Analysis
-
max time kernel
171s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
01-02-2022 01:36
Static task
static1
Behavioral task
behavioral1
Sample
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe
Resource
win10v2004-en-20220112
General
-
Target
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe
-
Size
69KB
-
MD5
412a0cf41cc1e85ac7ffdc0ccebd5475
-
SHA1
b86332d642d62fc945c015e3ae2f942a844ab948
-
SHA256
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8
-
SHA512
6830bc65ea37f5593b60923f37aab8e2aaea29230e110b44d45225361978253eb8a0066d73e3376cea69dc1d0af5b80c66c8e381dc2207041ae56836bcaa2c59
Malware Config
Extracted
C:\Users\Admin\Favorites\18EFE7-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\WaitDisable.tiff 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-250.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-48_altform-lightunplated.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\bubble\light.gif 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookSmallTile.scale-400.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1949_24x24x32.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Exchange.scale-400.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_contrast-white.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources.pri 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1850_40x40x32.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_Flight_Light.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-300.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MotionController_Hero.jpg 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\resources.pri 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-32_altform-lightunplated.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSmallTile.scale-100.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\202.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-100_contrast-high.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-48_contrast-black.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\MedTile.scale-125.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Rainbow.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-80_altform-unplated.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_bg.json 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File created C:\Program Files\Common Files\DESIGNER\18EFE7-Readme.txt 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-72_altform-unplated_contrast-black.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\appuri.model 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-400.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-300.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Dark.scale-250.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\15.jpg 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\onenote_whatsnew.xml 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-32_altform-unplated_contrast-black.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-80.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-80_altform-unplated.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark2x.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SmallTile.scale-100_contrast-black.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail.scale-150.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square44x44Logo.targetsize-48_altform-unplated.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLargeTile.scale-200.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-colorize.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-125.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-30.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-US.PhoneNumber.ot 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons_2x.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupMedTile.scale-150.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-400_contrast-black.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-150.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBarNotificationLogo.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\172.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\ui-strings.js 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsymxl.ttf 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-20_altform-unplated.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-20_contrast-white.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-GB.PostalAddress.ot 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailBadge.scale-200.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedStoreLogo.scale-100_contrast-black.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-125.png 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1436 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exepid process 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exevssvc.exedescription pid process Token: SeDebugPrivilege 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe Token: SeImpersonatePrivilege 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe Token: SeBackupPrivilege 4712 vssvc.exe Token: SeRestorePrivilege 4712 vssvc.exe Token: SeAuditPrivilege 4712 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exedescription pid process target process PID 2880 wrote to memory of 1436 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe vssadmin.exe PID 2880 wrote to memory of 1436 2880 11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe"C:\Users\Admin\AppData\Local\Temp\11117145652ed5e6cb36a8480fc4da64de65a784510d3240548869af056dcde8.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken