9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c

General

Target

9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
Size

73KB
MD5

1c021f42e3a138060e1d298726d1579f
SHA1

54e3384fb68fde6fc711491e8072781e3910156a
SHA256

9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c
SHA512

5ee344d17b5e9a2285258b8e16253263ebb856167b36e7679e602c041c2320c10a7182a7cb5c14f59fe3117a981e96fdff6fa7dc2c2194e90a6f659de143c101

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\odt\How_to_recovery.txt

Ransom Note

F5721E1E5D0B5A60998168818C573450D28684A7CC0E357AC5FEAE6DDF4AD54D 3055C38B717593BF62BC17B4C353AAC119047C989B5395EEDFF838482715B665 3415C4B517FE72C0D8A29074F670655D9E8A99534632515D5059F066C6D7D9B4 72C83493CE02A5A1013FAB5A0C8E71705EE05FF91BE2D8C63DCA7CF23F8B7F88 DFB579467D960A9458134C9871EB328F54D93397857CA3517E2503D307E98C4D 9431EE5883CC3ABA12C676B558B517C332A3F2A16BC8CE736152E597EC4EA6EA 85F23D6F47E43761B33072C07258025650F596E221423F89A6CA19F556F1B172 F7FD2DFDBD697DC03242B2A4C7ACEF9BEDB336324086B72ABC299E89E39828E7 0CE2CD7E6D9900C0F96DE824EEDB0D12B2999813991DD15E03275DD0070F3810 6B5D0B0E5E6910E6B851FDF69AF50E233276FF3487B2A96CEEC3C11DC44A0454 6EE82BE48679C136B82DC21C50FBD5F3DC5E5F585CA5DBE783D8798E0697DC1D 41D8E369496110B1F7F982724C14B82C41626F2F63C1A4144D86688FB46EA25C D87E0B936A7B93E324BE74470BCCED6EB7B631F503A2776F09841B85573FFD3A A9D978B8CCCC3FA24B545CF91C4CD0E4F12E9B2B5ED57E5274BBEF6F8EB792FB 150AE3EBB31B154C2FC0708089DB69DA979AFFE7F3AAF649AEA7DC2B87726DB0 9F402A0F53EDFE8EE00CB80DC8FDB96898F3303092DAF69CC347A63C9AAB26B6 939EEE725164548C7A18C8F0CEFE24C35CEAD344D700AF467FBD50BBB3304924 03F5E54DB7B652E350E5E512A1C1D97984E326F3A2A1B42EE2C0CB5A04C03E0D 00B62F8F3842E935FA7703AC9ACAC10B3D750158018D08E8FB6C7F2D93A087BC EAB387099C9A62A351304341182AD077C8222E7FDB4CD18FA492BE8E73F77310 330B18B7F930656EBBB779DD8021AA5CE3BECC753648EA7EE8BEFC66CCC2ED3D 43CAD24B9664D5452B1A9E3FFEDA4F2320870C1E118BD19CD8C0063ACDB0EB33 D91D638BF93127E9E541E9CA366A40A87277F905BD47A4C30428294F32871645 C48DEAD7D94051EE9C3C8948E45675D31A3E4D9A6F4EDBFE0976B01348EBC16B E1C24D006574C3881E8D4D094E76B1056A8470FABA90AF89871E54D5D8E28C62 92318AD6F1841801C9 Contact us for price and get decryption software. Note that this server is available via Tor browser only Follow the instructions to open the link: qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: ithelp02@decorous.cyou ithelp02@wholeness.business * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. ��

Emails

ithelp02@decorous.cyou

ithelp02@wholeness.business

URLs

http://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\FormatAdd.png => C:\Users\Admin\Pictures\FormatAdd.png.farattack	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Pictures\SyncConfirm.tiff	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File renamed	C:\Users\Admin\Pictures\SyncConfirm.tiff => C:\Users\Admin\Pictures\SyncConfirm.tiff.farattack	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\LicChk = "C:\\Users\\Admin\\AppData\\Local\\9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe"	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

Drops desktop.ini file(s) 29 IoCs

Processes:

9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Public\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

description ioc process

File opened (read-only) \??\A: 9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

description	ioc	process
File opened (read-only)	\??\A:	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

Drops file in Program Files directory 64 IoCs

Processes:

9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\ui-strings.js	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\How_to_recovery.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\How_to_recovery.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_2x.png	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\THMBNAIL.PNG	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBCN6.CHM	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\share.svg	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\selector.js	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\How_to_recovery.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\How_to_recovery.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\SLERROR.XML	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\How_to_recovery.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\How_to_recovery.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\japanese_over.png	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\ui-strings.js	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\de-DE\wordpad.exe.mui	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\eu-es\ui-strings.js	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\bundle.js	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\ui-strings.js	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\How_to_recovery.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaTypewriterBold.ttf	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\How_to_recovery.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\ProtectionManagement.dll.mui	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File created	C:\Program Files\Internet Explorer\es-ES\How_to_recovery.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-actions.xml	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\How_to_recovery.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_delete_18.svg	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\ui-strings.js	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\ui-strings.js	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\How_to_recovery.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\EppManifest.dll.mui	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1480 vssadmin.exe
3132 vssadmin.exe

pid	process
1480	vssadmin.exe
3132	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

vssvc.exe9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

description	pid	process
Token: SeBackupPrivilege	2624	vssvc.exe
Token: SeRestorePrivilege	2624	vssvc.exe
Token: SeAuditPrivilege	2624	vssvc.exe
Token: SeIncBasePriorityPrivilege	2472	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.execmd.execmd.exe

description	pid	process	target process
PID 2472 wrote to memory of 584	2472	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe	cmd.exe
PID 2472 wrote to memory of 584	2472	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe	cmd.exe
PID 584 wrote to memory of 1480	584	cmd.exe	vssadmin.exe
PID 584 wrote to memory of 1480	584	cmd.exe	vssadmin.exe
PID 2472 wrote to memory of 3960	2472	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe	cmd.exe
PID 2472 wrote to memory of 3960	2472	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe	cmd.exe
PID 3960 wrote to memory of 3132	3960	cmd.exe	vssadmin.exe
PID 3960 wrote to memory of 3132	3960	cmd.exe	vssadmin.exe
PID 2472 wrote to memory of 2868	2472	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe	cmd.exe
PID 2472 wrote to memory of 2868	2472	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe	cmd.exe
PID 2472 wrote to memory of 2868	2472	9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe
"C:\Users\Admin\AppData\Local\Temp\9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
2⤵
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:1480

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
2⤵
- Suspicious use of WriteProcessMemory
PID:3960

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:3132

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c.exe > nul
2⤵
PID:2868