Analysis
-
max time kernel
129s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:25
Static task
static1
Behavioral task
behavioral1
Sample
a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe
Resource
win10-en-20211208
General
-
Target
a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe
-
Size
161KB
-
MD5
b80cbbee9676aa8c647066a2e97e1d0f
-
SHA1
d0aad84d055b90a05a62319255830d55e03777ba
-
SHA256
a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d
-
SHA512
75529d67f6ed75eed241342832dede9f17825dce4d20a0ea5178ad329e6b1c594d4364a3899050d3df7b14e9b507f7be5dc08c455c883015f89e6d58488c31b8
Malware Config
Extracted
C:\god22u74-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/63AC71E720D21D0D
http://decryptor.top/63AC71E720D21D0D
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exedescription ioc process File renamed C:\Users\Admin\Pictures\InvokeUnblock.tif => \??\c:\users\admin\pictures\InvokeUnblock.tif.god22u74 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File renamed C:\Users\Admin\Pictures\RevokeEnter.tif => \??\c:\users\admin\pictures\RevokeEnter.tif.god22u74 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exedescription ioc process File opened (read-only) \??\Y: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\Z: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\A: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\F: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\N: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\U: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\V: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\X: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\D: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\G: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\L: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\Q: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\T: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\W: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\H: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\K: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\O: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\P: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\R: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\S: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\B: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\E: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\I: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\J: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened (read-only) \??\M: a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iq9o19e5t1.bmp" a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe -
Drops file in Program Files directory 20 IoCs
Processes:
a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exedescription ioc process File created \??\c:\program files (x86)\microsoft sql server compact edition\god22u74-readme.txt a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\god22u74-readme.txt a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\ClearStep.docm a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\DismountDisable.wax a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\ExitAdd.midi a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\SyncExit.wma a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\RemoveStop.mpeg2 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\DenyDisconnect.midi a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\ReceiveEnable.vsdm a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\RedoDebug.xlsx a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\ResolveOpen.wdp a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\AssertResume.gif a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\ConvertToRead.vsd a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\ConvertToTrace.wmf a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\DebugUnlock.odp a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\god22u74-readme.txt a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File created \??\c:\program files\god22u74-readme.txt a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File created \??\c:\program files (x86)\god22u74-readme.txt a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\InitializeEnable.ttc a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification \??\c:\program files\MergeInitialize.php a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe -
Drops file in Windows directory 64 IoCs
Processes:
a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-winsock-core.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a7a90ee6983e9333_afd.sys.mui_ff192075 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3b112a3415ba87ce.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-d..lient-dll.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f840295d0e5d03eb_dhcpcsvc.dll.mui_186571e1 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_65c533f1c582e47c_lodctr.exe.mui_4ac7d1a1 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_de-de_16322155c9df9531.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..tional-codepage-708_31bf3856ad364e35_6.1.7600.16385_none_2ae246a0b4dfd97e_c_708.nls_a9f9a85e a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5514f8211751b1ec.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-security-spp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0311930b84ec63f1.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f7fe9ec9f7f467dd_apphelp.dll.mui_59096153 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-transactionmanagerapi_31bf3856ad364e35_6.1.7600.16385_none_56ada62f354bb10e.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_en-us_22d9783c715c7b1c_wudfx.mfl_ed9a43c5 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..owmanager.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_34be759892c77101_dwmapi.dll.mui_2fc614a7 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd_bootmgfw.efi.mui_a6e78cfa a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-e..gine-isam.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c799dc868f03eac0_esent.dll.mui_e30e3b90 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_6.1.7600.16385_none_59590e92c817a4e0_vga869.fon_09ec4cfe a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..ndprintui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d16a6a0766330383_printui.exe.mui_5e66aade a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9162dff52c1fa7f0_modemui.dll.mui_a710bc71 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a34eb21187cbf59e_advapi32.dll.mui_28c7718f a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c0efc2e183d1cad0.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-cryptdll-dll_31bf3856ad364e35_6.1.7600.16385_none_0574dc0a0f190696_cryptdll.dll_e0da7eac a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_6.1.7600.16385_de-de_099b02651e31eb2c_iscsidsc.dll.mui_6acb64a6 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-x..ificateenrollmentui_31bf3856ad364e35_6.1.7600.16385_none_2a47a0022a1c5b6c_certenrollui.dll_7114147c a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-commonlog_31bf3856ad364e35_6.1.7600.16385_none_da778c54413d0c9c_clfs.sys_04dfdff9 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_1ea06bbff56ef9c1.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_fdd0e869f380cdab_ndadmin.exe.mui_2e106c3e a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_347a450f0c8bd52d.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-i..onal-keyboard-kbdus_31bf3856ad364e35_6.1.7601.17514_none_e72ccbf15f92e33c.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_59428066df58b3cd_memtest.exe.mui_77b8cbcc a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-usermodensi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3c276c4c4126c7ee.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1641d14c740080f5.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-eventlog.resources_31bf3856ad364e35_6.1.7600.16385_de-de_510aeb40eba1fef7.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-msxml60.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d40b16d89404e928_msxml6r.dll.mui_4516d602 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7601.17514_en-us_cd970b6106ea9e70.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_58531de323d90bc5.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_cs-cz_05c5e84e9f9316bf_comdlg32.dll.mui_ac8e62f4 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_6.1.7600.16385_none_70644a8bdb0d9303_cga80woa.fon_40965299 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..irectdraw.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6d2d09d37991389c_ddraw.dll.mui_95b8c3ab a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a30b50d594956ddd.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_6.1.7600.16385_none_2cb0f5602bedb50f_segoeuil.ttf_ea38f4ef a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7601.17514_none_07f91de77125e78d_atmfd.dll_ff796bf0 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mfc42x.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1e96aa8ba8b5d8f4.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_6.1.7600.16385_de-de_2e452ff3e70e56b2.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7871ea5b49da50fd_winload.efi.mui_35ee487d a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-credui.resources_31bf3856ad364e35_6.1.7601.17514_en-us_c040cad9b8e1500c_credui.dll.mui_34721171 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_lt-lt_bf2eaae65ee1141a_msimsg.dll.mui_72e8994f a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..ional-codepage-1252_31bf3856ad364e35_6.1.7600.16385_none_21f2251b6b9f9897_c_1252.nls_71b281ed a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-sxssrv_31bf3856ad364e35_6.1.7600.16385_none_bc7acb14d0edfca2.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-vssapi_31bf3856ad364e35_6.1.7601.17514_none_330ce3bf9861358f_75dfb225-e2e4-4d39-9ac9-ffaff65ddf06.xml_e6426aa8 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17514_none_04709031736ac277_cng.sys_050526ad a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-winbio.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9b7c76e94cbb839f.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2f58c6295ee26536.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-hbaapi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ec933d4f7ddcc091.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3d8bb37f97ba22ff_apphelp.dll_7ce69c4a a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-e..sam-win2k.resources_31bf3856ad364e35_6.1.7600.16385_es-es_274bd68abd4f2ffa.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..ruetype-new_tai_lue_31bf3856ad364e35_6.1.7600.16385_none_325f57c8c0ee36a8.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-gautami_31bf3856ad364e35_6.1.7600.16385_none_d7a960cbb5ebb166_gautamib.ttf_eba5f98c a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..ty-protectedstorage_31bf3856ad364e35_6.1.7600.16385_none_a43e06414a0fcb4b_pstorec.dll_b3635d22 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496_setupapi.mof_8d9de59f a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ac02e909516f7d8b_bootmgr.exe.mui_c434701f a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_e24a7886a9947ebf.manifest a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7002897809b71b0c_dnsapi.dll.mui_97465f8a a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4a4b188d86270b21_consent.exe.mui_2eb3b9db a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1c8666cba19c26e1_serialui.dll.mui_7d29d2a3 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_en-us_30bc7fe1e159c5d3_wmiapres.dll.mui_c1b8803f a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 708 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exepid process 1096 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1228 vssvc.exe Token: SeRestorePrivilege 1228 vssvc.exe Token: SeAuditPrivilege 1228 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.execmd.exedescription pid process target process PID 1096 wrote to memory of 848 1096 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe cmd.exe PID 1096 wrote to memory of 848 1096 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe cmd.exe PID 1096 wrote to memory of 848 1096 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe cmd.exe PID 1096 wrote to memory of 848 1096 a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe cmd.exe PID 848 wrote to memory of 708 848 cmd.exe vssadmin.exe PID 848 wrote to memory of 708 848 cmd.exe vssadmin.exe PID 848 wrote to memory of 708 848 cmd.exe vssadmin.exe PID 848 wrote to memory of 708 848 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe"C:\Users\Admin\AppData\Local\Temp\a3f077a4c29c522d9d70e3b22778c5a07239b6949562b37617e5ac913843076d.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:708
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1228
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-54-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB