Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:07
Static task
static1
Behavioral task
behavioral1
Sample
c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe
Resource
win10-en-20211208
General
-
Target
c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe
-
Size
158KB
-
MD5
6dc266627079d874d817794dc2e46d52
-
SHA1
7a0345d8f4f74754ef7163834c14137234d56862
-
SHA256
c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d
-
SHA512
7896a0b907e1b3c5ac14cf1152ea18d801165573c997bee06549cc42e573bd57da15ca7bcc1834005a6996041d20592a857bf637765d7f08f8a37d15570576eb
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exedescription ioc process File opened (read-only) \??\E: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\G: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\H: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\J: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\O: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\T: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\F: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\L: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\R: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\Z: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\A: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\N: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\P: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\U: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\V: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\W: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\Y: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\B: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\I: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\K: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\M: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\Q: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\S: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened (read-only) \??\X: c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe -
Drops file in Windows directory 64 IoCs
Processes:
c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_de-de_10d22dcfce04430a.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_en-us_853b0789da5b1e2a.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9d9222b9cac3adcd.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dc4a3190eb7d1265_acledit.dll.mui_5f932ccb c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a34eb21187cbf59e_advapi32.dll.mui_28c7718f c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_de-de_18a6abaa160568df_hidserv.dll.mui_561adfc8 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_8c256fc0a6a20d36_authui.dll.mui_19b92789 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7449c6becaace7e3.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a34eb21187cbf59e.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7600.16385_none_3f3d4351a032bf57.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2403bfdae4c06f52.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_sdbinst.exe_8725e339 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4_hid.dll.mui_cccd5ae0 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_aelupsvc.dll_f420497b c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_b0ff4fc4cd57c163_aclui.dll_ebee9df6 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c162de87050a6649_hid.dll.mui_cccd5ae0 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e92ea4b1d7adbfab_appidapi.dll.mui_b6af37bb c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-acledit_31bf3856ad364e35_6.1.7600.16385_none_c3d671ef7642fced.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9d9222b9cac3adcd_aclui.dll.mui_adadbfb7 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_cc970e0c87e2bb88.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_b0ff4fc4cd57c163.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_17013cbdbd7efe45_advapi32.dll.mui_28c7718f c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3e80b31cc7dc75d0.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_es-es_53e89731b078cab8_sdbinst.exe.mui_258ad624 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7601.17514_de-de_ad5d781cbe6250e8_aelupsvc.dll.mui_5d6cb110 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-agpsettings_31bf3856ad364e35_6.1.7600.16385_none_cb02d84df678436e.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f6a00d30a34ae11a.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_82ed82846d97d873_sdbinst.exe.mui_258ad624 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7600.16385_none_3f3d4351a032bf57_advapi32.dll_9512793c c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_68a3391d007cd856_winmm.dll.mui_224f6445 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e7718915b6ba8195_authui.dll.mui_19b92789 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1641d14c740080f5.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7601.17514_es-es_87377835d7709369_acledit.dll.mui_5f932ccb c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7601.17514_none_703438df00e9e0d7.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_de-de_cb8d93e1dba7ea79.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_82ed82846d97d873.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dc4a3190eb7d1265.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_404998b8bd95c42f_aclui.dll.mui_adadbfb7 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_747e69daca85f63e.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c6bb35d9d79285b4_activeds.dll.mui_67414db4 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_shimeng.dll_2036b947 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_es-es_53e89731b078cab8_aelupsvc.dll.mui_5d6cb110 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_cc970e0c87e2bb88_aclui.dll.mui_adadbfb7 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7b478cfdf5bb71e8.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_apphelp.dll_7ce69c4a c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b98e60acbd094074_axinstui.exe.mui_aea34130 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_de-de_cb8d93e1dba7ea79_advapi32.dll.mui_28c7718f c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e92ea4b1d7adbfab.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c162de87050a6649.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e8934bff7a284e2f.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_es-es_53e89731b078cab8_apphelp.dll.mui_59096153 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf_axinstsv.dll.mui_be092a2d c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b98e60acbd094074_axinstsv.dll.mui_be092a2d c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f6a00d30a34ae11a_aelupsvc.dll.mui_5d6cb110 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_en-us_853b0789da5b1e2a_acledit.dll.mui_5f932ccb c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_641a5485f7dc7cab.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f067c9d9c2297404_hidserv.dll.mui_561adfc8 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_en-us_243862f6e4997dad.manifest c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee_activeds.tlb_662648dd c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 564 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exepid process 1100 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe 1100 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 276 vssvc.exe Token: SeRestorePrivilege 276 vssvc.exe Token: SeAuditPrivilege 276 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.execmd.exedescription pid process target process PID 1100 wrote to memory of 608 1100 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe cmd.exe PID 1100 wrote to memory of 608 1100 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe cmd.exe PID 1100 wrote to memory of 608 1100 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe cmd.exe PID 1100 wrote to memory of 608 1100 c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe cmd.exe PID 608 wrote to memory of 564 608 cmd.exe vssadmin.exe PID 608 wrote to memory of 564 608 cmd.exe vssadmin.exe PID 608 wrote to memory of 564 608 cmd.exe vssadmin.exe PID 608 wrote to memory of 564 608 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe"C:\Users\Admin\AppData\Local\Temp\c4a7f8b8046a6623cd7909bacb1cbef13471a4efd8adb4aedbf7fc1377ab502d.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:564
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:276
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-55-0x0000000075421000-0x0000000075423000-memory.dmpFilesize
8KB
-
memory/1100-57-0x0000000002080000-0x000000000211F000-memory.dmpFilesize
636KB
-
memory/1100-58-0x0000000002220000-0x000000000234D000-memory.dmpFilesize
1.2MB
-
memory/1100-59-0x0000000000070000-0x000000000007A000-memory.dmpFilesize
40KB
-
memory/1100-61-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1100-60-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1100-62-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1100-63-0x00000000004D0000-0x00000000004EF000-memory.dmpFilesize
124KB
-
memory/1100-64-0x00000000025B0000-0x00000000026B9000-memory.dmpFilesize
1.0MB
-
memory/1100-65-0x0000000000270000-0x0000000000276000-memory.dmpFilesize
24KB