General
Target

3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe

Filesize

1MB

Completed

24-01-2022 03:09

Task

behavioral2

Score
9/10
MD5

bed6fc04aeb785815744706239a1f243

SHA1

3d0649b5f76dbbff9f86b926afbd18ae028946bf

SHA256

3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45

SHA256

1ed873577545dc52ffe3516b10848a0474c7f30dbaeed95c67b9b5a690acf4045c05114231dc4350e60219dea00a7e2be4cedc81a9e8655de59831ac09f53100

Malware Config
Signatures 9

Filter: none

Defense Evasion
Discovery
Impact
  • Deletes shadow copies

    Description

    Ransomware often targets backup files to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery
  • Enumerates connected drives
    3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    File opened (read-only)\??\B:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\F:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\L:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\O:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\R:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\V:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\N:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\P:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\W:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\G:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\J:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\Q:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\X:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\Y:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\S:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\T:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\A:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\E:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\H:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\I:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\K:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\M:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\U:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened (read-only)\??\Z:3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
  • Drops file in Windows directory
    3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.15063.0_none_44fadb58fe4497d9_dwm.exe_04cf416e3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-userpowermanagement_31bf3856ad364e35_10.0.15063.0_none_be8221ec6a07dad4_powrprof.dll_480be7573641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ja-jp_d02a172e465bf139_comctl32.dll.mui_0da4e6823641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.15063.0_none_9894c210d52e9480.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_10.0.15063.0_none_bcdc71d81c5b7ee4_dxgkrnl.sys_8aad3dfb3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-m..ntmanager.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_7cf15239355bc253_mountmgr.sys.mui_71b54a253641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_de-de_cbe51fcec4ccd94a_dsreg.dll.mui_5d9efc7e3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_f8fc3ce2364f0716_wininit.exe.mui_997435f53641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..wmanager-compositor_31bf3856ad364e35_10.0.15063.0_none_20ead682ac8d69e0.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_f5dc2ec982476ba8_iscsisession.cdxml_9cd8900b3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft-windows-c..temminpnp.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_d5b9c58bbc83da2f.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_bebc164cdf01a737_bootmgr.efi.mui_be5d00753641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_nb-no_2913753fa8e426be.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_8514sysg.fon_d69594ed3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_de-de_5be8d57b685c3b22_scdeviceenum.dll.mui_815e76623641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..erservice.resources_31bf3856ad364e35_10.0.15063.0_de-de_58ea79f1dbc52af4.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_10.0.15063.0_none_e8fc1bcb973bd8b8.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_el-gr_d1f73285f872ee81.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_dc9d1f26de15ab15.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.15063.0_es-es_68f82fb0f31d7d7e.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_760eaa73a2ef7d91.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_hr-hr_5705fc83f923aa47.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_sl-si_55950d3867c13540_comctl32.dll.mui_0da4e6823641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_he-il_87fc497c627dface.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..n-cmdline.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_83341399f9512935_dsregcmd.exe.mui_8ce2c6383641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-cryptdll-dll_31bf3856ad364e35_10.0.15063.0_none_210709721af4ec88.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..ndowmanager-effects_31bf3856ad364e35_10.0.15063.0_none_0c6c3963abedbb7f_wuceffects.dll_0c15b7d53641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_8836c38c5592b4d0_user32.dll.mui_14652dbb3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_2ae775fa9c77b08e_msimsg.dll.mui_72e8994f3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_vga860.fon_071299973641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_en-us_a159cef78915f1d9.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_10.0.15063.0_de-de_0cb68f8bd1dc0cd2.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_06c8a8054dc02d3d.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..opactivitymoderator_31bf3856ad364e35_10.0.15063.0_none_1afe75a2a51438fe_bamsettingsclient.dll_db7ec8403641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_bae6f1b1935516b4_atmlib.dll_fe5ca5c93641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ro-ro_9eee956fea195b3b_msimsg.dll.mui_72e8994f3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..oexistencemigration_31bf3856ad364e35_10.0.15063.0_none_22f6ec0bb529250e_iphlpsvc.dll_805aaf493641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.15063.0_none_72996f15c8286420.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.15063.0_en-us_4f11d10363ebf375_user32.dll.mui_14652dbb3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.15063.0_es-es_6ead483edc26f335_axinstui.exe.mui_aea341303641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_cs-cz_9120bc15bf67e669.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_el-gr_d41c5f0ba6999f90.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_cs-cz_b8c0e267f83754d0.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.15063.0_es-es_810313f24dbc3874_netiougc.exe.mui_ad7a9e4d3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..gon-tools.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_5590b20187c8e1aa.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-ui-xaml-controls_31bf3856ad364e35_10.0.15063.0_none_26f0788116f5471e.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..e-ws2ifsl.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_699975e6c4d41a9e_ws2ifsl.sys.mui_b672c7b43641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_de-de_33ac492def379f50_gpapi.dll.mui_ef0a97483641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_bg-bg_69d60750c30ce9db_msimsg.dll.mui_72e8994f3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_lt-lt_ce3b1a34396db477.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.15063.0_none_2948eb6ce79ec07c.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sr-..-rs_2ed8755544e099be.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.15063.0_none_e819281ea9bc03bf_axinstui.exe_eba3b15b3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-w..cture-bsp.resources_31bf3856ad364e35_10.0.15063.0_de-de_4058ea17e2072e4b_mswsock.dll.mui_d7c2a7303641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-basesrv_31bf3856ad364e35_10.0.15063.0_none_1ddec40f1c898738_basesrv.dll_8c1ad8083641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_es-es_504a2aac09940195_webclnt.dll.mui_e8f040403641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_pt-br_2835cecc79400925_comctl32.dll.mui_0da4e6823641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_c3d533af484301a2.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_es-mx_a35c198187d0c729.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ro-ro_e8129b1fdba02ab0_comctl32.dll.mui_0da4e6823641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..y-biometrics-client_31bf3856ad364e35_10.0.15063.0_none_c32c99d8bd9714e6.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_microsoft-windows-r..intmapper.resources_31bf3856ad364e35_10.0.15063.0_de-de_52bbcd224381180e_rpcepmap.dll.mui_349798e13641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_c74cd5a2848ce468_mpssvc.dll.mui_4b194b5f3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    File opened for modificationC:\Windows\WinSxS\Backup\wow64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_10.0.15063.0_es-es_06bc4d7b7f634266.manifest3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Interacts with shadow copies
    vssadmin.exe

    Description

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery

    Reported IOCs

    pidprocess
    424vssadmin.exe
  • Modifies data under HKEY_USERS
    3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
  • Suspicious behavior: EnumeratesProcesses
    3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe

    Reported IOCs

    pidprocess
    37243641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    37243641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
  • Suspicious use of AdjustPrivilegeToken
    vssvc.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeBackupPrivilege808vssvc.exe
    Token: SeRestorePrivilege808vssvc.exe
    Token: SeAuditPrivilege808vssvc.exe
  • Suspicious use of WriteProcessMemory
    3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3724 wrote to memory of 447637243641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.execmd.exe
    PID 3724 wrote to memory of 447637243641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.execmd.exe
    PID 3724 wrote to memory of 447637243641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.execmd.exe
    PID 4476 wrote to memory of 4244476cmd.exevssadmin.exe
    PID 4476 wrote to memory of 4244476cmd.exevssadmin.exe
    PID 4476 wrote to memory of 4244476cmd.exevssadmin.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
    "C:\Users\Admin\AppData\Local\Temp\3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe"
    Enumerates connected drives
    Drops file in Windows directory
    Modifies data under HKEY_USERS
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:3724
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      Suspicious use of WriteProcessMemory
      PID:4476
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        Interacts with shadow copies
        PID:424
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Suspicious use of AdjustPrivilegeToken
    PID:808
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • memory/3724-117-0x0000000000600000-0x000000000074A000-memory.dmp

                    • memory/3724-118-0x00000000008B0000-0x00000000008D3000-memory.dmp

                    • memory/3724-119-0x00000000008B0000-0x00000000008D3000-memory.dmp

                    • memory/3724-120-0x00000000008B0000-0x00000000008D3000-memory.dmp

                    • memory/3724-121-0x00000000008E0000-0x00000000008E6000-memory.dmp