Analysis
-
max time kernel
141s -
max time network
136s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 00:58
Static task
static1
Behavioral task
behavioral1
Sample
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe
Resource
win10-en-20211208
General
-
Target
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe
-
Size
157KB
-
MD5
cb10b8ae80227663ab17ab7b206c3057
-
SHA1
3eb865331bf14ce7c22cd7464928432285820824
-
SHA256
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299
-
SHA512
72c2ebce70ea3b6c76b4ce84171ce28bdd322f9caae94eba7ac491e134fb67c953738dda4a52efe869874b731a28d711887a6957ff24d2376c0c505b300a4b89
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exedescription ioc process File opened (read-only) \??\M: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\O: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\Q: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\S: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\X: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\R: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\U: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\Y: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\E: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\F: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\J: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\K: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\L: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\V: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\W: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\Z: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\A: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\H: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\I: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\N: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\P: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\B: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\G: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\T: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe -
Drops file in Windows directory 64 IoCs
Processes:
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-e..gine-isam.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1edda9a99ffeed56_esent.dll.mui_e30e3b90 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_cb446d33b8328ccb_appidapi.dll.mui_b6af37bb d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_6.1.7600.16385_none_aa5813cb3a17070e_ipsecsvc.mof_713662d2 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9220543b26dc7c09_wmiutils.dll.mui_42583eaf d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_23376bf5921e7b63.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..dem-voice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_49ed934cce6107e1_serwvdrv.dll.mui_6a9f4568 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-uxtheme.resources_31bf3856ad364e35_6.1.7600.16385_es-es_71e04df1607dd9bf_uxtheme.dll.mui_15ce9297 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c110f4bd66485354.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e_t2embed.dll_66e8486f d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-shlwapi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_53a5cec4855ca29e_shlwapi.dll.mui_a6436c6f d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..truetype-couriernew_31bf3856ad364e35_6.1.7600.16385_none_32383eb7c6ebfd9b_courbi.ttf_7ee31c80 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_6.1.7600.16385_none_df4bbe8e10903104_vgas1256.fon_a23e6fc8 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_083761eb9020e571_iprtrmgr.dll.mui_eb023b92 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_40e59f17fbfe3781.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9d9222b9cac3adcd.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_22415d369426c24f_comctl32.dll.mui_0da4e682 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e8dccb238c9862b1_netrass.inf_loc_17636d00 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..cesframework-msimtf_31bf3856ad364e35_6.1.7600.16385_none_2d7a7604044d57d9.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7_dnscacheugc.exe_aa32623e d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-imageres.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1e4defe6035a694f.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..assdriver.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e5b6e09ea67fc5c8.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-userenv.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1fb2926c3d49eba3.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-winsock-core.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d6adfa39555da0ee_afd.sys.mui_ff192075 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_es-es_ecc8f50ace56f38c.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-d..lient-dll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5588b35e1b8aed89_dhcpcmonitor.dll.mui_478a7103 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-d..oryservices-ntdsapi_31bf3856ad364e35_6.1.7600.16385_none_ceb39c895289e648_ntdsapi.dll_23e20303 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-x..nrollment.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a46c227d342162e2_certenroll.dll.mui_a77d5a29 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b5fa959a738d6d74.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-o..iles-core.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5f7103aaf3c5ba0d_cscmig.dll.mui_7e59bd05 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-csrsrv_31bf3856ad364e35_6.1.7600.16385_none_2fd0d2fef36f6a6b.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728_printui.exe_bb673fff d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-halftone-ui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b5470469869088f3.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..onal-codepage-54936_31bf3856ad364e35_6.1.7600.16385_none_dad19c79a102ff10.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-o..iles-core.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b6b4d0ce04c0bca3_cscmig.dll.mui_7e59bd05 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mfc42x.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_64fae1eae3516fc5_mfc42.dll.mui_66106d85 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_nb-no_03e8d9cb0e69654f.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-imagesp1.resources_31bf3856ad364e35_6.1.7600.16385_de-de_56b600ae9623cd26.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mpr.resources_31bf3856ad364e35_6.1.7600.16385_en-us_167a7fa34db11fe9_mpr.dll.mui_a313505c d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a_rasacd.sys_43640ee7 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ba0c82eccf526351_netrass.inf_loc_17636d00 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..libraries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d869760728e52d38_iphlpapi.dll.mui_9531144c d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_abc131a3483b963e.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-duser.resources_31bf3856ad364e35_6.1.7600.16385_de-de_cc15f8cd954588fe_duser.dll.mui_3c369ac4 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4a4b188d86270b21_consent.exe.mui_2eb3b9db d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_63dee2821fc69fce_bridge.sys_4e5f368e d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_networking-mpssvc-svc_31bf3856ad364e35_6.1.7601.17514_none_f83a40e7de7c47da_firewallapi.dll_b7801b42 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_es-es_646109f2014f4049_certcli.dll.mui_1b6822cf d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f39c285e7fbf22f0.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-o..iles-core.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b6b4d0ce04c0bca3.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..ionengine.resources_31bf3856ad364e35_6.1.7600.16385_en-us_453d1da2343e9f05_scesrv.dll.mui_c6e979b7 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-win32k_31bf3856ad364e35_6.1.7601.17514_none_17197f29b1265401_win32k.sys_0d7a6fb3 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6959b1ef4a72a285_ntmarta.dll.mui_027ef4fc d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_networking-mpssvc-svc.resources_31bf3856ad364e35_6.1.7601.17514_en-us_89701e1decba44ab_firewallapi.dll.mui_43c7a05b d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..owmanager.resources_31bf3856ad364e35_6.1.7600.16385_en-us_05ee2d61d58171a1_dwmredir.dll.mui_08a6874d d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-duser.resources_31bf3856ad364e35_6.1.7600.16385_de-de_283494514da2fa34_duser.dll.mui_3c369ac4 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-o..ct-picker.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_654ac65c9c785379_objsel.dll.mui_9b915792 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9f45784d166e7cf4_samsrv.dll.mui_32250491 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-directory-services-sam_31bf3856ad364e35_6.1.7601.17514_none_10145eccb79418a5.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_de-de_111bacf3e074578c_rascfg.dll.mui_0b036e1f d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_083761eb9020e571_rtm.dll.mui_55e4e990 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..ineclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a8af9daaf6cb0394_scecli.dll.mui_225fa220 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6578e61f4c86036e.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-searchfolder.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_abfe0f492aa0f474.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 564 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exepid process 1608 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe 1608 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1768 vssvc.exe Token: SeRestorePrivilege 1768 vssvc.exe Token: SeAuditPrivilege 1768 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.execmd.exedescription pid process target process PID 1608 wrote to memory of 452 1608 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe cmd.exe PID 1608 wrote to memory of 452 1608 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe cmd.exe PID 1608 wrote to memory of 452 1608 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe cmd.exe PID 1608 wrote to memory of 452 1608 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe cmd.exe PID 452 wrote to memory of 564 452 cmd.exe vssadmin.exe PID 452 wrote to memory of 564 452 cmd.exe vssadmin.exe PID 452 wrote to memory of 564 452 cmd.exe vssadmin.exe PID 452 wrote to memory of 564 452 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe"C:\Users\Admin\AppData\Local\Temp\d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:564
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1768
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1608-54-0x0000000076C61000-0x0000000076C63000-memory.dmpFilesize
8KB
-
memory/1608-56-0x00000000020E0000-0x000000000217F000-memory.dmpFilesize
636KB
-
memory/1608-57-0x0000000002180000-0x00000000022AD000-memory.dmpFilesize
1.2MB
-
memory/1608-58-0x0000000001EB0000-0x0000000001ECF000-memory.dmpFilesize
124KB
-
memory/1608-60-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1608-59-0x00000000001B0000-0x00000000001BA000-memory.dmpFilesize
40KB
-
memory/1608-62-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1608-61-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1608-64-0x00000000001F0000-0x00000000001F6000-memory.dmpFilesize
24KB
-
memory/1608-63-0x00000000025E0000-0x00000000026E9000-memory.dmpFilesize
1.0MB