Analysis
-
max time kernel
140s -
max time network
24s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:18
Static task
static1
Behavioral task
behavioral1
Sample
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe
Resource
win10-en-20211208
General
-
Target
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe
-
Size
164KB
-
MD5
9935b34b16a93eb2ef874cfd4501cb7f
-
SHA1
4871435f17541c2c0cf01092bcd38d4869368a08
-
SHA256
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485
-
SHA512
55391e39d8096a7103851f8ca7de7de99866ceb66138728db736da8840bf17fdfac256638634d02a079beaacce36e0f7d117cef2109094921da2fe0c7f01804e
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exedescription ioc process File opened (read-only) \??\F: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\G: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\L: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\S: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\W: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\A: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\E: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\U: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\X: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\Y: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\B: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\M: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\N: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\O: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\P: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\R: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\K: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\I: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\J: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\Q: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\T: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\V: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\Z: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\H: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe -
Drops file in Windows directory 64 IoCs
Processes:
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-eventlog.resources_31bf3856ad364e35_6.1.7600.16385_de-de_510aeb40eba1fef7_wevtsvc.dll.mui_f41bf7b7 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-small_31bf3856ad364e35_6.1.7600.16385_none_d7839341959a2de0_smallf.fon_a2b4e504 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shfolder_31bf3856ad364e35_6.1.7600.16385_none_4b125fb438c5a314.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-uxtheme.resources_31bf3856ad364e35_6.1.7600.16385_es-es_71e04df1607dd9bf.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-netio-infrastructure_31bf3856ad364e35_6.1.7600.16385_none_bce508cf035f5001.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.17932_none_f1cc51dc6cfd0cbf.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17514_none_04709031736ac277_sspicli.dll_bcec1809 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shell32_31bf3856ad364e35_6.1.7601.17514_none_ca4f304d289b7800.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7600.16385_de-de_357580b015bbeb72_kernelbase.dll.mui_16288a65 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mssign32-dll.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_60506fa5482da36a_mssign32.dll.mui_d663578f af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_82ed82846d97d873_sdbinst.exe.mui_258ad624 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-kernel32.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_3b92880831ee8845_kernel32.dll.mui_c29170cd af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_6.1.7600.16385_en-us_354c8605d3d714f3_wiaservc.dll.mui_54051b53 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-xmllite_31bf3856ad364e35_6.1.7600.16385_none_e5307039bcff94de.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4730168dcf6e8468.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-d..lient-dll.resources_31bf3856ad364e35_6.1.7601.17514_en-us_57ee6a4218527f7e.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..tional-codepage-852_31bf3856ad364e35_6.1.7600.16385_none_cebe6552fc856926_c_852.nls_bb0fdbcc af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-rpc-local.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9b5d51a51f05b818.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-e..estorageengine-isam_31bf3856ad364e35_6.1.7601.17514_none_500a4c5042ab494a.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7871ea5b49da50fd_winload.efi.mui_35ee487d af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-cryptui-dll_31bf3856ad364e35_6.1.7601.17514_none_e41460cdaec2dd58.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-sens-service.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a0071dddf8fc3cd7.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..-msctfime.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4725641a6a4489b7.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3d8bb37f97ba22ff_apphelp.dll_7ce69c4a af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_42c2ad9b8d27e8f1_mlang.dll.mui_2904864a af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-usermodensi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_deaa3f2f341fcff5_nsisvc.dll.mui_237a741f af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c_bootmgfw.efi.mui_a6e78cfa af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_sr-..-cs_e977d49ab747fe93_comctl32.dll.mui_0da4e682 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..ional-codepage-1254_31bf3856ad364e35_6.1.7600.16385_none_22d533776b0da1a5.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..ineclient.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7b614a5dfbb391be.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..eservices.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d92dea821b79a3bd_sti.dll.mui_00a4f15b af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_6.1.7600.16385_none_70644a8bdb0d9303_cga80852.fon_2e7ddfad af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da_cmiv2.dll_be06aa9f af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76_oskmenu.xml_6983d9ef af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..installer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_755f24abe639fb46_sti_ci.dll.mui_f0a16278 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.17514_none_da3cb85562df73c9.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-d..irectdraw.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_110e6e4fc133c766_ddraw.dll.mui_95b8c3ab af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-t..s-runtime.resources_31bf3856ad364e35_6.1.7600.16385_es-es_05ec1f5c78932466.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_es-es_62cfb8af00872165.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_015df3e3bafadc7a_winresume.efi.mui_f412814e af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a125df51245f3df3.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7600.16385_de-de_227521a01b1e0f11_perfhost.exe.mui_2046145e af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_zh-tw_08ca9d4159f2a9bf_msimsg.dll.mui_72e8994f af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..-truetype-gishabold_31bf3856ad364e35_6.1.7600.16385_none_f50009547b049b77.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f26f103cfb71516a_webclnt.dll.mui_e8f04040 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_015df3e3bafadc7a_winload.efi.mui_35ee487d af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4008824c98f8edac_dnsapi.dll_c81f5791 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-ebrima_31bf3856ad364e35_6.1.7600.16385_none_2a70c05575ba0bb8.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e202f15f2ca6a82a.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6ace9e67456cc40b_winsockhc.dll_817ccaf3 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_ce00766f323410b7_comctl32.dll.mui_0da4e682 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-winbio.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_3e33ece83f8d9a01_winbio.dll.mui_7a8d17bd af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7601.17514_none_d527b0a5438b8346_umpnpmgr.mof_112f9e6c af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b5c5f27e73b45f19_adtschema.dll.mui_208d0981 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3d8bb37f97ba22ff_sdbinst.exe_8725e339 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7601.17514_none_124dc839a586a988_fontsub.dll_367a1189 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-crypt32-dll.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_fccd7be8d8e00970.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-keyiso.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ace42a47c85d5097_keyiso.dll.mui_4bbf12ff af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7075301659287d94.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_dd93fd1708b38fd5_mofcomp.exe.mui_35badf56 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-smartcardksp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06eae3639ce15ec1.manifest af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-msasn1_31bf3856ad364e35_6.1.7601.17514_none_25801b39bc00ed6c_msasn1.dll_e56dbc57 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-null_31bf3856ad364e35_6.1.7600.16385_none_055adf2434ae116e_null.sys_e821cef0 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 996 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exepid process 1596 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1824 vssvc.exe Token: SeRestorePrivilege 1824 vssvc.exe Token: SeAuditPrivilege 1824 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.execmd.exedescription pid process target process PID 1596 wrote to memory of 1400 1596 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe cmd.exe PID 1596 wrote to memory of 1400 1596 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe cmd.exe PID 1596 wrote to memory of 1400 1596 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe cmd.exe PID 1596 wrote to memory of 1400 1596 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe cmd.exe PID 1400 wrote to memory of 996 1400 cmd.exe vssadmin.exe PID 1400 wrote to memory of 996 1400 cmd.exe vssadmin.exe PID 1400 wrote to memory of 996 1400 cmd.exe vssadmin.exe PID 1400 wrote to memory of 996 1400 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe"C:\Users\Admin\AppData\Local\Temp\af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1596-54-0x0000000076001000-0x0000000076003000-memory.dmpFilesize
8KB