26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe
238KB
24-01-2022 03:02
behavioral2
f3b3bb093d9f95fa405947c9be02594d
102ea13148647c13ecc20c75cd62f3c17a7bebf2
26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a
8f749837fe4300378d87b398486f15a7cf0bb9753832161c82cf31919b781a496cf29077acd11b4c302e53c49674ca259105a0ec7af93a9b5dd8aab12437286b
Filter: none
-
Sodin,Sodinokibi,REvil
Description
Ransomware with advanced anti-analysis and privilege escalation functionality.
Tags
-
Deletes shadow copies
Description
Ransomware often targets backup files to inhibit system recovery.
Tags
TTPs
-
Enumerates connected drives26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe
Description
Attempts to read the root path of hard drives other than the default C: drive.
TTPs
Reported IOCs
description ioc process File opened (read-only) \??\W: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\E: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\N: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\M: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\S: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\X: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\Z: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\A: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\J: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\K: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\L: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\O: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\P: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\Q: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\Y: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\B: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\F: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\I: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\R: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\T: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\U: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\V: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\G: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened (read-only) \??\H: 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe -
Drops file in Windows directory26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe
Reported IOCs
description ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.15063.0_none_ce6bccb1aa74baa3_ntlmshared.dll_d7ed706e 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..entication-usermode_31bf3856ad364e35_10.0.15063.0_none_558a46bee183e781_authz.dll_c0d80602 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-security-spp.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_e700c2d461501612.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_el-gr_6dec26b9213f9155.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.15063.0_de-de_c5f11561ed21f5cb.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.15063.0_de-de_c8d121395a04e07d_listsvc.dll.mui_27f0fc85 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_hr-hr_40f4f6ac6faa981f_msimsg.dll.mui_72e8994f 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_eb8784774de6a9ad_iscsiwmi.dll_272dd9e6 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_b1b128a97e9410e9_certprop.dll.mui_602eaab4 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.15063.0_none_505ddd3c336d55b8_setupapi.dll_8d9de2e7 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_hr-hr_78aafb7af9d71d92_bootmgr.efi.mui_be5d0075 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_de-de_29579edbbad6dd55.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_bae6f1b1935516b4_dciman32.dll_a41dd515 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-r..intmapper.resources_31bf3856ad364e35_10.0.15063.0_de-de_52bbcd224381180e.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_fi-fi_9afd8f54d47294fd_msimsg.dll.mui_72e8994f 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-s..cs-client-extension_31bf3856ad364e35_10.0.15063.0_none_3a587d36329a2cf4_winbioext.dll_b698c00f 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_hu-hu_8b4d2222606ec8fc.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_de-de_1f0c5aa0d4fcc3f8_memtest.efi.mui_71e15c22 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_nb-no_4ab87436a9979a09_bootmgfw.efi.mui_a6e78cfa 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.15063.0_none_b75e366b959a24e0_consent.exe_9075a1c2 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_10.0.15063.0_none_03cb89fc0724bf2c_ws2_32.dll_89b90cb6 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_8706117e54d521c4_msimsg.dll.mui_72e8994f 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-ngc-ksp_31bf3856ad364e35_10.0.15063.0_none_7c9d6f514ca3de44_ngcksp.dll_a56a189a 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_el-gr_5951efba74d1259c.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_pl-pl_c7457c7a32053978.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_c99395587677579e_wintypes.dll.mui_36d5f25a 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_8514oem.fon_c20e1190 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shacct_31bf3856ad364e35_10.0.15063.0_none_d7160ce35a44058a.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_3dfe9dfd48e10842.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_he-il_404f12a54e01d1c8.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-appid_31bf3856ad364e35_10.0.15063.0_none_72b493d71f56c769_appidapi.dll_affa6810 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-w..sition-coreservices_31bf3856ad364e35_10.0.15063.0_none_4dfcbe9d2082d76a_wiatrace.dll_dfb4e972 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ko-kr_ce5152af8ee877a4_msimsg.dll.mui_72e8994f 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_hu-hu_79df2140f9147efa_bootmgfw.efi.mui_a6e78cfa 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.15063.0_none_69f7bd111ce467b4_csrss.exe_06529458 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.15063.0_en-us_71c1f73248e2ec42_listsvc.dll.mui_27f0fc85 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_fi-fi_c57ff9d901ccef55_comctl32.dll.mui_0da4e682 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-directui_31bf3856ad364e35_10.0.15063.0_none_d25e77385bc57ad6_windows.ui.xaml.resources.dll_3a1e5f1c 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_de-de_edb8c1d83a8ccb6e_rtm.dll.mui_55e4e990 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..-webauthn.resources_31bf3856ad364e35_10.0.15063.0_es-es_3c6da488499731b8.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_92b2e4a927d14296_wmiutils.dll.mui_42583eaf 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-l..istry-support-tcpip_31bf3856ad364e35_10.0.15063.0_none_97310f403e3bb3f4_tcpipreg.sys_e872d013 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.15063.0_none_5522510b24d3f7d4_ipsecsvc.mof_713662d2 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_de-de_cbe51fcec4ccd94a_userdeviceregistration.dll.mui_22ab8f29 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.15063.0_none_b75e366b959a24e0_appinfoext.dll_c7e33d76 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-r..intmapper.resources_31bf3856ad364e35_10.0.15063.0_de-de_52bbcd224381180e_rpcepmap.dll.mui_349798e1 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-user32_31bf3856ad364e35_10.0.15063.0_none_e8a0efccda8bfa95.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.15063.0_none_2948eb6ce79ec07c_rasdiag.dll_341d4299 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_es-es_effb6eaa34ff2c34.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_de-de_f868f8fe9a37e614_comctl32.dll.mui_0da4e682 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ko-kr_7393f3e338ccb84f_comctl32.dll.mui_0da4e682 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.15063.0_es-es_d7c3bcb290a11f82_wudfpf.sys.mui_f61e9e86 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_10.0.15063.0_none_d8565387b13c2e24_msaudite.dll_9eacd00a 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_de-de_3cea917b11996ccf_wmiapres.dll.mui_c1b8803f 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_85f1256.fon_77c3aa02 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_app866.fon_e1f13b9e 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.15063.0_none_7d443ad9ecf1cbd0.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_1a52bffe303ba629.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_tr-tr_62a053e1dd4c4aba.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_sk-sk_7827ea7767da95a8.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..wmanager-compositor_31bf3856ad364e35_10.0.15063.0_none_16962c30782ca7e5_dwmcore.dll_523baf47 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-directory-services-sam_31bf3856ad364e35_10.0.15063.0_none_c3023296d9c347cc_samlib.dll_caeebf04 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_aaf722a283f6bf8c.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shsvcs.resources_31bf3856ad364e35_10.0.15063.0_de-de_000f55c92a390fac.manifest 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe -
Enumerates physical storage devices
Description
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
TTPs
-
Interacts with shadow copiesvssadmin.exe
Description
Shadow copies are often targeted by ransomware to inhibit system recovery.
Tags
TTPs
Reported IOCs
pid process 2536 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe
Reported IOCs
pid process 1304 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe 1304 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe -
Suspicious use of AdjustPrivilegeTokenvssvc.exe
Reported IOCs
description pid process Token: SeBackupPrivilege 1796 vssvc.exe Token: SeRestorePrivilege 1796 vssvc.exe Token: SeAuditPrivilege 1796 vssvc.exe -
Suspicious use of WriteProcessMemory26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.execmd.exe
Reported IOCs
description pid process target process PID 1304 wrote to memory of 1016 1304 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe cmd.exe PID 1304 wrote to memory of 1016 1304 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe cmd.exe PID 1304 wrote to memory of 1016 1304 26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe cmd.exe PID 1016 wrote to memory of 2536 1016 cmd.exe vssadmin.exe PID 1016 wrote to memory of 2536 1016 cmd.exe vssadmin.exe PID 1016 wrote to memory of 2536 1016 cmd.exe vssadmin.exe
-
C:\Users\Admin\AppData\Local\Temp\26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe"C:\Users\Admin\AppData\Local\Temp\26e114462b40c5a6ff4c28309e53f8bedeee43753fea6b5d4715b3910b07696a.exe"Enumerates connected drivesDrops file in Windows directorySuspicious behavior: EnumeratesProcessesSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailuresSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /QuietInteracts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exeSuspicious use of AdjustPrivilegeToken