Analysis
-
max time kernel
170s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
01-02-2022 01:31
Static task
static1
Behavioral task
behavioral1
Sample
55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe
Resource
win10v2004-en-20220112
General
-
Target
55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe
-
Size
69KB
-
MD5
a2de690489ee5d8b3cd06fdea0a63670
-
SHA1
5f94ad2d365ae9c233b3f9ef68470c03e45aba64
-
SHA256
55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb
-
SHA512
0fb16a63055cc5cd13464ce3d414f7efe8c41abe4da98614629d2af2116ea9f2742edaaf7ca77ef33a26b8e0552e9bc149edbec7029b87c24fb77cd2d674a476
Malware Config
Extracted
C:\Users\Admin\Desktop\BAA3E3-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exedescription ioc process File renamed C:\Users\Admin\Pictures\SkipUnpublish.tif => C:\Users\Admin\Pictures\SkipUnpublish.tif.baa3e3 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File renamed C:\Users\Admin\Pictures\CompareUpdate.tif => C:\Users\Admin\Pictures\CompareUpdate.tif.baa3e3 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File renamed C:\Users\Admin\Pictures\BlockWatch.tif => C:\Users\Admin\Pictures\BlockWatch.tif.baa3e3 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File renamed C:\Users\Admin\Pictures\ExitClose.png => C:\Users\Admin\Pictures\ExitClose.png.baa3e3 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File renamed C:\Users\Admin\Pictures\SelectUpdate.png => C:\Users\Admin\Pictures\SelectUpdate.png.baa3e3 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File renamed C:\Users\Admin\Pictures\UpdateResume.crw => C:\Users\Admin\Pictures\UpdateResume.crw.baa3e3 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\jawt.lib 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\snooze.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-100.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-unplated.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxManifest.xml 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Misc_Clickpop.m4a 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xecd2.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-200_contrast-black.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageSmallTile.scale-125.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-16.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-32.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-unplated_contrast-black.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-200.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-100.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-400.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_CarReservation_Light.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-32.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\logo.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Opacity.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-48.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\CoreEngine\Data\BrushProfile\BrushBump64.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\NativePurchaseControl.xaml 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_altform-lightunplated.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\resources.pri 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Light.scale-400.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ar.pak 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-256.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_same_reviewers.gif 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\resources.pri 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-24_contrast-black.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\IrisProtocol.winmd 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\TimeBackground.winmd 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-400.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-36_altform-unplated.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-150.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-125.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-200.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageSmallTile.scale-400.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-unplated.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-64.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.dll.sig 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Snooze.scale-80.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_2_Loud.m4a 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\PRNDMediaSource.winmd 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymxb.ttf 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\AppIcon.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Fonts\SkypeAssets-Medium.ttf 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-40_altform-unplated_contrast-white.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-80.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-400.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-790714498-1549421491-1643397139-1000-MergedResources-0.pri 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\LICENSE 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-32_contrast-black.png 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-US.Calendar.model 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2076 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exepid process 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exedescription pid process Token: SeDebugPrivilege 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe Token: SeImpersonatePrivilege 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exedescription pid process target process PID 616 wrote to memory of 2076 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe vssadmin.exe PID 616 wrote to memory of 2076 616 55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe"C:\Users\Admin\AppData\Local\Temp\55cdf7ea2da073657b79bed6ac128f61c20519a41715b1675c509face60fb9bb.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵