Analysis
-
max time kernel
127s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 02:35
Static task
static1
Behavioral task
behavioral1
Sample
0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe
Resource
win10-en-20211208
General
-
Target
0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe
-
Size
157KB
-
MD5
79f2341510d9fb5291aefc3e69d18253
-
SHA1
70f2bc8cc0861dc5ff4590821d67ac34272c929a
-
SHA256
0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c
-
SHA512
6b3922e53960be8ef803706661384d1a92b85aa2225347cf27153ad5ebb79695bb0d73a861a0f95e1129512ff7f148d725172148584fa519796d79a301f365cb
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exedescription ioc process File opened (read-only) \??\I: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\O: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\Q: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\R: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\S: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\F: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\G: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\H: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\T: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\W: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\Z: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\B: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\X: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\Y: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\L: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\M: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\N: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\A: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\E: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\K: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\V: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\J: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\P: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened (read-only) \??\U: 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe -
Drops file in Windows directory 64 IoCs
Processes:
0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_hu-hu_108ceb72e3e4e2a9.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.gdiplus.systemcopy_31bf3856ad364e35_10.0.15063.0_none_f7ee6fbe2edc3d66.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_10.0.15063.0_de-de_7a7bbe6b4471ea21.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.15063.0_de-de_7f6609be4b2dcbcf_dnsapi.dll.mui_97465f8a 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-eventlog.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_ddeaf102b6e3bcdd.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_9c4fb75c7c756c69.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..geservice.resources_31bf3856ad364e35_10.0.15063.0_es-es_80c51b1009151e54_storsvc.dll.mui_2fc7b1d3 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmpdui_31bf3856ad364e35_10.0.15063.0_none_6de569323ab18e56.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_cs-cz_9120bc15bf67e669_bootmgr.exe.mui_c434701f 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_pt-pt_fe9533b44b551ea9.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.15063.0_none_5f76fb5d5934b9cf_ipsecsvc.mof_713662d2 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ucrt_31bf3856ad364e35_10.0.15063.0_none_c729b8d286af64eb.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_pt-pt_9269d4068ddf1552_bootmgr.efi.mui_be5d0075 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.15063.0_de-de_debbbd462df48416.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.15063.0_none_6c3a936ba57599b0_winload.exe_75835076 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_e477adbb7e0017f7_volmgrx.sys.mui_b0c205d7 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_sl-si_3f840760de482318.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_193bb5ceb03ac714_wiaservc.dll.mui_54051b53 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.15063.0_es-es_810313f24dbc3874_tcpipcfg.dll.mui_a5479fc1 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_f301a0aafc6617f7_webclnt.dll.mui_e8f04040 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..opactivitymoderator_31bf3856ad364e35_10.0.15063.0_none_25531ff4d974faf9_bamsettingsclient.dll_db7ec840 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_es-es_c7c88d7dc401c162_memtest.efi.mui_71e15c22 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-c..temminpnp.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_31d8610f74e14b65_drvcfg.exe.mui_ff2bc967 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_8514oemr.fon_dbe7e3dc 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-provsvc.resources_31bf3856ad364e35_10.0.15063.0_en-us_848d8c2152ade85d.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-hal_31bf3856ad364e35_10.0.15063.0_none_bc3ccbdd9278f0bd_hal.dll_f279be4d 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msxml60_31bf3856ad364e35_10.0.15063.0_none_9981d57bcfa52887_msxml6r.dll_d8460bdb 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-client-li..scription.resources_31bf3856ad364e35_10.0.15063.0_en-us_1923ad0413dac689.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-keyiso.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_54c3cd039e862de2_keyiso.dll.mui_4bbf12ff 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_10.0.15063.0_es-es_4af765598c2696d8_netlogon.dll.mui_ecbeb9bd 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_a221761e9816d444_consent.exe.mui_2eb3b9db 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.15063.0_en-us_d84575ef7f0e3162_rasautou.exe.mui_55686a97 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.15063.0_none_1ef4411ab33dfe81_cis.scp_0303a193 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.15063.0_none_460932e9ff0c93bd.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-win32kbase.resources_31bf3856ad364e35_10.0.15063.0_de-de_88e19e6ec3d70899_win32kbase.sys.mui_07d441e9 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_dc9d1f26de15ab15_gpsvc.dll.mui_0c160ac2 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_10.0.15063.0_es-es_8a7b9e0a56c331ec_wmpdui.dll.mui_92411657 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_0a2d92d31f26b1b9_iscsicli.exe.mui_64c0a23c 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_bebc164cdf01a737_bootmgr.efi.mui_be5d0075 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.15063.0_none_44fadb58fe4497d9.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_cga40woa.fon_3e9e1495 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_de-de_e3641786062c0973_mprdim.dll.mui_11b5ef08 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smbminirdr_31bf3856ad364e35_10.0.15063.0_none_90a5466e89ec288b.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_de-de_417a979f0416bbef_sti.dll.mui_00a4f15b 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_bd1d1a4af7dd55de_wiarpc.dll.mui_0c913b87 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-msauditevtlog_31bf3856ad364e35_10.0.15063.0_none_e2aafdd9e59cf01f_adtschema.dll_4cae41ac 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_adfae850a551a66a_userdeviceregistration.dll.mui_22ab8f29 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_sk-sk_7827ea7767da95a8_bootmgfw.efi.mui_a6e78cfa 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.15063.0_none_9894c210d52e9480_bootmgr.efi_da0f14a8 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_10.0.15063.0_none_fa7db1d69e32c652_winbrand.dll_9cd6a3cf 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_el-gr_57db20e197c67f2d_msimsg.dll.mui_72e8994f 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_e1f4fde2e2936fd2.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_es-es_9847ea4fc76dd6ad.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_b007ff450adb462f_tcpipcfg.dll.mui_a5479fc1 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.15063.0_de-de_7ca341af89682490.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directui_31bf3856ad364e35_10.0.15063.0_none_c809cce62764b8db_windows.ui.xaml.resources.dll_3a1e5f1c 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_664c2e56d78422ef_iscsiexe.dll.mui_7d81b1cc 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_10.0.15063.0_none_d8565387b13c2e24_msobjs.dll_052c8a60 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_fi-fi_f892f9b169daaca2.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_windows-defender-drivers_31bf3856ad364e35_10.0.15063.0_none_01e0e8792e07e99a_wdboot.sys_9bae05d2 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_bebc164cdf01a737_bootmgfw.efi.mui_a6e78cfa 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..cture-bsp.resources_31bf3856ad364e35_10.0.15063.0_en-us_def515be9c847815_mswsock.dll.mui_d7c2a730 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_uk-ua_83b5c737a2b4f712.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-h..p-provsvc.resources_31bf3856ad364e35_10.0.15063.0_es-es_8ead935787359bfd.manifest 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1276 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exepid process 3004 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe 3004 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 960 vssvc.exe Token: SeRestorePrivilege 960 vssvc.exe Token: SeAuditPrivilege 960 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.execmd.exedescription pid process target process PID 3004 wrote to memory of 1132 3004 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe cmd.exe PID 3004 wrote to memory of 1132 3004 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe cmd.exe PID 3004 wrote to memory of 1132 3004 0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe cmd.exe PID 1132 wrote to memory of 1276 1132 cmd.exe vssadmin.exe PID 1132 wrote to memory of 1276 1132 cmd.exe vssadmin.exe PID 1132 wrote to memory of 1276 1132 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe"C:\Users\Admin\AppData\Local\Temp\0832b9544b38aeb0e7731cfc3a676365224472a62d3628a0dfb838d3e5202e1c.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken