dmalocker | ef7fefcb41d79c824c429819fbe73e6d0186c0586bc5f031debf553cd43edce4

pid	Process
1400	bcdedit.exe
1372	bcdedit.exe

Deletes System State backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

pid	Process
1348	wbadmin.exe

Modifies extensions of user files 20 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\ApproveInstall.tiff.t1000	SysLogsService.exe
File created	C:\Users\Admin\Pictures\DismountCopy.crw.t1000	SysLogsService.exe
File opened for modification	C:\Users\Admin\Pictures\DismountCopy.crw.t1000	SysLogsService.exe
File opened for modification	C:\Users\Admin\Pictures\ResolveDisconnect.raw.t1000	SysLogsService.exe
File created	C:\Users\Admin\Pictures\UnblockRegister.crw.t1000	SysLogsService.exe
File opened for modification	C:\Users\Admin\Pictures\UninstallClear.tiff.t1000	SysLogsService.exe
File opened for modification	C:\Users\Admin\Pictures\WatchUnregister.png.t1000	SysLogsService.exe
File opened for modification	C:\Users\Admin\Pictures\ApproveInstall.tiff.t1000	SysLogsService.exe
File opened for modification	C:\Users\Admin\Pictures\FindRevoke.tiff.t1000	SysLogsService.exe
File created	C:\Users\Admin\Pictures\ResolveClose.tiff.t1000	SysLogsService.exe
File created	C:\Users\Admin\Pictures\ShowLock.png.t1000	SysLogsService.exe
File opened for modification	C:\Users\Admin\Pictures\ShowLock.png.t1000	SysLogsService.exe
File created	C:\Users\Admin\Pictures\UninstallClear.tiff.t1000	SysLogsService.exe
File created	C:\Users\Admin\Pictures\FindRevoke.tiff.t1000	SysLogsService.exe
File opened for modification	C:\Users\Admin\Pictures\ResolveClose.tiff.t1000	SysLogsService.exe
File created	C:\Users\Admin\Pictures\ResolveDisconnect.raw.t1000	SysLogsService.exe
File created	C:\Users\Admin\Pictures\WatchUnregister.png.t1000	SysLogsService.exe
File created	C:\Users\Admin\Pictures\CopyImport.raw.t1000	SysLogsService.exe
File opened for modification	C:\Users\Admin\Pictures\CopyImport.raw.t1000	SysLogsService.exe
File opened for modification	C:\Users\Admin\Pictures\UnblockRegister.crw.t1000	SysLogsService.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SysLogsService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SysLogsService.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/776-55-0x000000013F660000-0x000000013FE18000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SysLogsService.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\K:	SysLogsService.exe
File opened (read-only)	\??\X:	SysLogsService.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\Z:	SysLogsService.exe
File opened (read-only)	\??\L:	SysLogsService.exe
File opened (read-only)	\??\M:	SysLogsService.exe
File opened (read-only)	\??\A:	SysLogsService.exe
File opened (read-only)	\??\B:	SysLogsService.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\T:	SysLogsService.exe
File opened (read-only)	\??\U:	SysLogsService.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\O:	SysLogsService.exe
File opened (read-only)	\??\W:	SysLogsService.exe
File opened (read-only)	\??\Y:	SysLogsService.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\H:	SysLogsService.exe
File opened (read-only)	\??\I:	SysLogsService.exe
File opened (read-only)	\??\P:	SysLogsService.exe
File opened (read-only)	\??\Q:	SysLogsService.exe
File opened (read-only)	\??\R:	SysLogsService.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\G:	SysLogsService.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\E:	SysLogsService.exe
File opened (read-only)	\??\F:	SysLogsService.exe
File opened (read-only)	\??\S:	SysLogsService.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\V:	SysLogsService.exe
File opened (read-only)	\??\J:	SysLogsService.exe
File opened (read-only)	\??\N:	SysLogsService.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
776	SysLogsService.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 13 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

T1107

Inhibit System Recovery

pid	Process
1528	vssadmin.exe
936	vssadmin.exe
696	vssadmin.exe
1096	vssadmin.exe
1940	vssadmin.exe
1072	vssadmin.exe
1832	vssadmin.exe
1708	vssadmin.exe
2032	vssadmin.exe
852	vssadmin.exe
1624	vssadmin.exe
440	vssadmin.exe
1260	vssadmin.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1120	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe
776	SysLogsService.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeBackupPrivilege	1828	vssvc.exe
Token: SeRestorePrivilege	1828	vssvc.exe
Token: SeAuditPrivilege	1828	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1800	wmic.exe
Token: SeSecurityPrivilege	1800	wmic.exe
Token: SeTakeOwnershipPrivilege	1800	wmic.exe
Token: SeLoadDriverPrivilege	1800	wmic.exe
Token: SeSystemProfilePrivilege	1800	wmic.exe
Token: SeSystemtimePrivilege	1800	wmic.exe
Token: SeProfSingleProcessPrivilege	1800	wmic.exe
Token: SeIncBasePriorityPrivilege	1800	wmic.exe
Token: SeCreatePagefilePrivilege	1800	wmic.exe
Token: SeBackupPrivilege	1800	wmic.exe
Token: SeRestorePrivilege	1800	wmic.exe
Token: SeShutdownPrivilege	1800	wmic.exe
Token: SeDebugPrivilege	1800	wmic.exe
Token: SeSystemEnvironmentPrivilege	1800	wmic.exe
Token: SeRemoteShutdownPrivilege	1800	wmic.exe
Token: SeUndockPrivilege	1800	wmic.exe
Token: SeManageVolumePrivilege	1800	wmic.exe
Token: 33	1800	wmic.exe
Token: 34	1800	wmic.exe
Token: 35	1800	wmic.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 1528	776	SysLogsService.exe	28
PID 776 wrote to memory of 1528	776	SysLogsService.exe	28
PID 776 wrote to memory of 1528	776	SysLogsService.exe	28
PID 776 wrote to memory of 1072	776	SysLogsService.exe	32
PID 776 wrote to memory of 1072	776	SysLogsService.exe	32
PID 776 wrote to memory of 1072	776	SysLogsService.exe	32
PID 776 wrote to memory of 1832	776	SysLogsService.exe	34
PID 776 wrote to memory of 1832	776	SysLogsService.exe	34
PID 776 wrote to memory of 1832	776	SysLogsService.exe	34
PID 776 wrote to memory of 1708	776	SysLogsService.exe	36
PID 776 wrote to memory of 1708	776	SysLogsService.exe	36
PID 776 wrote to memory of 1708	776	SysLogsService.exe	36
PID 776 wrote to memory of 936	776	SysLogsService.exe	38
PID 776 wrote to memory of 936	776	SysLogsService.exe	38
PID 776 wrote to memory of 936	776	SysLogsService.exe	38
PID 776 wrote to memory of 2032	776	SysLogsService.exe	40
PID 776 wrote to memory of 2032	776	SysLogsService.exe	40
PID 776 wrote to memory of 2032	776	SysLogsService.exe	40
PID 776 wrote to memory of 696	776	SysLogsService.exe	42
PID 776 wrote to memory of 696	776	SysLogsService.exe	42
PID 776 wrote to memory of 696	776	SysLogsService.exe	42
PID 776 wrote to memory of 1096	776	SysLogsService.exe	44
PID 776 wrote to memory of 1096	776	SysLogsService.exe	44
PID 776 wrote to memory of 1096	776	SysLogsService.exe	44
PID 776 wrote to memory of 852	776	SysLogsService.exe	46
PID 776 wrote to memory of 852	776	SysLogsService.exe	46
PID 776 wrote to memory of 852	776	SysLogsService.exe	46
PID 776 wrote to memory of 1624	776	SysLogsService.exe	48
PID 776 wrote to memory of 1624	776	SysLogsService.exe	48
PID 776 wrote to memory of 1624	776	SysLogsService.exe	48
PID 776 wrote to memory of 1940	776	SysLogsService.exe	50
PID 776 wrote to memory of 1940	776	SysLogsService.exe	50
PID 776 wrote to memory of 1940	776	SysLogsService.exe	50
PID 776 wrote to memory of 440	776	SysLogsService.exe	52
PID 776 wrote to memory of 440	776	SysLogsService.exe	52
PID 776 wrote to memory of 440	776	SysLogsService.exe	52
PID 776 wrote to memory of 1260	776	SysLogsService.exe	54
PID 776 wrote to memory of 1260	776	SysLogsService.exe	54
PID 776 wrote to memory of 1260	776	SysLogsService.exe	54
PID 776 wrote to memory of 1400	776	SysLogsService.exe	56
PID 776 wrote to memory of 1400	776	SysLogsService.exe	56
PID 776 wrote to memory of 1400	776	SysLogsService.exe	56
PID 776 wrote to memory of 1372	776	SysLogsService.exe	58
PID 776 wrote to memory of 1372	776	SysLogsService.exe	58
PID 776 wrote to memory of 1372	776	SysLogsService.exe	58
PID 776 wrote to memory of 1348	776	SysLogsService.exe	60
PID 776 wrote to memory of 1348	776	SysLogsService.exe	60
PID 776 wrote to memory of 1348	776	SysLogsService.exe	60
PID 776 wrote to memory of 1800	776	SysLogsService.exe	62
PID 776 wrote to memory of 1800	776	SysLogsService.exe	62
PID 776 wrote to memory of 1800	776	SysLogsService.exe	62

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	SysLogsService.exe

C:\Users\Admin\AppData\Local\Temp\SysLogsService.exe
"C:\Users\Admin\AppData\Local\Temp\SysLogsService.exe"
1⤵
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:776
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:1528
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:1072
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1832
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1708
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:936
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2032
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:696
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1096
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:852
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1624
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1940
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:440
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:1260
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1400
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1372
- C:\Windows\system32\wbadmin.exe
  wbadmin DELETE SYSTEMSTATEBACKUP
  2⤵
  - Deletes System State backups
  - Drops file in Windows directory
  PID:1348
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\CRYPTiNFO.TXT
1⤵
- Opens file in notepad (likely ransom note)
PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery