Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:14
Static task
static1
Behavioral task
behavioral1
Sample
b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe
Resource
win10-en-20211208
General
-
Target
b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe
-
Size
164KB
-
MD5
ba03ba79cc94a3987b0a479431a335e1
-
SHA1
1f61e3b72171e8328b698e1ae6c7e2f6d507d200
-
SHA256
b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c
-
SHA512
15fb435a013b95879fd5950418ead840098f1e496f8b5df7966ae2814850a21364302200ed7043d6d028f05d930c083e4f191e78e971bc9af49394f229cbebf5
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exedescription ioc process File opened (read-only) \??\Z: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\F: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\I: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\M: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\O: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\S: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\T: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\U: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\W: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\B: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\H: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\J: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\N: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\Q: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\X: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\E: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\G: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\P: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\Y: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\A: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\K: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\L: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\R: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened (read-only) \??\V: b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe -
Drops file in Windows directory 64 IoCs
Processes:
b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..rics-storageadapter_31bf3856ad364e35_6.1.7600.16385_none_329b3f476f0cd674.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76_osknumpadbase.xml_7f05a37a b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-session0viewer_31bf3856ad364e35_6.1.7600.16385_none_483083fb94bfc714.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-p..ndprintui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d2945884bb037beb_puiobj.dll.mui_b9c0c4d6 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b5fa959a738d6d74.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7601.17514_en-us_c342610ed289dc75_loadperf.dll.mui_f6faeae0 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..assdriver.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e5b6e09ea67fc5c8.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_981164b3f9ab2ac9.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_bg-bg_97b937009fa00cc6.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f5d83b1064d90ccb.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_he-il_c8da0f0005e7bf7a.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ba0c82eccf526351_rascfg.dll.mui_0b036e1f b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8b52ed91fe5d105f_authui.dll.mui_19b92789 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..anagement.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a79c1e9c7eb86252.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_347a450f0c8bd52d.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b9d7dfd0cf7954f6_ndptsp.tsp.mui_5bee9ce3 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-smartcardsubsystem_31bf3856ad364e35_6.1.7601.17514_none_76234513809272a3_scarddlg.dll_b3dbecec b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728_puiapi.dll_0bf3f842 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9a8171aceaed6fe4.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mountpointmanager_31bf3856ad364e35_6.1.7601.17514_none_50be2a351da54dd5_mountmgr.mof_7737198d b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-npfs_31bf3856ad364e35_6.1.7600.16385_none_02667684369c39b6_npfs.sys_e6c97a48 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_7019de43f9e3a677_prflbmsg.dll.mui_4caa0054 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_26cee700b53a673d_sdbinst.exe.mui_258ad624 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_es-es_182b2b3b124f76ad_advapi32.dll.mui_28c7718f b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..-microsoftyaheibold_31bf3856ad364e35_6.1.7600.16385_none_6aba850ecda3eb39_msyhbd.ttf_16e5cd4d b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76_main.xml_e4c2fcc8 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_sr-..-cs_2c1fb02935715739_msimsg.dll.mui_72e8994f b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_6.1.7601.17514_none_e2a1ffe0ca40cff2_recdisc.exe_20690b49 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..stringime.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_147b598d18c22af1.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-version_31bf3856ad364e35_6.1.7600.16385_none_70f340d66a96c29b_version.dll_406ddf44 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-qos_31bf3856ad364e35_6.1.7600.16385_none_14950489a5b66a85.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_en-us_291c6c0621fdacf4.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_de-de_79e8a243827e6f57_wudfsvc.dll.mui_e907fe77 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-efs-service.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4b5ad37c597b9f43_efssvc.dll.mui_03cc4e41 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6959b1ef4a72a285_ntmarta.dll.mui_027ef4fc b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-d..lient-dll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_accc80812c85f01f.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7601.17514_none_227e1c01642654f4_werdiagcontroller.dll_208f2db3 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4fbac3e2381c9426_sccls.dll.mui_f104be47 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76_ea-sym.xml_44c5096b b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-vssapi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e407da2adfde8551.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-security-spp.resources_31bf3856ad364e35_6.1.7600.16385_es-es_02dcefef85135596.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_abd5b433b8ccf7a4_cmisetup.dll_91548db0 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..lient-dll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_08eb1c04e4e36155.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7601.17514_en-us_c342610ed289dc75_unlodctr.exe.mui_53acc4d0 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..tional-codepage-863_31bf3856ad364e35_6.1.7600.16385_none_2addea58b4e20d54_c_863.nls_b83728a4 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a_rasadhlp.dll_7438be63 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_51bcbc61a5466a58_certenrollctrl.exe_9495aa75 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_07187ff0f42156ab_certcli.dll.mui_1b6822cf b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..anagement.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_33e993f0490559ab_powrprof.dll.mui_a2448a34 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..utoenroll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6e3ba8f78468edc8_pautoenr.dll.mui_9667d15f b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..eprotocol.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9f72475f89cffa63_irclass.dll.mui_c67cedc8 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-ntdll_31bf3856ad364e35_6.1.7601.17514_none_b6fce3b112cd3657_ntdll.dll_ae4ef39c b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b9d7dfd0cf7954f6.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496_setupapi.mof_8d9de59f b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8f1e1b0781b835e8_odbcjet.chm_2a003207 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-shdocvw.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1ea841b1ccb1284f_shdocvw.dll.mui_9b8f26d5 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-t..rk-msimtf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_13a4b4f67ddaf2e4.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_de-de_964af31d4c0ac434.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1107dcb1e9c5b5e5_mlang.dll.mui_2904864a b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_sk-sk_d539b488144eefb8.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-credui.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_06a50238f37ce6dd_credui.dll.mui_34721171 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7b478cfdf5bb71e8.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..tional-codepage-875_31bf3856ad364e35_6.1.7600.16385_none_2adebd12b4e159ed.manifest b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 876 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exepid process 808 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe 808 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1160 vssvc.exe Token: SeRestorePrivilege 1160 vssvc.exe Token: SeAuditPrivilege 1160 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.execmd.exedescription pid process target process PID 808 wrote to memory of 1736 808 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe cmd.exe PID 808 wrote to memory of 1736 808 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe cmd.exe PID 808 wrote to memory of 1736 808 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe cmd.exe PID 808 wrote to memory of 1736 808 b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe cmd.exe PID 1736 wrote to memory of 876 1736 cmd.exe vssadmin.exe PID 1736 wrote to memory of 876 1736 cmd.exe vssadmin.exe PID 1736 wrote to memory of 876 1736 cmd.exe vssadmin.exe PID 1736 wrote to memory of 876 1736 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe"C:\Users\Admin\AppData\Local\Temp\b82a70c7c55ef2b951666b320adcb684a66fb6c1ebe24b56d2cc51edca510f3c.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/808-54-0x00000000754B1000-0x00000000754B3000-memory.dmpFilesize
8KB
-
memory/808-56-0x00000000020D0000-0x000000000216F000-memory.dmpFilesize
636KB
-
memory/808-57-0x0000000002170000-0x000000000229D000-memory.dmpFilesize
1.2MB
-
memory/808-58-0x0000000001C30000-0x0000000001C4F000-memory.dmpFilesize
124KB
-
memory/808-59-0x0000000002540000-0x0000000002649000-memory.dmpFilesize
1.0MB
-
memory/808-61-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/808-63-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/808-64-0x00000000002C0000-0x00000000002C6000-memory.dmpFilesize
24KB
-
memory/808-62-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/808-60-0x00000000001B0000-0x00000000001BA000-memory.dmpFilesize
40KB