Analysis
-
max time kernel
146s -
max time network
161s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:21
Static task
static1
Behavioral task
behavioral1
Sample
aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe
Resource
win10-en-20211208
General
-
Target
aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe
-
Size
157KB
-
MD5
38cb49969742420b4e2e95e480381dc5
-
SHA1
ddd0ad81d38cf1087c8905937547cda9458085cb
-
SHA256
aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1
-
SHA512
28736a9622627dbded980bde3a9994dd410cdf358d54333bb154db84662ee5df87e1c8a7b9d1a5d845dad74aa706a3b1848ca45dd826df53ffb6f7daedc9a49d
Malware Config
Extracted
C:\Recovery\3d6rs23-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/164BA2FE1EEE3CED
http://decryptor.top/164BA2FE1EEE3CED
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exedescription ioc process File renamed C:\Users\Admin\Pictures\MountGrant.raw => C:\Users\Admin\Pictures\MountGrant.raw.3d6rs23 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File renamed C:\Users\Admin\Pictures\StopSet.tiff => C:\Users\Admin\Pictures\StopSet.tiff.3d6rs23 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File renamed C:\Users\Admin\Pictures\UnblockExit.tif => C:\Users\Admin\Pictures\UnblockExit.tif.3d6rs23 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File renamed C:\Users\Admin\Pictures\UpdateGet.tiff => C:\Users\Admin\Pictures\UpdateGet.tiff.3d6rs23 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Users\Admin\Pictures\UpdateGet.tiff aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File renamed C:\Users\Admin\Pictures\ExpandGet.png => C:\Users\Admin\Pictures\ExpandGet.png.3d6rs23 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File renamed C:\Users\Admin\Pictures\PushUnregister.raw => C:\Users\Admin\Pictures\PushUnregister.raw.3d6rs23 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File renamed C:\Users\Admin\Pictures\ShowGrant.tiff => C:\Users\Admin\Pictures\ShowGrant.tiff.3d6rs23 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Users\Admin\Pictures\ShowGrant.tiff aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Users\Admin\Pictures\StopSet.tiff aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exedescription ioc process File opened (read-only) \??\O: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\V: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\X: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\A: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\G: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\H: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\M: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\S: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\U: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\W: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\Y: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\F: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\J: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\Q: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\R: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\Z: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\T: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\B: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\E: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\I: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\K: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\L: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\N: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\P: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened (read-only) \??\D: aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\19v216r12m8x.bmp" aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe -
Drops file in Windows directory 64 IoCs
Processes:
aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_698ac5bc9a8c1572.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..entication-usermode_31bf3856ad364e35_6.1.7600.16385_none_39f81956d5a8018f.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_68d891dc840c463a_setupapi.dll.mui_bcc172a4 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c42c8a2303da16f1_ndptsp.tsp.mui_5bee9ce3 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-win32k.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b379b64eac772036.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..endencies.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aa60e56750ed0f15.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_lt-lt_d8a56adb99152caa_comctl32.dll.mui_0da4e682 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8_bootmgr.efi.mui_be5d0075 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_zh-tw_ac9edb6e6b20299f.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..ltinstall.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0c9d0a808b71e7c0_infdefaultinstall.exe.mui_ea4c5b8c aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-f..temutilitylibraries_31bf3856ad364e35_6.1.7601.17514_none_eb9dc1c34def72a3.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4008824c98f8edac_dnsapi.dll_c81f5791 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_sr-..-cs_690f4f26ec911a81.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..libraries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0739be3de62b2c98.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..tional-codepage-865_31bf3856ad364e35_6.1.7600.16385_none_cebf2144fc84cf60_c_865.nls_b283c1d6 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-ole-automation_31bf3856ad364e35_6.1.7601.17514_none_257ada4f467a7f64_oleaut32.dll_730e3d41 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_82dac7a36bd74688.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_bg-bg_fe9dd62ff9adc95e_comdlg32.dll.mui_ac8e62f4 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_bg-bg_d05ef37bdb11d344_comctl32.dll.mui_0da4e682 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-gdi32_31bf3856ad364e35_6.1.7601.17514_none_b7a4af6b5ff115ac_gdi32.dll_1f014d57 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-spp-main.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1caa2c287378295b_spp.dll.mui_42138158 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-events_31bf3856ad364e35_6.1.7600.16385_none_0c4ed7b1a5ec567a.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_88118c849810bde8.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-d2d_31bf3856ad364e35_7.1.7601.16492_none_9abc61e3455c511e.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..eservices.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7bb0bd650e72abc4.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..entication-usermode_31bf3856ad364e35_6.1.7600.16385_none_9616b4da8e0572c5.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_6.1.7601.17514_de-de_f333274052deb889.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..ure-other.resources_31bf3856ad364e35_6.1.7600.16385_en-us_09d25d5db275f73d_wshelper.dll.mui_be261ecd aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-e..sam-win2k.resources_31bf3856ad364e35_6.1.7600.16385_en-us_278079a6bd283e55.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..ure-ws232.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3cb61b2fa392838e_ws2_32.dll.mui_f13ef3a5 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_sv-se_8a63f7a6bd8df93f.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-riched32_31bf3856ad364e35_6.1.7601.17514_none_fb26b945993b2f11.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4fbac3e2381c9426_sccls.dll.mui_f104be47 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ca302e6ca7955c8f.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-halftone-ui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_69d35b8da4b97527.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_6.1.7601.17514_none_09ee9e0dfa2c4fbd_dxgkrnl.sys_8aad3dfb aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4173873612663c97_aclui.dll.mui_adadbfb7 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..pp-client.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_67f0b62b00a7235a_sppc.dll.mui_0a75786d aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mfc42x.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c1197d6e9baee0fb.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-riched32_31bf3856ad364e35_6.1.7601.17514_none_fb26b945993b2f11_riched20.dll_fb578f95 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.5.7601.17514_fr-fr_172b5419eddfc893_wuaueng.dll.mui_297f975d aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ed8efda96cda0b2d_comctl32.dll.mui_0da4e682 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_c13cbb631bb77948_comctl32.dll.mui_0da4e682 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.1.7601.17514_none_35802f0f452f59bb.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_6.1.7600.16385_none_db04d3f548508fd9.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_6.1.7600.16385_none_70644a8bdb0d9303.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_7019de43f9e3a677_prflbmsg.dll.mui_4caa0054 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-ntvdm-vdmdbg_31bf3856ad364e35_6.1.7600.16385_none_4ea374e2e5067833_vdmdbg.dll_232a4cf0 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_fc675397c4309dd0_perfhost.exe.mui_2046145e aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-smartcardksp.resources_31bf3856ad364e35_6.1.7600.16385_es-es_06b640479d085066.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dfsclient_31bf3856ad364e35_6.1.7601.17514_none_e5c0334cfcbb6f1f.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-ldap-client_31bf3856ad364e35_6.1.7601.17514_none_51624d066d0b3e1c_wldap32.dll_09c99dc1 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0d09bfa184af61af_msaudite.dll.mui_dc90ce41 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e2c7a09849a324b2.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-win32k.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d829f74f35356bf6.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f52607304e593d93.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_664de2048e0b97ed_wiaservc.dll.mui_54051b53 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-dui70_31bf3856ad364e35_6.1.7600.16385_none_578b05f45f6e5c68.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_341a55f41ef1be52_modemui.dll.mui_a710bc71 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-p..ndprintui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d2945884bb037beb.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-htmlhelp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1143384e9ab8e550.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang_31bf3856ad364e35_6.1.7600.16385_none_b2d43d1ffdaf54e6_mlang.dat_211debd0 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..ng-spooler-splwow64_31bf3856ad364e35_6.1.7601.17514_none_25d05769a8973724.manifest aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a_rasautou.exe_477abe34 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 316 vssadmin.exe -
Processes:
aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\SystemCertificates\CA\Certificates\4C27431717565A3A07F3E6D0032C4258949CF9EC aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\SystemCertificates\CA\Certificates\4C27431717565A3A07F3E6D0032C4258949CF9EC\Blob = 0300000001000000140000004c27431717565a3a07f3e6d0032c4258949cf9ec140000000100000014000000f5cdd53c0850f96a4f3ab797da5683e669d268f7040000000100000010000000342e1e02d91852d4a66f8a892167c8fa0f0000000100000020000000a2de33490c476d356e2dbc737c2779692249526b65ab8fba9a34280481c8bdfc19000000010000001000000014b989b317682449c76eb3c21dac16e7180000000100000010000000a823b4a20180beb460cab955c24d7e212000000001000000510400003082044d30820335a003020102020b040000000001444ef03631300d06092a864886f70d01010b05003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3134303232303130303030305a170d3234303232303130303030305a304c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613122302006035504031319416c70686153534c204341202d20534841323536202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100da01ece4ec7360fb7e8f6ab7c617e3926432d4ac00d9a20fb9edee6b8a86ca9267d974d75d47023c8f40d69e6d14cdc3da2939a70f050a68a2661a1ec4b28b7658e5ab5d1d8f40b3398bef1e837d22d0e3a9002eec53cf62198544284cc027cb7b0eec10640010a405cca072be416c315b48e4b1ecb923eb554dd07d624aa5b4a5a45985c52591a6fea6099f06106d8f810c64405e73009ae02e65985410007098c8e1ed345fd89cc70dc0d6235945fcfe557a86ee946022f1aed1e65546f699c51b08745facb064848f89381ca1a790214f026ebde06167d4f842870f0af7c9046d2aa92fef42a5dfdda353db981e81f99a727b5ade4f3e7fa258a0e217ad670203010001a38201233082011f300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020100301d0603551d0e04160414f5cdd53c0850f96a4f3ab797da5683e669d268f730450603551d20043e303c303a0604551d20003032303006082b06010505070201162468747470733a2f2f7777772e616c70686173736c2e636f6d2f7265706f7369746f72792f30330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742e63726c303d06082b060105050701010431302f302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747231301f0603551d23041830168014607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010b050003820101006040681647e7168ddb5ca1562acbf45c9bb01ea24bf5cb023ff80ba1f2a742d4b74cebe36680f32543782e1b1756075218cbd1a8ece6fb733ea4628c80b4d2c51273a3d3fa0238be633d84b899c1f1baf79fc340d1581853c162ddaf18427f344ec543d571b03000c7e390ae3f578697ceea0c128e2270e366a7547f2e28cbd454d0b31e626708f927e1cbe366b8241b896a894465f2d94cd2581c8c4ec095a1d4ef672f3820e82eff9651f0bad83d927047651c9e7372b4600c5ce2d17376e0af4ee2e537a5452f8a233e87c730e631387cf4dd52caf353042557566694e80beee603144eeefd6d94649e5ece79d4b2a6cf40b144a83e87195ee9f821165953 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exepid process 964 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1560 vssvc.exe Token: SeRestorePrivilege 1560 vssvc.exe Token: SeAuditPrivilege 1560 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.execmd.exedescription pid process target process PID 964 wrote to memory of 1576 964 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe cmd.exe PID 964 wrote to memory of 1576 964 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe cmd.exe PID 964 wrote to memory of 1576 964 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe cmd.exe PID 964 wrote to memory of 1576 964 aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe cmd.exe PID 1576 wrote to memory of 316 1576 cmd.exe vssadmin.exe PID 1576 wrote to memory of 316 1576 cmd.exe vssadmin.exe PID 1576 wrote to memory of 316 1576 cmd.exe vssadmin.exe PID 1576 wrote to memory of 316 1576 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe"C:\Users\Admin\AppData\Local\Temp\aaa87a7dea32059d3db813bdec307042c5961ba1b52e8b1e2fd3a599fe731eb1.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/964-54-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB