Analysis
-
max time kernel
159s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 00:38
Static task
static1
Behavioral task
behavioral1
Sample
ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe
Resource
win10-en-20211208
General
-
Target
ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe
-
Size
143KB
-
MD5
fb9d11c5ff87dd9071ab44f4c562ca3e
-
SHA1
1e383b22a38c91373ba446a820d61883f282cb3e
-
SHA256
ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea
-
SHA512
6c9f8caee949d0161bc7a37301a24af4c3ecf136f6afe66793cf01936fc31143308e527093776d4a5c1c323ac4fb06257570bd197e0549367281d2be47e3e4b4
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exedescription ioc process File opened (read-only) \??\J: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\R: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\U: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\B: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\E: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\G: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\I: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\N: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\O: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\Q: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\S: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\T: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\Y: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\L: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\X: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\Z: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\A: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\F: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\H: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\K: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\M: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\P: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\V: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened (read-only) \??\W: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe -
Drops file in Windows directory 64 IoCs
Processes:
ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_de-de_5be8d57b685c3b22_scardsvr.dll.mui_5f6fb64f ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_443aebdfd447e1c0.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ja-jp_5569e07ec9d20ae6_comctl32.dll.mui_0da4e682 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-csrss_31bf3856ad364e35_10.0.15063.0_none_744c6763514529af.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_adfae850a551a66a_userdeviceregistration.dll.mui_22ab8f29 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_ro-ro_d6a49a3e7445e0ae_bootmgr.efi.mui_be5d0075 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ro-ro_9eee956fea195b3b_msimsg.dll.mui_72e8994f ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lsa.resources_31bf3856ad364e35_10.0.15063.0_de-de_eecad791e08c04ca_lsasrv.dll.mui_d47f7e1c ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_cs-cz_9120bc15bf67e669.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_hr-hr_8a18fc5c61316794.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_c816ea8b6b3f385c.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_bae6f1b1935516b4.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.15063.0_none_7d443ad9ecf1cbd0_ntoskrnl.exe_0fb0ab79 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.15063.0_de-de_2f549ff69030259d_rasauto.dll.mui_12fa2c50 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.15063.0_none_f5ad4336b7886518_iumcrypt.dll_29ac136d ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_nb-no_82c9d6ba4bb6c1ef_memtest.efi.mui_71e15c22 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_10.0.15063.0_en-us_236c9464334ff5e6.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_06c8a8054dc02d3d.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_10.0.15063.0_none_b658a5fa435968f5.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wintrust-dll_31bf3856ad364e35_10.0.15063.0_none_0b16bd5107406066_wintrust.dll_abec426a ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_es-es_effb6eaa34ff2c34_mofcomp.exe.mui_35badf56 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_zh-tw_2b7fd85da86d863f_memtest.efi.mui_71e15c22 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_664c2e56d78422ef_iscsicli.exe.mui_64c0a23c ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.15063.0_en-us_567969ff4355ff0f_wininit.exe.mui_997435f5 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_a6a461aeb0d62e64_fidocredprov.dll.mui_4ca89266 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_de-de_29579edbbad6dd55.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.15063.0_none_7bfeabd9337d55a1_vdsutil.dll_f2ef43cf ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ro-ro_a0656448c72401aa_comctl32.dll.mui_0da4e682 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.15063.0_de-de_7f6609be4b2dcbcf_dnsrslvr.dll.mui_1e1a1ed1 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_hvgafix.fon_bf27df1c ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_10.0.15063.0_none_bcdc71d81c5b7ee4_dxgkrnl.sys_8aad3dfb ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..ng-client-overrides_31bf3856ad364e35_10.0.15063.0_none_2aad78202bd046dc_power.settings.processor.ppkg_04839598 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_es-es_74a152abb3d1d6b4_dsreg.dll.mui_5d9efc7e ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-client-li..m-service.resources_31bf3856ad364e35_10.0.15063.0_de-de_aa72c79d3365a91b_clipsvc.dll.mui_18823613 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_1164be3dcef90997.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.15063.0_none_9894c210d52e9480_updaterevokesipolicy.p7b_76fe3620 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_pt-br_5b48cea4e14dc672_comctl32.dll.mui_0da4e682 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_de-de_3cea917b11996ccf_mofd.dll.mui_793ef98d ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_cs-cz_16564cc48d9f6c75.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_et-ee_5337c09478c69707.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_en-us_0f2e55c68b9b08e2_scardsvr.dll.mui_5f6fb64f ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-c..temminpnp.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_496c5037f236e2d6_umpnpmgr.dll.mui_d66aed17 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_nl-nl_48f7bf74aac3a3de_bootmgfw.efi.mui_a6e78cfa ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-efs-service.resources_31bf3856ad364e35_10.0.15063.0_en-us_5df6e82b85a049fd_efssvc.dll.mui_03cc4e41 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-watchdog_31bf3856ad364e35_10.0.15063.0_none_717cc175e24acb19.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_10.0.15063.0_es-es_7adc7d345eead8ce.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_pt-pt_29179e3878af7901.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_fr-ca_97104af0d7031f5b.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.15063.0_none_9894c210d52e9480.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_bae6f1b1935516b4_lpk.dll_ebdc1de9 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_1a52bffe303ba629.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-sechost_31bf3856ad364e35_10.0.15063.0_none_98d6b61705c4f027_sechost.dll_a7bf8aa9 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_fr-ca_f4a5b54d6c6b3700.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-drv_31bf3856ad364e35_10.0.15063.0_none_b38673e5fb4dea69.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_sr-..-rs_61f5adcf622ceaac.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_es-es_8e182ef83abe4823.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_10.0.15063.0_en-us_fc9c46454adb8ec6_drvinst.exe.mui_e88f4c73 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_nb-no_13026f681f6b1496_msimsg.dll.mui_72e8994f ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_664c2e56d78422ef_iscsidsc.dll.mui_6acb64a6 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.15063.0_none_e8b186736ef44520.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-appid_31bf3856ad364e35_10.0.15063.0_none_72b493d71f56c769.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_de-de_edb8c1d83a8ccb6e.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_10.0.15063.0_es-es_5784f6984d299f85.manifest ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_2a2f66220fcb97e2_winload.efi.mui_35ee487d ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1752 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exepid process 2724 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe 2724 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe 2724 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe 2724 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2924 vssvc.exe Token: SeRestorePrivilege 2924 vssvc.exe Token: SeAuditPrivilege 2924 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.execmd.exedescription pid process target process PID 2724 wrote to memory of 892 2724 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe cmd.exe PID 2724 wrote to memory of 892 2724 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe cmd.exe PID 2724 wrote to memory of 892 2724 ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe cmd.exe PID 892 wrote to memory of 1752 892 cmd.exe vssadmin.exe PID 892 wrote to memory of 1752 892 cmd.exe vssadmin.exe PID 892 wrote to memory of 1752 892 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe"C:\Users\Admin\AppData\Local\Temp\ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2724-115-0x0000000000900000-0x00000000009AE000-memory.dmpFilesize
696KB
-
memory/2724-116-0x0000000000900000-0x00000000009AE000-memory.dmpFilesize
696KB
-
memory/2724-117-0x00000000010A0000-0x00000000010A1000-memory.dmpFilesize
4KB
-
memory/2724-118-0x00000000010B0000-0x00000000010B6000-memory.dmpFilesize
24KB