dddf58d54c7e1b086fc575df30ed923766f2ab9c23ede70c1a109400886dd39f

General

Target

dddf58d54c7e1b086fc575df30ed923766f2ab9c23ede70c1a109400886dd39f.dll
Size

164KB
MD5

75aab937577f6df274fab05ee2baf9f5
SHA1

bd0f79c02d8d2b6bf32e0b798b9397f7704b4648
SHA256

dddf58d54c7e1b086fc575df30ed923766f2ab9c23ede70c1a109400886dd39f
SHA512

f71ad7cdd1f226df19a6d4be4dfc2560512dddceb7e73dd9a119e7422aaadcf20eb21b685e3471af1f4b0fd106561351ef8c332b8a34abc1790a56634d259fea

Score

9^/10

ransomware

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

828 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1040 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1872 vssvc.exe
Token: SeRestorePrivilege 1872 vssvc.exe
Token: SeAuditPrivilege 1872 vssvc.exe

pid	process
828	vssadmin.exe

pid	process
1040	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.execmd.exe

description	pid	process	target process
PID 1692 wrote to memory of 1040	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1040	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1040	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1040	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1040	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1040	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1040	1692	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1408	1040	rundll32.exe	cmd.exe
PID 1040 wrote to memory of 1408	1040	rundll32.exe	cmd.exe
PID 1040 wrote to memory of 1408	1040	rundll32.exe	cmd.exe
PID 1040 wrote to memory of 1408	1040	rundll32.exe	cmd.exe
PID 1408 wrote to memory of 828	1408	cmd.exe	vssadmin.exe
PID 1408 wrote to memory of 828	1408	cmd.exe	vssadmin.exe
PID 1408 wrote to memory of 828	1408	cmd.exe	vssadmin.exe
PID 1408 wrote to memory of 828	1408	cmd.exe	vssadmin.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dddf58d54c7e1b086fc575df30ed923766f2ab9c23ede70c1a109400886dd39f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Suspicious use of WriteProcessMemory
PID:1408