Analysis
-
max time kernel
156s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-01-2022 07:56
Static task
static1
Behavioral task
behavioral1
Sample
22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe
Resource
win10-en-20211208
General
-
Target
22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe
-
Size
161KB
-
MD5
5d07f1aa1597cf910630e1852d7d0729
-
SHA1
194ac2c2b6949ac37d85f4c8d4f6b8acc7c29b18
-
SHA256
22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3
-
SHA512
f443941be3e922c0bbf2c4307a03868c8865194b777600e83f46c2f7a86d9876f8a630e2ef701261cad7b20c197720c81103755556567ab0b797c3c8e3c9e703
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exedescription ioc process File opened (read-only) \??\N: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\T: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\Z: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\A: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\J: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\L: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\M: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\O: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\P: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\V: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\X: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\Y: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\F: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\G: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\B: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\E: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\H: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\I: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\K: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\Q: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\R: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\S: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\U: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened (read-only) \??\W: 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe -
Drops file in Windows directory 64 IoCs
Processes:
22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mfc42x.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c1197d6e9baee0fb.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mountpointmanager_31bf3856ad364e35_6.1.7601.17514_none_50be2a351da54dd5_mountmgr.sys_77371b26 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..ndprintui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_85f6c12b845befb7_puiapi.dll.mui_e94aeb19 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_f212a9458fcfdbd5_prflbmsg.dll.mui_4caa0054 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..ineclient.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4b32708de9c40b9b_scecli.dll.mui_225fa220 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.1.7601.17514_none_35802f0f452f59bb_dhcpcore6.dll_38a935e4 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_hu-hu_8f3b48a84cb8ca60_msimsg.dll.mui_72e8994f 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-kernel32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_990fb5253ef5803e.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f6a00d30a34ae11a_aelupsvc.dll.mui_5d6cb110 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9d9222b9cac3adcd.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9e8c88ba3cdfd040.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_sr-..-cs_4596701e6fa56fc9.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_th-th_48e4d94ee906cf10.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-profsvc_31bf3856ad364e35_6.1.7601.17514_none_59d75cdc494c95ea_userprofilewmiprovider.mof_b1cb7e72 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c5a9614052e986a8_rasautou.exe.mui_55686a97 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_sv-se_2e3835d3cebb791f_comdlg32.dll.mui_ac8e62f4 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-consolehost.resources_31bf3856ad364e35_6.1.7600.16385_en-us_721c93346b019af5_conhost.exe.mui_eaf216eb 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rpc-kernel_31bf3856ad364e35_6.1.7601.17514_none_1d32894498861e30_msrpc.sys_2e252236 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..ineclient.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a87afa8ef6f1f539_scecli.dll.mui_225fa220 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5_ole32.dll_e9dcc2e3 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c55c4b1f64558323_wudfplatform.dll.mui_d815d31a 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_51a9c0732ea27a7c_wudfhost.exe.mui_1fc689ff 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-daunpenh_31bf3856ad364e35_6.1.7601.17514_none_65eab3ba3a64f6af_daunpenh.ttf_f02ee377 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_de-de_260fca3a475cc286_newdev.dll.mui_914efc6c 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mprmsg.resources_31bf3856ad364e35_6.1.7601.17514_en-us_e305dc58e46187b4.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-ntlanman.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c686c1311f544cad.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4008824c98f8edac_dnsapi.dll_c81f5791 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-tahoma_31bf3856ad364e35_6.1.7600.16385_none_8bc15c538e547e20.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-kernel32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_990fb5253ef5803e_kernel32.dll.mui_c29170cd 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1d2f90411ea5c48a.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da_cmiv2.dll_be06aa9f 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-courier_31bf3856ad364e35_6.1.7600.16385_none_5283fef09ca6fa1a_couree.fon_7511c346 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_6.1.7600.16385_none_db04d3f548508fd9_85f874.fon_2b942d95 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..update-authenticamd_31bf3856ad364e35_6.1.7600.16385_none_599889656b4ace55.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bebeb572af940bcd_comctl32.dll.mui_0da4e682 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-small_31bf3856ad364e35_6.1.7600.16385_none_d7839341959a2de0_smaller.fon_f3e7e3ff 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_fi-fi_e802953b7bce56ec_comdlg32.dll.mui_ac8e62f4 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-directory-services-sam_31bf3856ad364e35_6.1.7601.17514_none_10145eccb79418a5_samlib.dll_caeebf04 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_47c3a7a7b5db2631_dnsapi.dll.mui_97465f8a 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-imageres_31bf3856ad364e35_6.1.7600.16385_none_38b294da11970cde.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-keyiso.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_95503b1f4b07b926_keyiso.dll.mui_4bbf12ff 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ba0c82eccf526351_rascfg.dll.mui_0b036e1f 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e8dccb238c9862b1_rasdiag.dll.mui_15cb4ec4 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1af4bd3e3cd35904_winresume.efi.mui_f412814e 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_he-il_a5612ff788fc14c2_comctl32.dll.mui_0da4e682 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-courier_31bf3856ad364e35_6.1.7600.16385_none_5283fef09ca6fa1a_courf.fon_2a004040 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_de-de_fc571f848681e778.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasserver_31bf3856ad364e35_6.1.7601.17514_none_09cf3ec67e6c6b50_rasmigplugin.dll_7ee2aa40 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-courier_31bf3856ad364e35_6.1.7600.16385_none_5283fef09ca6fa1a_couf1256.fon_26dcd6aa 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0eaa73e1c56d6827_iscsidsc.dll.mui_6acb64a6 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mssign32-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_19ec38460d920c99.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-c..tionauthorityclient_31bf3856ad364e35_6.1.7601.17514_none_35a3baeb53471267_certcli.dll_f553bbce 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..truetype-couriernew_31bf3856ad364e35_6.1.7600.16385_none_32383eb7c6ebfd9b.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_6.1.7600.16385_none_db04d3f548508fd9_j8514fix.fon_cc283848 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-small_31bf3856ad364e35_6.1.7600.16385_none_d7839341959a2de0_smalle.fon_a263d115 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..ltinstall.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0c9d0a808b71e7c0.manifest 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018_loadperf.dll_3a569bab 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b5611bea97b62503_memtest.efi.mui_71e15c22 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_uk-ua_e8c7e489ddaf3a0c_comctl32.dll.mui_0da4e682 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4008824c98f8edac_dnscacheugc.exe_aa32623e 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1988 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exepid process 1972 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 900 vssvc.exe Token: SeRestorePrivilege 900 vssvc.exe Token: SeAuditPrivilege 900 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.execmd.exedescription pid process target process PID 1972 wrote to memory of 1624 1972 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe cmd.exe PID 1972 wrote to memory of 1624 1972 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe cmd.exe PID 1972 wrote to memory of 1624 1972 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe cmd.exe PID 1972 wrote to memory of 1624 1972 22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe cmd.exe PID 1624 wrote to memory of 1988 1624 cmd.exe vssadmin.exe PID 1624 wrote to memory of 1988 1624 cmd.exe vssadmin.exe PID 1624 wrote to memory of 1988 1624 cmd.exe vssadmin.exe PID 1624 wrote to memory of 1988 1624 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe"C:\Users\Admin\AppData\Local\Temp\22a78f99ac3e0035cc824d8c04678a67e470fa9a42d704fa01c254ec05be2ae3.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:1988
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1972-55-0x0000000074B21000-0x0000000074B23000-memory.dmpFilesize
8KB