Analysis
-
max time kernel
132s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe
Resource
win10-en-20211208
General
-
Target
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe
-
Size
161KB
-
MD5
70de91644acaf42fdc6a946548f89c02
-
SHA1
595c965cf5aca5047ccdd939a5626451d6703e19
-
SHA256
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332
-
SHA512
cc80c0fdd4f83f774785dce0f1830fd85da6a68504b811d794c2f257350680901ff29335ba2ca40f476682576b026849e6c95ab6ec5eb04fb6ae8aa3a4b5cf21
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exedescription ioc process File opened (read-only) \??\F: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\H: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\Y: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\M: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\O: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\P: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\S: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\A: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\B: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\K: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\L: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\Z: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\V: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\W: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\X: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\E: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\G: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\I: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\T: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\U: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\J: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\N: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\Q: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\R: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe -
Drops file in Windows directory 64 IoCs
Processes:
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-profsvc_31bf3856ad364e35_6.1.7601.17514_none_59d75cdc494c95ea.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-kernelbase_31bf3856ad364e35_6.1.7601.17932_none_8f658f40ffa656a6.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..endencies.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aa95888350c61d70.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-o..inefiles-win32-apis_31bf3856ad364e35_6.1.7601.17514_none_ad7263bc576752fb.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-installer-handler_31bf3856ad364e35_6.1.7600.16385_none_3acf7ac36580942c.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_sl-si_c985d2947338b739_mlang.dll.mui_2904864a a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-o..iles-core.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b6b4d0ce04c0bca3.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-uiribbon_31bf3856ad364e35_6.1.7601.17514_none_db578bdb5e3559c6.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_20f45663f3f88da5_bootmgr.exe.mui_c434701f a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-webservices.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0e8d75c5d7938376_webservices.dll.mui_eecc809d a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd_ole32.dll.mui_5035d60a a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-halftone-ui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6eae29ee4c1be3c7.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_es-es_cecbfd173661bff0_newdev.exe.mui_6ce4084e a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7e8b0c18f5629386_scardsvr.dll.mui_5f6fb64f a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_networking-mpssvc-svc_31bf3856ad364e35_6.1.7601.17514_none_f83a40e7de7c47da_wfapigp.mof_4a1027ba a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5ad8e52591f53bae_oleres.dll.mui_ff00d4cb a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-irdacoreprotocol_31bf3856ad364e35_6.1.7601.17514_none_ea0c02c127ba16bc_irclass.dll_dbffa295 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_6.1.7600.16385_none_70644a8bdb0d9303_dosapp.fon_f239c304 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..-truetype-wingdings_31bf3856ad364e35_6.1.7600.16385_none_85208756a65ef4ea.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_lv-lv_63d057976f8cd4ea_comdlg32.dll.mui_ac8e62f4 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hr-hr_a77de2d787af8188.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_68d891dc840c463a_setupapi.dll.mui_bcc172a4 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-version_31bf3856ad364e35_6.1.7600.16385_none_70f340d66a96c29b.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_es-es_48f4b6ddbd2973ac_msimsg.dll.mui_72e8994f a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c78acb1f45d20ec5_iscsiprf.mfl_24c6459c a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-rasserver.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1d9a3d4c1087f948_rtm.dll.mui_55e4e990 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-sens-service.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_43e8825a409ecba1.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_zh-hk_a74d96a66e8abfbf.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..ltinstall.resources_31bf3856ad364e35_6.1.7600.16385_de-de_63e0d7a39c6cea56.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasserver_31bf3856ad364e35_6.1.7601.17514_none_09cf3ec67e6c6b50_rasrqs-repl.man_b28d8556 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_6.1.7601.17514_none_2b566299338d2123.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..em-core-classdriver_31bf3856ad364e35_6.1.7600.16385_none_8bf97498085ce154_modem.sys_10d2ecc1 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..erservice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4c87c53cabac759d.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d33f52c4d452cdda_winmgmtr.dll.mui_741bfb68 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-e..e-library.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_41105aa8322922d2.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_eb7357d6e70b38e1_listsvc.dll.mui_27f0fc85 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c9f12eb68eff5150_newdev.dll.mui_914efc6c a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..temclient.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7497a71c57e547ec_winscard.dll.mui_4a82d97e a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-t..s-runtime.resources_31bf3856ad364e35_6.1.7600.16385_es-es_05ec1f5c78932466.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-imageres.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1e4defe6035a694f_imageres.dll.mui_3e41dee6 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-credui.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_92f2778cbdc9de36.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-d..irectdraw.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c59ac573df5cb39a_ddraw.dll.mui_95b8c3ab a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-international-core_31bf3856ad364e35_6.1.7601.17514_none_ebb1ce7438031941_muiunattend.exe_1e11bb40 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1820774de6bd4d16_perfi.dat_e3a35ecf a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_6.1.7600.16385_de-de_84c970b54d5773ed_odbcinst.chm_608e33e2 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bb8769138813077_netlogon.dll.mui_ecbeb9bd a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-xmllite_31bf3856ad364e35_6.1.7600.16385_none_e5307039bcff94de_xmllite.dll_ce078c31 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-usermodensi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3c276c4c4126c7ee.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-irdacoreprotocol_31bf3856ad364e35_6.1.7601.17514_none_462a9e44e01787f2_irclass.dll_dbffa295 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_en-us_63045bcb00602fc0_wship6.dll.mui_1cca9bd8 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-fat_31bf3856ad364e35_6.1.7600.16385_none_0aa81d2771152f86_fastfat.sys_0ffee946 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9f45784d166e7cf4_samsrv.dll.mui_32250491 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-gautami_31bf3856ad364e35_6.1.7600.16385_none_d7a960cbb5ebb166.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang_31bf3856ad364e35_6.1.7600.16385_none_b2d43d1ffdaf54e6_mlang.dat_211debd0 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_de-de_260fca3a475cc286.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_c0d17ceadf33e739_comctl32.dll.mui_0da4e682 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..pp-client.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_67f0b62b00a7235a_sppc.dll.mui_0a75786d a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-acproxy_31bf3856ad364e35_6.1.7600.16385_none_520444733f7b8add_acproxy.dll_5d65b262 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_6.1.7600.16385_none_70644a8bdb0d9303_app949.fon_e898de78 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mprmsg.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_83579b73da6c0c21_mprmsg.dll.mui_210d8c31 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-webservices.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6a776e2d9017e651.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-e..orerframe.resources_31bf3856ad364e35_6.1.7600.16385_en-us_af6da22a0c53ab14.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76_osknumpad.xml_a0b2cdc5 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.5.7601.17514_ja-jp_a378c96db82cbfec.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 980 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exepid process 1556 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 272 vssvc.exe Token: SeRestorePrivilege 272 vssvc.exe Token: SeAuditPrivilege 272 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.execmd.exedescription pid process target process PID 1556 wrote to memory of 572 1556 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe cmd.exe PID 1556 wrote to memory of 572 1556 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe cmd.exe PID 1556 wrote to memory of 572 1556 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe cmd.exe PID 1556 wrote to memory of 572 1556 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe cmd.exe PID 572 wrote to memory of 980 572 cmd.exe vssadmin.exe PID 572 wrote to memory of 980 572 cmd.exe vssadmin.exe PID 572 wrote to memory of 980 572 cmd.exe vssadmin.exe PID 572 wrote to memory of 980 572 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe"C:\Users\Admin\AppData\Local\Temp\a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1556-55-0x00000000756C1000-0x00000000756C3000-memory.dmpFilesize
8KB