Analysis
-
max time kernel
153s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-01-2022 23:35
Static task
static1
Behavioral task
behavioral1
Sample
7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe
-
Size
379KB
-
MD5
5a44e1d5691ec9395281123ea0bd501f
-
SHA1
64566d5049479227d2eff3d983b127c0339974cd
-
SHA256
7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9
-
SHA512
55d85e77f70f25bae6cf8bbf5dd787d5771c2e38e99461b608f6375be9cb0b1031f3c0268b82eb03db05eb88ce37d5f37afbfc69ab0c4f90791a706013b168c8
Score
10/10
Malware Config
Extracted
Path
C:\Documents and Settings\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt
Ransom Note
Hello, all your important files are encrypted and sensitive data leaked.
To decrypt your files and avoid other unpleasant things you need to buy special decryption tool.
Contact us via [email protected] or [email protected] and tell your UserID.
This is the only way to decrypt your files and avoid publi? disclosure of data .
Do not try to use third party software (it may corrupt your files).
We respect black market rules. We can confirm the ability to decrypt your files (and of course the evidence of the leak ),
Send us several unimportant files (do not try to deceive us).
Your UserID (send it to us for decryption):
84222351EF2E20E5077175242CB95DB7FBEE6B49F2F512FF56C05598307AF97F42BFFDA5D75FB1E1031538380F611B70DB843490CDC03972470FA637FA7923E8A295843653962D9CB71B8C64B000C7BC40586B31E1B6F0E6FB75828D700C57C467B4C1348F8166E6069F541DF3BCAD38A16CBDEFBCB360A381B188D48B6D7EF2C24F286DBAF1FAB547E8C4A525D7CD5FB8518764CD2C8A028358B5A0E6D013FB63BBBCC573BD5E10973040491D835996D51785CE5EE4BFBD9404C41E4F4AB20627915932C2B5936BC5E816BD2B3458EC92BA3052D5C1FD6048076EBEB4C243B37557F3B9DF46B2FBE42EE1D1CC91331AE83F48FC66C045E536496B1034152EE13082010A0282010100C6D7B70D3A1EBB1375D0B11122BA2E1713CDD236D88FAD514CD1ED06573687D8FF7B57A0C6E9841D2BD5D82D8DB92AC23247AE69BDD417F07D8610DCB9F47DEB11A3380FB01897BECC5AD13D253F0FE71ED043FC643956BBCF908D9BD5915AAC4126799B10FBB5CF158B25E16ED8CD8E69C37A42455FE3F74CD683397F5790D65FFDE39BC2626488936670F8544B9012C9FC44BF5710C1C3BCB0F797C09303326008797C7F216F76380AA8F5705A7E160ECBB77144250AF3BDAEA3BBFE1372392A6F914B5D7D86A76D3B0F7951F7573AE260146BC620E513FC8F0172489FD55AED12C6C2E26A2791E0D9E6D2C66B3437350EFA0CF289F78F73D4F8D09A87C1DF0203010001F1C7387879FD0B42E561F310F3DFC5405647485543
Signatures
-
Koxic
A C++ written ransomware first seen in late 2021.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Disables taskbar notifications via registry modification
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\UX Configuration\NotificationSuppress = "1" 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtectione = "0" 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\DisableBlockAtFirstSeen = "1" 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\LocalSettingOverrideSpynetReporting = "0" 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2" 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\UX Configuration 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC.HXS.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02443_.WMF.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_h.png.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FLAP.WMF.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00159_.WMF.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\HEADER.GIF.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL026.XML.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\cpu.js.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0211949.WMF.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Executive.xml.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB_COL.HXC.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14539_.GIF.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files\Java\jre7\lib\fonts\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN058.XML.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CRANE.WMF.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_left.png.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02756U.BMP.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files\Microsoft Games\Hearts\en-US\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\NamedURLs.HxK.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR40F.GIF.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_spellcheck.gif.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyReport.dotx.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01631_.WMF.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files\Microsoft Games\Chess\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01080_.WMF.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\WANNA_RECOVER_KOXIC_FILEZ_VGHUC.txt 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_hover.png.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AppConfigurationInternal.zip.KOXIC_VGHUC 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 956 ipconfig.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1412 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 592 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 592 taskkill.exe Token: SeBackupPrivilege 2036 vssvc.exe Token: SeRestorePrivilege 2036 vssvc.exe Token: SeAuditPrivilege 2036 vssvc.exe Token: SeBackupPrivilege 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe Token: SeRestorePrivilege 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe Token: SeManageVolumePrivilege 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe Token: SeTakeOwnershipPrivilege 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe Token: SeIncreaseQuotaPrivilege 1952 WMIC.exe Token: SeSecurityPrivilege 1952 WMIC.exe Token: SeTakeOwnershipPrivilege 1952 WMIC.exe Token: SeLoadDriverPrivilege 1952 WMIC.exe Token: SeSystemProfilePrivilege 1952 WMIC.exe Token: SeSystemtimePrivilege 1952 WMIC.exe Token: SeProfSingleProcessPrivilege 1952 WMIC.exe Token: SeIncBasePriorityPrivilege 1952 WMIC.exe Token: SeCreatePagefilePrivilege 1952 WMIC.exe Token: SeBackupPrivilege 1952 WMIC.exe Token: SeRestorePrivilege 1952 WMIC.exe Token: SeShutdownPrivilege 1952 WMIC.exe Token: SeDebugPrivilege 1952 WMIC.exe Token: SeSystemEnvironmentPrivilege 1952 WMIC.exe Token: SeRemoteShutdownPrivilege 1952 WMIC.exe Token: SeUndockPrivilege 1952 WMIC.exe Token: SeManageVolumePrivilege 1952 WMIC.exe Token: 33 1952 WMIC.exe Token: 34 1952 WMIC.exe Token: 35 1952 WMIC.exe Token: SeIncreaseQuotaPrivilege 1952 WMIC.exe Token: SeSecurityPrivilege 1952 WMIC.exe Token: SeTakeOwnershipPrivilege 1952 WMIC.exe Token: SeLoadDriverPrivilege 1952 WMIC.exe Token: SeSystemProfilePrivilege 1952 WMIC.exe Token: SeSystemtimePrivilege 1952 WMIC.exe Token: SeProfSingleProcessPrivilege 1952 WMIC.exe Token: SeIncBasePriorityPrivilege 1952 WMIC.exe Token: SeCreatePagefilePrivilege 1952 WMIC.exe Token: SeBackupPrivilege 1952 WMIC.exe Token: SeRestorePrivilege 1952 WMIC.exe Token: SeShutdownPrivilege 1952 WMIC.exe Token: SeDebugPrivilege 1952 WMIC.exe Token: SeSystemEnvironmentPrivilege 1952 WMIC.exe Token: SeRemoteShutdownPrivilege 1952 WMIC.exe Token: SeUndockPrivilege 1952 WMIC.exe Token: SeManageVolumePrivilege 1952 WMIC.exe Token: 33 1952 WMIC.exe Token: 34 1952 WMIC.exe Token: 35 1952 WMIC.exe Token: SeIncreaseQuotaPrivilege 1848 WMIC.exe Token: SeSecurityPrivilege 1848 WMIC.exe Token: SeTakeOwnershipPrivilege 1848 WMIC.exe Token: SeLoadDriverPrivilege 1848 WMIC.exe Token: SeSystemProfilePrivilege 1848 WMIC.exe Token: SeSystemtimePrivilege 1848 WMIC.exe Token: SeProfSingleProcessPrivilege 1848 WMIC.exe Token: SeIncBasePriorityPrivilege 1848 WMIC.exe Token: SeCreatePagefilePrivilege 1848 WMIC.exe Token: SeBackupPrivilege 1848 WMIC.exe Token: SeRestorePrivilege 1848 WMIC.exe Token: SeShutdownPrivilege 1848 WMIC.exe Token: SeDebugPrivilege 1848 WMIC.exe Token: SeSystemEnvironmentPrivilege 1848 WMIC.exe Token: SeRemoteShutdownPrivilege 1848 WMIC.exe Token: SeUndockPrivilege 1848 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1608 wrote to memory of 1892 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 27 PID 1608 wrote to memory of 1892 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 27 PID 1608 wrote to memory of 1892 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 27 PID 1608 wrote to memory of 1892 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 27 PID 1892 wrote to memory of 592 1892 cmd.exe 29 PID 1892 wrote to memory of 592 1892 cmd.exe 29 PID 1892 wrote to memory of 592 1892 cmd.exe 29 PID 1892 wrote to memory of 592 1892 cmd.exe 29 PID 1608 wrote to memory of 1692 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 31 PID 1608 wrote to memory of 1692 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 31 PID 1608 wrote to memory of 1692 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 31 PID 1608 wrote to memory of 1692 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 31 PID 1692 wrote to memory of 1412 1692 cmd.exe 33 PID 1692 wrote to memory of 1412 1692 cmd.exe 33 PID 1692 wrote to memory of 1412 1692 cmd.exe 33 PID 1692 wrote to memory of 1412 1692 cmd.exe 33 PID 1608 wrote to memory of 1044 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 35 PID 1608 wrote to memory of 1044 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 35 PID 1608 wrote to memory of 1044 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 35 PID 1608 wrote to memory of 1044 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 35 PID 1608 wrote to memory of 1524 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 37 PID 1608 wrote to memory of 1524 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 37 PID 1608 wrote to memory of 1524 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 37 PID 1608 wrote to memory of 1524 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 37 PID 1524 wrote to memory of 1952 1524 cmd.exe 39 PID 1524 wrote to memory of 1952 1524 cmd.exe 39 PID 1524 wrote to memory of 1952 1524 cmd.exe 39 PID 1524 wrote to memory of 1952 1524 cmd.exe 39 PID 1608 wrote to memory of 1396 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 40 PID 1608 wrote to memory of 1396 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 40 PID 1608 wrote to memory of 1396 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 40 PID 1608 wrote to memory of 1396 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 40 PID 1608 wrote to memory of 1176 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 42 PID 1608 wrote to memory of 1176 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 42 PID 1608 wrote to memory of 1176 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 42 PID 1608 wrote to memory of 1176 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 42 PID 1176 wrote to memory of 1848 1176 cmd.exe 44 PID 1176 wrote to memory of 1848 1176 cmd.exe 44 PID 1176 wrote to memory of 1848 1176 cmd.exe 44 PID 1176 wrote to memory of 1848 1176 cmd.exe 44 PID 1608 wrote to memory of 1784 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 45 PID 1608 wrote to memory of 1784 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 45 PID 1608 wrote to memory of 1784 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 45 PID 1608 wrote to memory of 1784 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 45 PID 1608 wrote to memory of 544 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 47 PID 1608 wrote to memory of 544 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 47 PID 1608 wrote to memory of 544 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 47 PID 1608 wrote to memory of 544 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 47 PID 544 wrote to memory of 1968 544 cmd.exe 49 PID 544 wrote to memory of 1968 544 cmd.exe 49 PID 544 wrote to memory of 1968 544 cmd.exe 49 PID 544 wrote to memory of 1968 544 cmd.exe 49 PID 1608 wrote to memory of 1060 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 50 PID 1608 wrote to memory of 1060 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 50 PID 1608 wrote to memory of 1060 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 50 PID 1608 wrote to memory of 1060 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 50 PID 1608 wrote to memory of 1224 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 52 PID 1608 wrote to memory of 1224 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 52 PID 1608 wrote to memory of 1224 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 52 PID 1608 wrote to memory of 1224 1608 7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe 52 PID 1224 wrote to memory of 1700 1224 cmd.exe 54 PID 1224 wrote to memory of 1700 1224 cmd.exe 54 PID 1224 wrote to memory of 1700 1224 cmd.exe 54 PID 1224 wrote to memory of 1700 1224 cmd.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe"C:\Users\Admin\AppData\Local\Temp\7a5e20e021dc29a07cad61f4d0bdb98e22749f13c3ace58220bfe978908bb7e9.exe"1⤵
- Windows security modification
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /F /IM MSASCuiL.exe taskkill /F /IM MSMpeng.exe taskkill /F /IM msseces.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSASCuiL.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet sc config browser sc config browser start=enabled sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabled sc stop SQLWriter sc config SQLWriter start=disabled sc stop MSSQLServerOLAPService sc config MSSQLServerOLAPService start=disabled sc stop MSSQLSERVER sc config MSSQLSERVER start=disabled sc stop MSSQL$SQLEXPRESS sc config MSSQL$SQLEXPRESS start=disabled sc stop ReportServer sc config ReportServer start=disabled sc stop OracleServiceORCL sc config OracleServiceORCL start=disabled sc stop OracleDBConsoleorcl sc config OracleDBConsoleorcl start=disabled sc stop OracleMTSRecoveryService sc config OracleMTSRecoveryService start=disabled sc stop OracleVssWriterORCL sc config OracleVssWriterORCL start=disabled sc stop MySQL sc config MySQL start=disabled2⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1412
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "echo OS INFO: > %TEMP%\GUQLVJUVA"2⤵PID:1044
-
-
C:\Windows\SysWOW64\cmd.execmd /c "wmic OS get Caption,CSDVersion,OSArchitecture,Version >> %TEMP%\GUQLVJUVA"2⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic OS get Caption,CSDVersion,OSArchitecture,Version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "echo BIOS INFO: >> %TEMP%\GUQLVJUVA"2⤵PID:1396
-
-
C:\Windows\SysWOW64\cmd.execmd /c "wmic BIOS get Manufacturer, Name, SMBIOSBIOSVersion, Version >> %TEMP%\GUQLVJUVA"2⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic BIOS get Manufacturer, Name, SMBIOSBIOSVersion, Version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "echo CPU INFO: >> %TEMP%\GUQLVJUVA"2⤵PID:1784
-
-
C:\Windows\SysWOW64\cmd.execmd /c "wmic CPU get Name, NumberOfCores, NumberOfLogicalProcessors >> %TEMP%\GUQLVJUVA"2⤵
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic CPU get Name, NumberOfCores, NumberOfLogicalProcessors3⤵PID:1968
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "echo MEMPHYSICAL INFO: >> %TEMP%\GUQLVJUVA"2⤵PID:1060
-
-
C:\Windows\SysWOW64\cmd.execmd /c "wmic MEMPHYSICAL get MaxCapacity >> %TEMP%\GUQLVJUVA"2⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic MEMPHYSICAL get MaxCapacity3⤵PID:1700
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "echo MEMORYCHIP: INFO >> %TEMP%\GUQLVJUVA"2⤵PID:1552
-
-
C:\Windows\SysWOW64\cmd.execmd /c "wmic MEMORYCHIP get Capacity, DeviceLocator, PartNumber, Tag >> %TEMP%\GUQLVJUVA"2⤵PID:1584
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic MEMORYCHIP get Capacity, DeviceLocator, PartNumber, Tag3⤵PID:1256
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "echo NIC INFO: >> %TEMP%\GUQLVJUVA"2⤵PID:592
-
-
C:\Windows\SysWOW64\cmd.execmd /c "wmic NIC get Description, MACAddress, NetEnabled, Speed >> %TEMP%\GUQLVJUVA"2⤵PID:1472
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic NIC get Description, MACAddress, NetEnabled, Speed3⤵PID:1632
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "echo DISKDRIVE INFO: >> %TEMP%\GUQLVJUVA"2⤵PID:1208
-
-
C:\Windows\SysWOW64\cmd.execmd /c "wmic DISKDRIVE get InterfaceType, Name, Size, Status >> %TEMP%\GUQLVJUVA"2⤵PID:1300
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic DISKDRIVE get InterfaceType, Name, Size, Status3⤵PID:1352
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "echo USERACCOUNT INFO: >> %TEMP%\GUQLVJUVA"2⤵PID:1524
-
-
C:\Windows\SysWOW64\cmd.execmd /c "wmic USERACCOUNT get Caption, Name, PasswordRequired, Status >> %TEMP%\GUQLVJUVA"2⤵PID:1020
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic USERACCOUNT get Caption, Name, PasswordRequired, Status3⤵PID:1516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "echo IPCONFIG: >> %TEMP%\GUQLVJUVA"2⤵PID:1176
-
-
C:\Windows\SysWOW64\cmd.execmd /c "ipconfig >> %TEMP%\GUQLVJUVA"2⤵PID:1716
-
C:\Windows\SysWOW64\ipconfig.exeipconfig3⤵
- Gathers network information
PID:956
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "echo DATABASES FILES: >> %TEMP%\GUQLVJUVA"2⤵PID:1068
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036