Analysis
-
max time kernel
169s -
max time network
184s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 00:58
Static task
static1
Behavioral task
behavioral1
Sample
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe
Resource
win10-en-20211208
General
-
Target
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe
-
Size
157KB
-
MD5
cb10b8ae80227663ab17ab7b206c3057
-
SHA1
3eb865331bf14ce7c22cd7464928432285820824
-
SHA256
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299
-
SHA512
72c2ebce70ea3b6c76b4ce84171ce28bdd322f9caae94eba7ac491e134fb67c953738dda4a52efe869874b731a28d711887a6957ff24d2376c0c505b300a4b89
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exedescription ioc process File opened (read-only) \??\H: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\L: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\M: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\N: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\O: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\V: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\E: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\W: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\Y: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\Z: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\B: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\F: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\G: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\J: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\Q: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\R: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\U: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\A: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\I: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\K: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\P: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\S: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\T: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened (read-only) \??\X: d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe -
Drops file in Windows directory 64 IoCs
Processes:
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_el-gr_d1f73285f872ee81.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.15063.0_es-es_6ead483edc26f335_axinstui.exe.mui_aea34130 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_vgafixe.fon_dea8b251 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-homegroup-provsvc_31bf3856ad364e35_10.0.15063.0_none_a2d14614268f974c_provsvc.dll_a438d02f d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-keyiso.resources_31bf3856ad364e35_10.0.15063.0_en-us_1b9eda7aacdf6c87_keyiso.dll.mui_4bbf12ff d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..erservice.resources_31bf3856ad364e35_10.0.15063.0_es-es_01a6accecaca285e_umpo.dll.mui_cac12e54 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ui-xaml-maps_31bf3856ad364e35_10.0.15063.0_none_a861864702eca1e1.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_en-us_269998480c8c0b86.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_35c138ce3c825021.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.15063.0_none_3fe4b2c9ef33a509.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.15063.0_none_4e7f7ad6cb1d2087.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_de-de_5be8d57b685c3b22_scdeviceenum.dll.mui_815e7662 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-themeservice.resources_31bf3856ad364e35_10.0.15063.0_de-de_c98b512d3ca0bb42.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_uk-ua_83b5c737a2b4f712_comctl32.dll.mui_0da4e682 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ru-ru_6fbaaffc5d91072d_comctl32.dll.mui_0da4e682 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_10.0.15063.0_es-es_4af765598c2696d8_netlogon.dll.mui_ecbeb9bd d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_sl-si_773a0c2f6874a88b_bootmgr.efi.mui_be5d0075 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_10.0.15063.0_en-us_77cfed1b3d429e22.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..sition-coreservices_31bf3856ad364e35_10.0.15063.0_none_43a8144aec22156f_sti.dll_d93e8a42 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.15063.0_es-es_794b71b522f7c9b2_rasdiag.dll.mui_15cb4ec4 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_he-il_e2b9a848b899ba23.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ru-ru_453845783036acd5.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-cryptsp-dll_31bf3856ad364e35_10.0.15063.0_none_3a7147463f9b3bd0.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..istration.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_9d25dd8ef3715159.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_eb8784774de6a9ad_iscsitarget.cdxml_1fec77bc d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_664c2e56d78422ef.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..gc-kspsvc.resources_31bf3856ad364e35_10.0.15063.0_es-es_aa4c598824ccb3c8_ngcsvc.dll.mui_96312421 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_de-de_663d7fcd9cbcfd1d.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..onmanager.resources_31bf3856ad364e35_10.0.15063.0_en-us_0f3f9edc83750aba.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_392c6ab41c63df3a_rtm.dll.mui_55e4e990 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_79fc50ac4945a493.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.15063.0_es-es_6dcb0adc83f0d3fa_winhttp.dll.mui_f661192f d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_da-dk_2e5a9c3cb5ade268.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_33a9f3ab14804647_scardsvr.dll.mui_5f6fb64f d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-keyiso.resources_31bf3856ad364e35_10.0.15063.0_de-de_7d02aed3f26222bd_keyiso.dll.mui_4bbf12ff d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.15063.0_none_8653562b67de179c_vds_ps.dll_fed45dfd d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sv-se_8675d120d143f7db.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directmanipulation_31bf3856ad364e35_10.0.15063.0_none_5e2ff11ada5cd7a4_directmanipulation.dll_07c179b4 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-webauthn.resources_31bf3856ad364e35_10.0.15063.0_de-de_895cc75926317253_webauthn.dll.mui_acc69b8d d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-win32kbase.resources_31bf3856ad364e35_10.0.15063.0_es-es_319dd14bb2dc0603.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-msvcrt_31bf3856ad364e35_10.0.15063.0_none_ecbdb9ac0c159910_msvcrt.dll_ee71f3d5 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_de-de_532657caf053a569_msimsg.dll.mui_72e8994f d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_da-dk_fb3d63c29861917a_comctl32.dll.mui_0da4e682 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_en-us_8febce1621bba7d7_bootmgfw.efi.mui_a6e78cfa d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.15063.0_none_f5ad4336b7886518_iumcrypt.dll_29ac136d d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_ec49a83516f431cd.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-c..temminpnp.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_d5b9c58bbc83da2f.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.15063.0_es-es_4709bf20e5d06fd6_appidsvc.dll.mui_6717e231 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-c..temminpnp.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_a58aebbbaa94540c.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wintrust-dll_31bf3856ad364e35_10.0.15063.0_none_00c212fed2df9e6b_wintrust.dll_abec426a d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-eventlog_31bf3856ad364e35_10.0.15063.0_none_edd835534ba7e8ec.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.15063.0_none_4e7f7ad6cb1d2087_sspisrv.dll_90c23c68 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_el-gr_5951efba74d1259c_comctl32.dll.mui_0da4e682 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-netapi32_31bf3856ad364e35_10.0.15063.0_none_a89c9e9e6ebf5995_netapi32.dll_8b1e859a d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-shacct_31bf3856ad364e35_10.0.15063.0_none_e16ab7358ea4c785.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_bg-bg_a18c0c1f4d396f4e_bootmgr.efi.mui_be5d0075 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_vgasysg.fon_af7316fb d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.15063.0_es-es_718d54164909dde7_listsvc.dll.mui_27f0fc85 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..e-ws2ifsl.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_dd4c0092fa872345.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.15063.0_none_2f06793a4bbe30eb_nissrv.exe_f967cd63 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_de-de_edb8c1d83a8ccb6e_rtm.dll.mui_55e4e990 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.15063.0_none_7d443ad9ecf1cbd0.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_hr-hr_0f58c5ace4a78141_comctl32.dll.mui_0da4e682 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_sr-..-rs_61f5adcf622ceaac.manifest d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3100 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exepid process 832 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe 832 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe 832 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe 832 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3336 vssvc.exe Token: SeRestorePrivilege 3336 vssvc.exe Token: SeAuditPrivilege 3336 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.execmd.exedescription pid process target process PID 832 wrote to memory of 404 832 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe cmd.exe PID 832 wrote to memory of 404 832 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe cmd.exe PID 832 wrote to memory of 404 832 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe cmd.exe PID 404 wrote to memory of 3100 404 cmd.exe vssadmin.exe PID 404 wrote to memory of 3100 404 cmd.exe vssadmin.exe PID 404 wrote to memory of 3100 404 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe"C:\Users\Admin\AppData\Local\Temp\d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:3100
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3336
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-118-0x00000000004A0000-0x00000000005EA000-memory.dmpFilesize
1.3MB
-
memory/832-119-0x00000000004A0000-0x00000000005EA000-memory.dmpFilesize
1.3MB
-
memory/832-120-0x0000000002070000-0x0000000002071000-memory.dmpFilesize
4KB
-
memory/832-121-0x0000000002080000-0x0000000002081000-memory.dmpFilesize
4KB
-
memory/832-122-0x00000000022E0000-0x00000000022E6000-memory.dmpFilesize
24KB