Analysis
-
max time kernel
177s -
max time network
191s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe
Resource
win10-en-20211208
General
-
Target
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe
-
Size
161KB
-
MD5
70de91644acaf42fdc6a946548f89c02
-
SHA1
595c965cf5aca5047ccdd939a5626451d6703e19
-
SHA256
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332
-
SHA512
cc80c0fdd4f83f774785dce0f1830fd85da6a68504b811d794c2f257350680901ff29335ba2ca40f476682576b026849e6c95ab6ec5eb04fb6ae8aa3a4b5cf21
Malware Config
Extracted
C:\un677k-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1854ECB909B9C73B
http://decryptor.top/1854ECB909B9C73B
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exedescription ioc process File renamed C:\Users\Admin\Pictures\BackupUnpublish.raw => \??\c:\users\admin\pictures\BackupUnpublish.raw.un677k a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File renamed C:\Users\Admin\Pictures\CompareFind.crw => \??\c:\users\admin\pictures\CompareFind.crw.un677k a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File renamed C:\Users\Admin\Pictures\PopStart.png => \??\c:\users\admin\pictures\PopStart.png.un677k a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File renamed C:\Users\Admin\Pictures\SelectUnlock.tif => \??\c:\users\admin\pictures\SelectUnlock.tif.un677k a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File renamed C:\Users\Admin\Pictures\StepRestart.raw => \??\c:\users\admin\pictures\StepRestart.raw.un677k a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File renamed C:\Users\Admin\Pictures\UninstallEnable.png => \??\c:\users\admin\pictures\UninstallEnable.png.un677k a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exedescription ioc process File opened (read-only) \??\Q: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\V: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\D: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\L: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\M: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\N: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\W: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\A: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\I: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\J: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\R: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\S: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\T: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\U: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\X: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\Z: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\B: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\E: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\F: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\G: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\H: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\K: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\O: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\P: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened (read-only) \??\Y: a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe -
Drops file in Program Files directory 16 IoCs
Processes:
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exedescription ioc process File opened for modification \??\c:\program files\DebugRename.txt a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\MountSet.odt a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\NewWatch.ini a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\ReadUnregister.otf a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File created \??\c:\program files\un677k-readme.txt a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\ConvertToDisable.svgz a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\RestartCopy.doc a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\UnpublishUse.wma a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File created \??\c:\program files (x86)\un677k-readme.txt a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\ImportConfirm.jpg a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\InitializeComplete.aifc a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\PopEnable.wma a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\PublishExpand.AAC a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\RequestRemove.mhtml a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\StopComplete.avi a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification \??\c:\program files\WaitClose.xhtml a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe -
Drops file in Windows directory 64 IoCs
Processes:
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.15063.0_es-es_4709bf20e5d06fd6.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_760eaa73a2ef7d91_appidsvc.dll.mui_6717e231 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_en-us_04d9ab74573a46e7_scarddlg.dll.mui_300ae9df a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.15063.0_none_8375fc1900429a0a_nsiproxy.sys_ebb6a83d a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_zh-tw_37f9af358af4f949.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_pt-pt_ca7b368a2ffe3d38.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_8514fixe.fon_f66366a7 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_fi-fi_71383c7ced7c7587_memtest.exe.mui_77b8cbcc a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_85s1256.fon_3e26940d a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..onmanager.resources_31bf3856ad364e35_10.0.15063.0_de-de_664ec8e39496fef5_partmgr.sys.mui_b800c491 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_es-es_8c204a62f53106dd_mprdim.dll.mui_11b5ef08 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_7fd92574f8ebc00c_netiougc.exe.mui_ad7a9e4d a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_42611468c1164d2f_sdbinst.exe.mui_258ad624 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.15063.0_es-es_6ead483edc26f335.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-hardware-policy_31bf3856ad364e35_10.0.15063.0_none_13342771e2a38a67_hwpolicy.sys_e58c38aa a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..ne-client-overrides_31bf3856ad364e35_10.0.15063.0_none_43849a6a5b3b562b_power.energyestimationengine.storage.ppkg_960e5b21 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smbminirdr_31bf3856ad364e35_10.0.15063.0_none_90a5466e89ec288b_mrxsmb.sys_cf1a02fc a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-c..temminpnp.resources_31bf3856ad364e35_10.0.15063.0_es-es_a6b4da38ff64cc74.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_el-gr_d41c5f0ba6999f90.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_de-de_e3641786062c0973_mprdim.dll.mui_11b5ef08 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shacct-profile_31bf3856ad364e35_10.0.15063.0_none_bb57d0370769d62e.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shsvcs.resources_31bf3856ad364e35_10.0.15063.0_en-us_a9002bc219171b71.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-etw-ese.resources_31bf3856ad364e35_10.0.15063.0_en-us_0fbb5c7f4cac8478.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_7f1ff209d10eb31c.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.15063.0_es-es_6099713577ddb2af_wininit.exe.mui_997435f5 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.15063.0_de-de_c03bfcd404188014_mpsdrv.sys.mui_b2aea3b6 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_03474fa863a84227_bootmgr.exe.mui_c434701f a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ru-ru_b767e6d3720d3033_comctl32.dll.mui_0da4e682 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_10.0.15063.0_es-es_b572c268c0e10a3c.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_uk-ua_50a2c75f3aa739c5.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_915abbd08935e3bf_msimsg.dll.mui_72e8994f a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_de-de_1f0c5aa0d4fcc3f8.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_svgasys.fon_32986711 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_zh-cn_5b9d9831c6538b40_msimsg.dll.mui_72e8994f a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_nl-nl_2752c07daa103093_comctl32.dll.mui_0da4e682 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.15063.0_none_6c3a936ba57599b0.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_523cdc9af095f546.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-network-security_31bf3856ad364e35_10.0.15063.0_none_de38492263599171_wfplwfs.sys_df3e0120 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_10.0.15063.0_none_03cb89fc0724bf2c.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_10.0.15063.0_de-de_cedf17224e64925d_profsvc.dll.mui_32482e9e a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_10.0.15063.0_en-us_4d64ef6218a1ebe5.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_de-de_3cea917b11996ccf.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_nl-nl_8b5dcc4a81438dbf_memtest.exe.mui_77b8cbcc a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base_31bf3856ad364e35_10.0.15063.0_none_2956ba0293b4f9a6_wintypes.dll_96e015b1 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.15063.0_es-es_2fb41edeaccde3f5.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_8514fixt.fon_f6726a58 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..e-ws2ifsl.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_dd4c0092fa872345.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_bg-bg_3839d6513809d2fd_comctl32.dll.mui_0da4e682 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_es-es_effb6eaa34ff2c34_wmiutils.dll.mui_42583eaf a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-transactionmanagerapi_31bf3856ad364e35_10.0.15063.0_none_0bcc8dc1546963cf_ktmw32.dll_835a43ee a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-version_31bf3856ad364e35_10.0.15063.0_none_c9f38ce4d1570426_version.dll_406ddf44 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_pt-pt_29179e3878af7901.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-homegroup-provsvc_31bf3856ad364e35_10.0.15063.0_none_a2d14614268f974c_provsvc.dll_a438d02f a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_8706117e54d521c4_msimsg.dll.mui_72e8994f a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_th-th_e25bed23d101e5a7_msimsg.dll.mui_72e8994f a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-irdaircomm_31bf3856ad364e35_10.0.15063.0_none_39a555445d7821f1.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_10.0.15063.0_es-es_7adc7d345eead8ce.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-themeservice.resources_31bf3856ad364e35_10.0.15063.0_en-us_727c27262b7ec707_themeservice.dll.mui_9e71f1ab a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_da-dk_807d2d131bd7ab27_comctl32.dll.mui_0da4e682 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_cs-cz_5e03839ba21b957b_comctl32.dll.mui_0da4e682 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base_31bf3856ad364e35_10.0.15063.0_none_1f020fb05f5437ab.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-provsvc.resources_31bf3856ad364e35_10.0.15063.0_de-de_db9cb62863cfdc98.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-m..ntmanager.resources_31bf3856ad364e35_10.0.15063.0_es-es_4dec66e6783cb498.manifest a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_10.0.15063.0_es-es_8a7b9e0a56c331ec_wmpdui.dll.mui_92411657 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3964 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exepid process 616 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe 616 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 532 vssvc.exe Token: SeRestorePrivilege 532 vssvc.exe Token: SeAuditPrivilege 532 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.execmd.exedescription pid process target process PID 616 wrote to memory of 1120 616 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe cmd.exe PID 616 wrote to memory of 1120 616 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe cmd.exe PID 616 wrote to memory of 1120 616 a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe cmd.exe PID 1120 wrote to memory of 3964 1120 cmd.exe vssadmin.exe PID 1120 wrote to memory of 3964 1120 cmd.exe vssadmin.exe PID 1120 wrote to memory of 3964 1120 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe"C:\Users\Admin\AppData\Local\Temp\a22c5e4a7eaa86c4e4b1f9c14ac3d8ca9bd5748129a74189ce9c132dae934332.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken