivilege 1404 wmic.exe Token: SeSystemEnvironmentPrivilege 1404 wmic.exe Token: SeRemoteShutdownPrivilege 1404 wmic.exe Token: SeUndockPrivilege 1404 wmic.exe Token: SeManageVolumePrivilege 1404 wmic.exe Token: 33 1404 wmic.exe Token: 34 1404 wmic.exe Token: 35 1404 wmic.exe Token: SeIncreaseQuotaPrivilege 1832 wmic.exe Token: SeSecurityPrivilege 1832 wmic.exe Token: SeTakeOwnershipPrivilege 1832 wmic.exe Token: SeLoadDriverPrivilege 1832 wmic.exe Token: SeSystemProfilePrivilege 1832 wmic.exe Token: SeSystemtimePrivilege 1832 wmic.exe Token: SeProfSingleProcessPrivilege 1832 wmic.exe Token: SeIncBasePriorityPrivilege 1832 wmic.exe Token: SeCreatePagefilePrivilege 1832 wmic.exe Token: SeBackupPrivilege 1832 wmic.exe Token: SeRestorePrivilege 1832 wmic.exe Token: SeShutdownPrivilege 1832 wmic.exe Token: SeDebugPrivilege 1832 wmic.exe Token: SeSystemEnvironmentPrivilege 1832 wmic.exe Token: SeRemoteShutdownPrivilege 1832 wmic.exe Token: SeUndockPrivilege 1832 wmic.exe Token: SeManageVolumePrivilege 1832 wmic.exe Token: 33 1832 wmic.exe Token: 34 1832 wmic.exe Token: 35 1832 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exetaskeng.exedescription pid Process procid_target PID 796 wrote to memory of 892 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 28 PID 796 wrote to memory of 892 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 28 PID 796 wrote to memory of 892 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 28 PID 796 wrote to memory of 892 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 28 PID 796 wrote to memory of 1068 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 32 PID 796 wrote to memory of 1068 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 32 PID 796 wrote to memory of 1068 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 32 PID 796 wrote to memory of 1068 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 32 PID 796 wrote to memory of 864 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 34 PID 796 wrote to memory of 864 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 34 PID 796 wrote to memory of 864 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 34 PID 796 wrote to memory of 864 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 34 PID 796 wrote to memory of 1404 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 36 PID 796 wrote to memory of 1404 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 36 PID 796 wrote to memory of 1404 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 36 PID 796 wrote to memory of 1404 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 36 PID 796 wrote to memory of 1748 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 38 PID 796 wrote to memory of 1748 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 38 PID 796 wrote to memory of 1748 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 38 PID 796 wrote to memory of 1748 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 38 PID 796 wrote to memory of 1832 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 40 PID 796 wrote to memory of 1832 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 40 PID 796 wrote to memory of 1832 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 40 PID 796 wrote to memory of 1832 796 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe 40 PID 1072 wrote to memory of 1192 1072 taskeng.exe 45 PID 1072 wrote to memory of 1192 1072 taskeng.exe 45 PID 1072 wrote to memory of 1192 1072 taskeng.exe 45 PID 1072 wrote to memory of 1192 1072 taskeng.exe 45 -
System policy modification 1 TTPs 3 IoCs
Processes:
46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe"C:\Users\Admin\AppData\Local\Temp\46c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd.exe"1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:796 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:892
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:864
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1748
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
C:\Windows\system32\taskeng.exetaskeng.exe {4372DE8D-DB9E-4B3E-8D20-C8132824FBE8} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:1192
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
f3f4909771e23ec301ae2a2c5945f25c
SHA10cbbc30d64966d7108f3404979058285d8ed250c
SHA25646c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd
SHA512fd928762c0ddc8301092504874b0ff4ad81a65c4cd385a493db2a5dcce786bcb2f915869958a6618ba10ac443ac6af6a458fed5ec2aedc52e0c649d9d72c27ad
-
MD5
f3f4909771e23ec301ae2a2c5945f25c
SHA10cbbc30d64966d7108f3404979058285d8ed250c
SHA25646c9bed88ac58193eb8c1b2ca91cfede01a74dafa4315ff57b7d3bb0c8a779cd
SHA512fd928762c0ddc8301092504874b0ff4ad81a65c4cd385a493db2a5dcce786bcb2f915869958a6618ba10ac443ac6af6a458fed5ec2aedc52e0c649d9d72c27ad