Analysis
-
max time kernel
174s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 07:59
Static task
static1
Behavioral task
behavioral1
Sample
17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe
Resource
win10-en-20211208
General
-
Target
17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe
-
Size
164KB
-
MD5
ca337c7130eef4f4ff8e8a4a8ec28647
-
SHA1
28558e35d3f9af01fe438eba7fba1c38201c86de
-
SHA256
17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467
-
SHA512
60b9b7841a942a6bcb700872b6ff1353fd282a7b318d6ac8d47e419573978aff43c961436a2fdb6a076e81545ef9759e7848fdc9eaa5a571638ab19d666a1c1c
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exedescription ioc process File opened (read-only) \??\I: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\S: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\H: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\E: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\J: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\O: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\U: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\V: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\X: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\A: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\K: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\Q: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\T: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\W: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\Y: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\Z: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\F: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\G: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\L: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\M: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\N: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\P: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\R: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened (read-only) \??\B: 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe -
Drops file in Windows directory 64 IoCs
Processes:
17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.15063.0_de-de_2f0789d5a19c2218_wudfplatform.dll.mui_d815d31a 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_sv-se_b76ddd15406997ba_memtest.exe.mui_77b8cbcc 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_en-us_fc172dc3df31b12e.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_eb8784774de6a9ad_iscsium.dll_edf4260f 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-twinapi_31bf3856ad364e35_10.0.15063.0_none_d6c5b2afd3cdeb43.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_92b2e4a927d14296.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ntasn1-dll_31bf3856ad364e35_10.0.15063.0_none_cb47c93ffda3742a_ntasn1.dll_a6567dcf 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ntosext_31bf3856ad364e35_10.0.15063.0_none_e5070f42682b7231_ntosext.sys_e9e096c6 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_7de2193a2131f2d5_user32.dll.mui_14652dbb 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wbiosrvc.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_2b73c2b7262e9b8a.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmilib_31bf3856ad364e35_10.0.15063.0_none_6a68d3903cfb6ab2_wmilib.sys_0dcce989 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-cryptbase_31bf3856ad364e35_10.0.15063.0_none_7679aeb1e6c8b09d_cryptbase.dll_83e36053 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-efs-service.resources_31bf3856ad364e35_10.0.15063.0_en-us_5df6e82b85a049fd.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_en-us_c3c95b73e48b1ae8_iscsicli.exe.mui_64c0a23c 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_de-de_b9999da0dd11d89a_msimsg.dll.mui_72e8994f 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_bg-bg_3839d6513809d2fd_comctl32.dll.mui_0da4e682 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ui-xaml-controls_31bf3856ad364e35_10.0.15063.0_none_314522d34b560919_windows.ui.xaml.controls.private.dll_8dc0d676 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-m..ntmanager.resources_31bf3856ad364e35_10.0.15063.0_es-es_4dec66e6783cb498_mountmgr.sys.mui_71b54a25 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..gc-kspsvc.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_4d03cf87179eca2a_ngcsvc.dll.mui_96312421 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-ui-xaml-maps_31bf3856ad364e35_10.0.15063.0_none_a861864702eca1e1_windows.ui.xaml.maps.dll_b092594a 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_da-dk_b3902ceb83e56874.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_nb-no_e1663e689467fdb8.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-appidcore.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_174418e7a8ce4d04_applockercsp.dll.mui_d2a0df70 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-directory-services-sam_31bf3856ad364e35_10.0.15063.0_none_cd56dce90e2409c7_offlinesam.dll_5e21eef0 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.15063.0_none_091ece90de4588c6_msvcp110_win.dll_397cf9b6 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_ega40852.fon_5e9154f7 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua-filevirtualization_31bf3856ad364e35_10.0.15063.0_none_78f4fe0cdd696494_luafv.sys_602842f9 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_a3a63dfe70f0e46f_userdeviceregistration.ngc.dll.mui_d2c6ca95 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.15063.0_none_a69f8cf95bf4534e.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_pt-br_59d1ffcc04432003.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..gc-kspsvc.resources_31bf3856ad364e35_10.0.15063.0_es-es_aa4c598824ccb3c8.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.15063.0_none_5f76fb5d5934b9cf.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.15063.0_es-es_6099713577ddb2af_wininit.exe.mui_997435f5 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_10.0.15063.0_none_ffa06ca6283461f7.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_10.0.15063.0_es-es_fc67a3294b02806b.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_e477adbb7e0017f7_volmgrx.sys.mui_b0c205d7 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_el-gr_6dec26b9213f9155.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..erservice.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_a45e22cdbd9c3ec0_umpo.dll.mui_cac12e54 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-crypt32-dll_31bf3856ad364e35_10.0.15063.0_none_76d845674b03423d.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_et-ee_67d1f793253502c0_comctl32.dll.mui_0da4e682 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_8514fix.fon_dc96978e 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.15063.0_es-es_718d54164909dde7.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_10.0.15063.0_none_de44366355bc504a_shsvcs.dll_f8739230 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tdi-driver_31bf3856ad364e35_10.0.15063.0_none_780221c56ec53292.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_8cee407ae5edcfbb.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_lt-lt_cfb1e90d16785ae6_comctl32.dll.mui_0da4e682 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_es-es_c394b857e4b20c8d_iscsicli.exe.mui_64c0a23c 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_10.0.15063.0_en-us_ff9ea33ba51dcc3d.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..gc-kspsvc.resources_31bf3856ad364e35_10.0.15063.0_de-de_019026ab35c7b65e_ngcsvc.dll.mui_96312421 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lsa_31bf3856ad364e35_10.0.15063.0_none_b75e63fb9599f19e_offlinelsa.dll_26ff60c5 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-time-service.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_92e9ee428a325ae8.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sv-se_3ec89a49bcc7ced5.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_et-ee_9ae4f76b8d42c00d.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_fr-fr_43dca1da7c0ef9e0_comctl32.dll.mui_0da4e682 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-etw-ese.resources_31bf3856ad364e35_10.0.15063.0_en-us_0566b22d184bc27d_etweseproviderresources.dll.mui_242b0636 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.15063.0_none_3fe4b2c9ef33a509_applockerfltr.sys_6a9d2cba 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-imm32_31bf3856ad364e35_10.0.15063.0_none_6d69f74fb339b66a.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_10.0.15063.0_none_8815846f65bab26d_drvinst.exe_6593e92a 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_hr-hr_0f58c5ace4a78141_comctl32.dll.mui_0da4e682 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_hu-hu_8b4d2222606ec8fc.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-crypt32-dll_31bf3856ad364e35_10.0.15063.0_none_76d845674b03423d_crypt32.dll_9c3ccf73 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_8836c38c5592b4d0.manifest 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_ega40866.fon_5e8c53bc 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shacct_31bf3856ad364e35_10.0.15063.0_none_d7160ce35a44058a_shacct.dll_f953c950 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4088 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exepid process 3732 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe 3732 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3900 vssvc.exe Token: SeRestorePrivilege 3900 vssvc.exe Token: SeAuditPrivilege 3900 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.execmd.exedescription pid process target process PID 3732 wrote to memory of 2312 3732 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe cmd.exe PID 3732 wrote to memory of 2312 3732 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe cmd.exe PID 3732 wrote to memory of 2312 3732 17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe cmd.exe PID 2312 wrote to memory of 4088 2312 cmd.exe vssadmin.exe PID 2312 wrote to memory of 4088 2312 cmd.exe vssadmin.exe PID 2312 wrote to memory of 4088 2312 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe"C:\Users\Admin\AppData\Local\Temp\17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken