Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-01-2022 07:57
Static task
static1
Behavioral task
behavioral1
Sample
2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe
Resource
win10-en-20211208
General
-
Target
2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe
-
Size
157KB
-
MD5
d8c7d853d3af593805d5be7a06aa44eb
-
SHA1
2fb9eb11bb466142a0d3a0985495dfe1194339cc
-
SHA256
2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5
-
SHA512
2e8dfec998de140b670e6342df6d630c9208a529664674323fd538545b1649fbb4aacabe654e3f007e6974b1e1b7dcfe90fd1c8bfa2e7f7473c19ef60d8cc321
Malware Config
Extracted
C:\Program Files\8to2035-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C873CBEACC27B5AA
http://decryptor.top/C873CBEACC27B5AA
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exedescription ioc process File renamed C:\Users\Admin\Pictures\HideUninstall.raw => C:\Users\Admin\Pictures\HideUninstall.raw.8to2035 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File renamed C:\Users\Admin\Pictures\SuspendUse.png => C:\Users\Admin\Pictures\SuspendUse.png.8to2035 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File renamed C:\Users\Admin\Pictures\SwitchRemove.raw => C:\Users\Admin\Pictures\SwitchRemove.raw.8to2035 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Pictures\OutUse.tiff 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File renamed C:\Users\Admin\Pictures\CopyAdd.tiff => C:\Users\Admin\Pictures\CopyAdd.tiff.8to2035 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File renamed C:\Users\Admin\Pictures\CopyLock.raw => C:\Users\Admin\Pictures\CopyLock.raw.8to2035 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File renamed C:\Users\Admin\Pictures\OpenWait.tif => C:\Users\Admin\Pictures\OpenWait.tif.8to2035 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File renamed C:\Users\Admin\Pictures\OutUse.tiff => C:\Users\Admin\Pictures\OutUse.tiff.8to2035 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File renamed C:\Users\Admin\Pictures\SyncGroup.png => C:\Users\Admin\Pictures\SyncGroup.png.8to2035 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Pictures\CopyAdd.tiff 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File renamed C:\Users\Admin\Pictures\ClearInvoke.tif => C:\Users\Admin\Pictures\ClearInvoke.tif.8to2035 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File renamed C:\Users\Admin\Pictures\CloseCompare.raw => C:\Users\Admin\Pictures\CloseCompare.raw.8to2035 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe -
Drops desktop.ini file(s) 38 IoCs
Processes:
2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Music\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Users\Public\desktop.ini 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exedescription ioc process File opened (read-only) \??\O: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\P: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\W: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\X: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\A: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\F: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\M: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\N: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\D: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\E: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\L: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\V: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\Y: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\S: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\U: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\B: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\J: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\K: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\Q: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\T: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\Z: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\G: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\H: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\I: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened (read-only) \??\R: 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hls353b.bmp" 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exedescription ioc process File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\8to2035-readme.txt 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.0.2.jar 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\20.png 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single.png 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0296279.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\ja-JP\wordpad.exe.mui 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PIXEL.ELM 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Riga 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielResume.Dotx 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_OFF.GIF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericonMask.bmp 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File created C:\Program Files\VideoLAN\VLC\plugins\8to2035-readme.txt 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File created C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\8to2035-readme.txt 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00448_.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLKIRMV.XML 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00806_.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02265_.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8to2035-readme.txt 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\4.png 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_s.png 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\cpu.js 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Austin.thmx 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL078.XML 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01627_.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14565_.GIF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02439_.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18223_.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15171_.GIF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Windows NT\TableTextService\ja-JP\TableTextService.dll.mui 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107090.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01154_.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Verve.xml 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STC 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL089.XML 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18222_.WMF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\8to2035-readme.txt 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File created C:\Program Files\DVD Maker\es-ES\8to2035-readme.txt 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341559.JPG 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 772 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exepid process 1736 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1364 vssvc.exe Token: SeRestorePrivilege 1364 vssvc.exe Token: SeAuditPrivilege 1364 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.execmd.exedescription pid process target process PID 1736 wrote to memory of 1100 1736 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe cmd.exe PID 1736 wrote to memory of 1100 1736 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe cmd.exe PID 1736 wrote to memory of 1100 1736 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe cmd.exe PID 1736 wrote to memory of 1100 1736 2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe cmd.exe PID 1100 wrote to memory of 772 1100 cmd.exe vssadmin.exe PID 1100 wrote to memory of 772 1100 cmd.exe vssadmin.exe PID 1100 wrote to memory of 772 1100 cmd.exe vssadmin.exe PID 1100 wrote to memory of 772 1100 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe"C:\Users\Admin\AppData\Local\Temp\2181579e0125e8087a3269ee8a90a973307f67eceb7122fdc7463db6bc5050b5.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:772
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1736-55-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB