Analysis
-
max time kernel
146s -
max time network
136s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 00:48
Static task
static1
Behavioral task
behavioral1
Sample
e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe
Resource
win10-en-20211208
General
-
Target
e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe
-
Size
161KB
-
MD5
f8a509a13601bcb0170956ec9c284a2a
-
SHA1
f11a903626588a5ab8a038b1deafef2f63603591
-
SHA256
e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c
-
SHA512
24d3567694322e4f927cf20fa6fdef05a598a1b06dbfd1ceb56cfa79447ec1896069a006096c24db18851fc8700e0d3da9476e9e5f367323c3bbd14246c6c6ee
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exedescription ioc process File opened (read-only) \??\F: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\L: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\M: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\P: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\Y: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\B: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\J: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\N: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\O: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\T: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\W: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\E: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\G: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\Q: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\S: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\Z: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\V: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\X: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\A: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\H: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\I: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\K: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\R: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened (read-only) \??\U: e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe -
Drops file in Windows directory 64 IoCs
Processes:
e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-e..gine-isam.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0e32b701c9788fec_esent.dll.mui_e30e3b90 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mprmsg_31bf3856ad364e35_6.1.7600.16385_none_13644a6db4b698b9.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4aab526590e1172b_scfilter.sys.mui_cebab716 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..anagement.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a79c1e9c7eb86252_powrprof.dll.mui_a2448a34 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-unimodem-config_31bf3856ad364e35_6.1.7600.16385_none_f4d7f7b17ffe522a_modemmigplugin.dll_6b9e1a82 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-x..ollmentui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_387e0dccfbc70bf0_certenrollui.dll.mui_e86ca64f e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_7019de43f9e3a677.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7600.16385_es-es_783d473f4a0142a2_winload.exe.mui_3bc5b827 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_13b239a73ae72dbc.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-legacyhwui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_acd574bd5394c981_hdwwiz.exe.mui_b4acc7bc e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-userenv_31bf3856ad364e35_6.1.7601.17514_none_ee666fe261e263e3_userenv.dll_1a3a70b6 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9365f544be6e4e04_certcli.dll.mui_1b6822cf e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_pt-pt_ef7b9e173a536f62_comdlg32.dll.mui_ac8e62f4 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_sv-se_d2199a50165e07e9.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..gertransport-serial_31bf3856ad364e35_6.1.7600.16385_none_6daa7ec5c65bf5bc.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-hal_31bf3856ad364e35_6.1.7601.17514_none_094ef8137049c196_hal.dll_f279be4d e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61a5ca31abb6a8fd_wshtcpip.dll.mui_042165f9 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_e44a5bf35c1f91f1.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-winbio.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9b7c76e94cbb839f.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8dd8c4f40dc38dd9_wer.dll.mui_e68ddae7 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shsvcs.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_22b18c66b73f6810_shsvcs.dll.mui_b69fccab e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-cryptui-dll.resources_31bf3856ad364e35_6.1.7601.17514_de-de_5c78c2290dbd5640_cryptui.dll.mui_9728c1dd e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dd2822fe8544398a_mlang.dll.mui_2904864a e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f52607304e593d93_setupapi.dll.mui_bcc172a4 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c2b105891e24eb61.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-d2d_31bf3856ad364e35_7.1.7601.16492_none_9abc61e3455c511e.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..itmap-ms_sans_serif_31bf3856ad364e35_6.1.7600.16385_none_ac9f9e10add68c8b_ssee1257.fon_9d31b9ac e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ac02e909516f7d8b_bootmgr.exe.mui_c434701f e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8f54bc532eadc7ab.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-sendmail.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ef49195de3a2e11b.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-shdocvw.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1ea841b1ccb1284f.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-rasserver_31bf3856ad364e35_6.1.7601.17514_none_1423e918b2cd2d4b_rasmigplugin.dll_7ee2aa40 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..tional-codepage-870_31bf3856ad364e35_6.1.7600.16385_none_2adf2efab4e0d9c8.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mprapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_494a397158b65c29.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-msxml30.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9fd3daa29505fb3c.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_de-de_59f90b40a942117e_erofflps.txt_649e76ed e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_2e9f92abd2ce43b6_hh.exe_f87e0044 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-msxml30.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9fd3daa29505fb3c_msxml3r.dll.mui_cd6e1e8f e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..ional-codepage-1255_31bf3856ad364e35_6.1.7600.16385_none_2346baa56ac4a62c.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-sendmail.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1e196194a0e8e07b_sendmail.dll.mui_cbac108c e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4b697e9c79bef952.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_07187ff0f42156ab.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e8a6ad183d1aaa86_serialui.dll.mui_7d29d2a3 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d33f52c4d452cdda_mofcomp.exe.mui_35badf56 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..trics-sensoradapter_31bf3856ad364e35_6.1.7600.16385_none_6fa6b9c88f2a3ba1.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-smartcardksp.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_940adae60f7352f1_scksp.dll.mui_05f14191 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973_user32.dll_55f4ed20 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-version_31bf3856ad364e35_6.1.7600.16385_none_70f340d66a96c29b.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..sition-coreservices_31bf3856ad364e35_6.1.7601.17514_none_90ba4080c9f2e648_wiarpc.dll_5aecac54 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..pp-client.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_37c1dc5aeeb79d37.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft.windows.s..rt_driver.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4f76fd40fd479095_scsiport.sys.mui_ef25385f e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6a9c9a561f35147e_activeds.dll.mui_67414db4 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-hbaapi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_32f774aeb8785762.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516_bootmgfw.efi.mui_a6e78cfa e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5f087cbd507d8e79_wer.dll.mui_e68ddae7 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..onmanager.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5a20b74a645757f9.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-qos_31bf3856ad364e35_6.1.7601.17514_none_0c716dff6e442c24_pacer.sys_c93de3d8 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_51f6d6941d367e01.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4f8620c6384385cb_scfilter.sys.mui_cebab716 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f4f0ae70cac9cfaf.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e7718915b6ba8195_authui.dll.mui_19b92789 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_de-de_69ed730eb5df1137_memtest.efi.mui_71e15c22 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-cryptnet-dll_31bf3856ad364e35_6.1.7600.16385_none_730e32c11586bfeb.manifest e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 672 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exepid process 1924 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1836 vssvc.exe Token: SeRestorePrivilege 1836 vssvc.exe Token: SeAuditPrivilege 1836 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.execmd.exedescription pid process target process PID 1924 wrote to memory of 932 1924 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe cmd.exe PID 1924 wrote to memory of 932 1924 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe cmd.exe PID 1924 wrote to memory of 932 1924 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe cmd.exe PID 1924 wrote to memory of 932 1924 e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe cmd.exe PID 932 wrote to memory of 672 932 cmd.exe vssadmin.exe PID 932 wrote to memory of 672 932 cmd.exe vssadmin.exe PID 932 wrote to memory of 672 932 cmd.exe vssadmin.exe PID 932 wrote to memory of 672 932 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe"C:\Users\Admin\AppData\Local\Temp\e639306c7587cc302a5c6c6e638ea552d652c6b0e69457c373b50f89dab5b94c.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:672
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1924-54-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB