Analysis
-
max time kernel
176s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
01-02-2022 01:28
Static task
static1
Behavioral task
behavioral1
Sample
8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe
Resource
win10v2004-en-20220113
General
-
Target
8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe
-
Size
69KB
-
MD5
b76547ddbc0e1629cd71bfff6bfce483
-
SHA1
874b1a91edf573896c1d03c79875b45d1508d4f7
-
SHA256
8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840
-
SHA512
699ffeb2ed7d89006ec464977aff4bcbd1ac0725b9a5083b72f6440653b9b00a591eaf8c30328e005d3f3e16de87d4dd490725fffa905c6e1c0ae58eedfc1e6b
Malware Config
Extracted
C:\ProgramData\Microsoft\MF\BBF5A1-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ConvertFromRevoke.tiff 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Users\Admin\Pictures\RevokeStop.tiff 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Users\Admin\Pictures\SuspendMeasure.tiff 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.scale-100.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-150_contrast-white.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\star_half.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\DialRotation.mp4 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-24_altform-unplated.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubGameBar.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-48_altform-unplated_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-150.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-150_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36_altform-unplated_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File created C:\Program Files (x86)\Microsoft\Edge\BBF5A1-Readme.txt 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220113113529.pma 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notificationCenter.css 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_altform-unplated_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-32_altform-unplated_contrast-white.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-100_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-24_altform-lightunplated.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCache.scale-100.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-200_contrast-white.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\resources.pri 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-black_scale-200.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Fonts\SkypeAssets-Medium.ttf 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-125.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-125.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hi-IN\View3d\3DViewerProductDescription-universal.xml 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-400_contrast-white.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteWideTile.scale-200.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookMedTile.scale-125.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupWideTile.scale-400.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_scale-200.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Paint3D.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-32.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-64.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\1px.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-unplated_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\archives\archive_manifest.json 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-150.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\onenote-winrt-16.00.js 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-150.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-16.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlOuterCircle.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-256_altform-unplated.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxMediumTile.scale-200.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\iheart-radio.scale-100_contrast-white.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-256_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-32_altform-unplated_contrast-white.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymk.ttf 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-150_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_altform-unplated_contrast-black.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\8041_24x24x32.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-40.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-32.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Lighting.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-150.png 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2072 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exepid process 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exevssvc.exedescription pid process Token: SeDebugPrivilege 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe Token: SeImpersonatePrivilege 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe Token: SeBackupPrivilege 4080 vssvc.exe Token: SeRestorePrivilege 4080 vssvc.exe Token: SeAuditPrivilege 4080 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exedescription pid process target process PID 480 wrote to memory of 2072 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe vssadmin.exe PID 480 wrote to memory of 2072 480 8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe"C:\Users\Admin\AppData\Local\Temp\8753133dfcece88e52666fcf7e1a79400284b430ccb6320c78e425f6c5cf6840.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken