Analysis
-
max time kernel
173s -
max time network
168s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 02:17
Static task
static1
Behavioral task
behavioral1
Sample
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
Resource
win10-en-20211208
General
-
Target
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
-
Size
1.1MB
-
MD5
bed6fc04aeb785815744706239a1f243
-
SHA1
3d0649b5f76dbbff9f86b926afbd18ae028946bf
-
SHA256
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45
-
SHA512
1ed873577545dc52ffe3516b10848a0474c7f30dbaeed95c67b9b5a690acf4045c05114231dc4350e60219dea00a7e2be4cedc81a9e8655de59831ac09f53100
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exedescription ioc process File opened (read-only) \??\B: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\F: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\L: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\O: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\R: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\V: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\N: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\P: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\W: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\G: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\J: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\Q: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\X: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\Y: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\S: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\T: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\A: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\E: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\H: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\I: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\K: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\M: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\U: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened (read-only) \??\Z: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe -
Drops file in Windows directory 64 IoCs
Processes:
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.15063.0_none_44fadb58fe4497d9_dwm.exe_04cf416e 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-userpowermanagement_31bf3856ad364e35_10.0.15063.0_none_be8221ec6a07dad4_powrprof.dll_480be757 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ja-jp_d02a172e465bf139_comctl32.dll.mui_0da4e682 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.15063.0_none_9894c210d52e9480.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_10.0.15063.0_none_bcdc71d81c5b7ee4_dxgkrnl.sys_8aad3dfb 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-m..ntmanager.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_7cf15239355bc253_mountmgr.sys.mui_71b54a25 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_de-de_cbe51fcec4ccd94a_dsreg.dll.mui_5d9efc7e 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_f8fc3ce2364f0716_wininit.exe.mui_997435f5 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..wmanager-compositor_31bf3856ad364e35_10.0.15063.0_none_20ead682ac8d69e0.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_f5dc2ec982476ba8_iscsisession.cdxml_9cd8900b 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-c..temminpnp.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_d5b9c58bbc83da2f.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_bebc164cdf01a737_bootmgr.efi.mui_be5d0075 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_nb-no_2913753fa8e426be.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_8514sysg.fon_d69594ed 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_de-de_5be8d57b685c3b22_scdeviceenum.dll.mui_815e7662 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..erservice.resources_31bf3856ad364e35_10.0.15063.0_de-de_58ea79f1dbc52af4.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_10.0.15063.0_none_e8fc1bcb973bd8b8.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_el-gr_d1f73285f872ee81.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_dc9d1f26de15ab15.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.15063.0_es-es_68f82fb0f31d7d7e.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_760eaa73a2ef7d91.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_hr-hr_5705fc83f923aa47.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_sl-si_55950d3867c13540_comctl32.dll.mui_0da4e682 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_he-il_87fc497c627dface.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..n-cmdline.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_83341399f9512935_dsregcmd.exe.mui_8ce2c638 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-cryptdll-dll_31bf3856ad364e35_10.0.15063.0_none_210709721af4ec88.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..ndowmanager-effects_31bf3856ad364e35_10.0.15063.0_none_0c6c3963abedbb7f_wuceffects.dll_0c15b7d5 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_8836c38c5592b4d0_user32.dll.mui_14652dbb 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_2ae775fa9c77b08e_msimsg.dll.mui_72e8994f 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_vga860.fon_07129997 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_en-us_a159cef78915f1d9.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_10.0.15063.0_de-de_0cb68f8bd1dc0cd2.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_06c8a8054dc02d3d.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..opactivitymoderator_31bf3856ad364e35_10.0.15063.0_none_1afe75a2a51438fe_bamsettingsclient.dll_db7ec840 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_bae6f1b1935516b4_atmlib.dll_fe5ca5c9 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ro-ro_9eee956fea195b3b_msimsg.dll.mui_72e8994f 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..oexistencemigration_31bf3856ad364e35_10.0.15063.0_none_22f6ec0bb529250e_iphlpsvc.dll_805aaf49 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.15063.0_none_72996f15c8286420.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.15063.0_en-us_4f11d10363ebf375_user32.dll.mui_14652dbb 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.15063.0_es-es_6ead483edc26f335_axinstui.exe.mui_aea34130 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_cs-cz_9120bc15bf67e669.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_el-gr_d41c5f0ba6999f90.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_cs-cz_b8c0e267f83754d0.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.15063.0_es-es_810313f24dbc3874_netiougc.exe.mui_ad7a9e4d 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..gon-tools.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_5590b20187c8e1aa.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ui-xaml-controls_31bf3856ad364e35_10.0.15063.0_none_26f0788116f5471e.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..e-ws2ifsl.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_699975e6c4d41a9e_ws2ifsl.sys.mui_b672c7b4 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_de-de_33ac492def379f50_gpapi.dll.mui_ef0a9748 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_bg-bg_69d60750c30ce9db_msimsg.dll.mui_72e8994f 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_lt-lt_ce3b1a34396db477.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.15063.0_none_2948eb6ce79ec07c.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sr-..-rs_2ed8755544e099be.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.15063.0_none_e819281ea9bc03bf_axinstui.exe_eba3b15b 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-w..cture-bsp.resources_31bf3856ad364e35_10.0.15063.0_de-de_4058ea17e2072e4b_mswsock.dll.mui_d7c2a730 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-basesrv_31bf3856ad364e35_10.0.15063.0_none_1ddec40f1c898738_basesrv.dll_8c1ad808 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_es-es_504a2aac09940195_webclnt.dll.mui_e8f04040 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_pt-br_2835cecc79400925_comctl32.dll.mui_0da4e682 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_c3d533af484301a2.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_es-mx_a35c198187d0c729.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ro-ro_e8129b1fdba02ab0_comctl32.dll.mui_0da4e682 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..y-biometrics-client_31bf3856ad364e35_10.0.15063.0_none_c32c99d8bd9714e6.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-r..intmapper.resources_31bf3856ad364e35_10.0.15063.0_de-de_52bbcd224381180e_rpcepmap.dll.mui_349798e1 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_c74cd5a2848ce468_mpssvc.dll.mui_4b194b5f 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_10.0.15063.0_es-es_06bc4d7b7f634266.manifest 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 424 vssadmin.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exepid process 3724 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe 3724 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 808 vssvc.exe Token: SeRestorePrivilege 808 vssvc.exe Token: SeAuditPrivilege 808 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.execmd.exedescription pid process target process PID 3724 wrote to memory of 4476 3724 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe cmd.exe PID 3724 wrote to memory of 4476 3724 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe cmd.exe PID 3724 wrote to memory of 4476 3724 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe cmd.exe PID 4476 wrote to memory of 424 4476 cmd.exe vssadmin.exe PID 4476 wrote to memory of 424 4476 cmd.exe vssadmin.exe PID 4476 wrote to memory of 424 4476 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe"C:\Users\Admin\AppData\Local\Temp\3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3724-117-0x0000000000600000-0x000000000074A000-memory.dmpFilesize
1.3MB
-
memory/3724-118-0x00000000008B0000-0x00000000008D3000-memory.dmpFilesize
140KB
-
memory/3724-119-0x00000000008B0000-0x00000000008D3000-memory.dmpFilesize
140KB
-
memory/3724-120-0x00000000008B0000-0x00000000008D3000-memory.dmpFilesize
140KB
-
memory/3724-121-0x00000000008E0000-0x00000000008E6000-memory.dmpFilesize
24KB