Analysis
-
max time kernel
144s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 00:58
Static task
static1
Behavioral task
behavioral1
Sample
d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe
Resource
win10-en-20211208
General
-
Target
d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe
-
Size
161KB
-
MD5
91cb56f49b8ab508066623ce2eff9f6f
-
SHA1
8e4bb045593eb19fb72d756349215e060b05c019
-
SHA256
d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c
-
SHA512
eec032f97a96b82e6e981cc46843eabf20cdd7c132c89db3102eb1613940fd89d2a1ec04d57be2fadd9e32b46b5153f6221cb19c71f51c47956e55bd2e6e5a24
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exedescription ioc process File opened (read-only) \??\Q: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\R: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\V: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\L: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\M: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\N: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\P: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\T: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\U: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\W: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\Y: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\B: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\Z: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\F: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\G: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\H: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\J: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\K: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\S: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\X: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\A: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\I: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\O: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened (read-only) \??\E: d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe -
Drops file in Windows directory 64 IoCs
Processes:
d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61a5ca31abb6a8fd_wshtcpip.dll.mui_042165f9 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-hbaapi_31bf3856ad364e35_6.1.7601.17514_none_b18e5ca4be201fbf_hbaapi.mof_4e35fdd7 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_88ac424d7875fb9e_msaudite.dll.mui_dc90ce41 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748_bootmgr.efi.mui_be5d0075 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..ruetype-new_tai_lue_31bf3856ad364e35_6.1.7600.16385_none_325f57c8c0ee36a8_ntailub.ttf_139d3615 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-arial_31bf3856ad364e35_6.1.7601.17514_none_d0a9759ec3fa9e2d_ariali.ttf_a85a3504 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_84ba675e1f78be8c.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shacct.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_61d39da0d47e9d3e.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mfc42x.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f148573ead9e671e.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-ntlanman.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6a6825ad66f6db77.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.7601.17514_none_83801b5eed6392d9_gdiplus.dll_423f7010 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shdocvw.resources_31bf3856ad364e35_6.1.7600.16385_es-es_23831012741396ef_shdocvw.dll.mui_9b8f26d5 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-kernel32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a3645f7773564239_kernel32.dll.mui_c29170cd d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_66e40021f6ac2d53_rasdiag.dll.mui_15cb4ec4 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559_bootmgfw.efi_139dd311 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..truetype-couriernew_31bf3856ad364e35_6.1.7600.16385_none_32383eb7c6ebfd9b_couri.ttf_21733c5a d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_6.1.7600.16385_none_df4bbe8e10903104_vgas1257.fon_a23f7007 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_79b8d8cfc8e56a7e.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rmcast_31bf3856ad364e35_6.1.7601.17514_none_b2a3d1a09e8a89b1_wshrm.dll_0c3acbc3 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_70787288cf854a52_aclui.dll.mui_adadbfb7 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..ional-codepage-1252_31bf3856ad364e35_6.1.7600.16385_none_21f2251b6b9f9897_c_1252.nls_71b281ed d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..-platform-libraries_31bf3856ad364e35_6.1.7601.17514_none_4896f054b1edb553_iphlpapi.dll_7ae3573f d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-userenv.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1fb2926c3d49eba3_userenv.dll.mui_e516a7e7 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-rasserver_31bf3856ad364e35_6.1.7601.17514_none_1423e918b2cd2d4b_rasapi-dl.man_1c597019 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_51a9c0732ea27a7c_wudfhost.exe.mui_1fc689ff d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-efs-service.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4b5ad37c597b9f43.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_6.1.7600.16385_none_70644a8bdb0d9303_cga40woa.fon_3e9e1495 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_6.1.7600.16385_none_70644a8bdb0d9303_ega40869.fon_5e8f5479 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2dba46ae3c357fb2_sqlsoldb.chm_9573a554 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..cture-bsp.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_703a658bb8025c25_mswsock.dll.mui_d7c2a730 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..ltinstall.resources_31bf3856ad364e35_6.1.7600.16385_de-de_63e0d7a39c6cea56.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0e75d0c5c59459cc_iscsiexe.dll.mui_7d81b1cc d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_es-es_cbe42c602e9e85b3_tcpip.sys.mui_5885771c d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244_t2embed.dll_66e8486f d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_811df60c21c09a54_mlang.dll.mui_2904864a d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_23376bf5921e7b63_msobjs.dll_052c8a60 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-winbio.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9bb11a054c9491fa.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-vijaya_31bf3856ad364e35_6.1.7601.17514_none_44db357a5c7540d8_vijaya.ttf_a73b2b74 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-profapi_31bf3856ad364e35_6.1.7600.16385_none_fe1f5c20925a5a60.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-x..ollmentui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_38b2b0e8fba01a4b.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b40b4fc097a11d8a_acledit.dll.mui_5f932ccb d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_zh-tw_ac9edb6e6b20299f.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_de-de_111bacf3e074578c_rasdiag.dll.mui_15cb4ec4 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..dem-voice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_49b8f030ce87f986_serwvdrv.dll.mui_6a9f4568 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-t..libraries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7c4ada837087bc02.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-syssetup_31bf3856ad364e35_6.1.7601.17514_none_cef6913cae56559b.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_de-de_87cba9e8f27bba0e_winmgmtr.dll.mui_741bfb68 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.7600.16385_de-de_f06f5fc570802050_winhttp.dll.mui_f661192f d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-consolehost.resources_31bf3856ad364e35_6.1.7600.16385_es-es_71e7f0186b288c9a.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-e..orerframe.resources_31bf3856ad364e35_6.1.7600.16385_es-es_af38ff0e0c7a9cb9.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-laoui_31bf3856ad364e35_6.1.7600.16385_none_d02cc17733960c0e.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-imageres.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d17bb570ccd9cec0.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..pp-client.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c40f51aeb9049490_slc.dll.mui_dc24f809 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..pp-client.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_67f0b62b00a7235a_sppc.dll.mui_0a75786d d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..eservices.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7bb0bd650e72abc4_wiaservc.dll.mui_54051b53 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cb9f3ee914f6b4fb_acledit.dll.mui_5f932ccb d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1f237cc3876b81ab.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-t..stringime.resources_31bf3856ad364e35_6.1.7600.16385_en-us_898c75d2a31eba5b.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-acledit_31bf3856ad364e35_6.1.7600.16385_none_c3d671ef7642fced_acledit.dll_89da72d2 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-e..orerframe.resources_31bf3856ad364e35_6.1.7600.16385_de-de_067ccc311d759f4f_explorerframe.dll.mui_074caeb5 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..geadapter.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_83f13dac88dfa782_winbiostorageadapter.dll.mui_40b1790d d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_e24a7886a9947ebf_hdwwiz.cpl_b6a1dbdc d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-sendmail.resources_31bf3856ad364e35_6.1.7600.16385_de-de_46584364f4c4d556.manifest d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 384 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exepid process 1088 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 580 vssvc.exe Token: SeRestorePrivilege 580 vssvc.exe Token: SeAuditPrivilege 580 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.execmd.exedescription pid process target process PID 1088 wrote to memory of 776 1088 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe cmd.exe PID 1088 wrote to memory of 776 1088 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe cmd.exe PID 1088 wrote to memory of 776 1088 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe cmd.exe PID 1088 wrote to memory of 776 1088 d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe cmd.exe PID 776 wrote to memory of 384 776 cmd.exe vssadmin.exe PID 776 wrote to memory of 384 776 cmd.exe vssadmin.exe PID 776 wrote to memory of 384 776 cmd.exe vssadmin.exe PID 776 wrote to memory of 384 776 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe"C:\Users\Admin\AppData\Local\Temp\d4e108e8c6fcc46b796a4f38c7734343aa4a84eb75277bebc212383b69493e3c.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:384
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:580
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1088-54-0x00000000751B1000-0x00000000751B3000-memory.dmpFilesize
8KB