Analysis
-
max time kernel
182s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
01-02-2022 01:25
Static task
static1
Behavioral task
behavioral1
Sample
ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe
Resource
win10v2004-en-20220112
General
-
Target
ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe
-
Size
69KB
-
MD5
fead7dc34c78049f8c85151f3596f732
-
SHA1
57ca011a891619aa2c10058f0c03d38e36247dcc
-
SHA256
ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79
-
SHA512
df1d70b3b3db9307a66d24c1850fc2ad685f391d0d6ddc8d604e6fbe4740c97d8d220fab705513236b81c5c93c0ce142b1e9c36898ee07a7bdd279136425171b
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\RequestRegister.tiff ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\WinMetadata\Microsoft.UI.Xaml.winmd ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageLargeTile.scale-125.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-30_altform-unplated.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\km.pak.DATA ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageLargeTile.scale-150.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-black_scale-100.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7dc.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch-Dark.scale-400.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-32_altform-unplated.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-125.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\AppxManifest.xml ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\14891C-Readme.txt ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailBadge.scale-400.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Images\BlankImage.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-72_altform-lightunplated.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-400.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\load-typekit.js ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\6.jpg ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-300.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-36.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_contrast-white.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailSmallTile.scale-400.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-96_altform-unplated.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_hr.json ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-white_scale-100.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-200.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-129.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-200_contrast-black.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\HoloAssets\HoloLens_HeadTracking.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-64_altform-unplated_contrast-white.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteReplayCrossHairIcon-1.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupSmallTile.scale-400.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\moe_status_icons.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\kweather.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_Full.aapp ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-unplated.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\SmallLogoBeta.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_altform-unplated.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-32_contrast-white.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.contrast-white_scale-100.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-20.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-150_contrast-black.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d9.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\HelpThumbnail.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sun.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-250.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-256_altform-unplated.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\manifest.json ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeWideTile.scale-400.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100_contrast-high.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-400.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-16.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\151.png ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2492 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe Token: SeImpersonatePrivilege 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe Token: SeBackupPrivilege 2876 vssvc.exe Token: SeRestorePrivilege 2876 vssvc.exe Token: SeAuditPrivilege 2876 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1252 wrote to memory of 2492 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 54 PID 1252 wrote to memory of 2492 1252 ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe"C:\Users\Admin\AppData\Local\Temp\ae2f99e7858ba084520795e0ac40f7f511b9242f5079069ed359934f523b4f79.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2492
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:7248
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2876