medusalocker | 6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e

General

Target

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
Size

707KB
MD5

0ea3051e5173035fc97c403746d67437
SHA1

e04260b5cc147207c3d18b9a486cb636b3a46ff8
SHA256

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e
SHA512

9afdcf3ffd9190362900c55f02172f5c9d1033e7e618b627b0efbda170eb31114547d9808ad161dfa08dc135fe311d096a8317370d5e7cefaf2e263ac118c85d

Score

10^/10

medusalocker neshta evasion persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

\??\Z:\Boot\Recovery_Instructions.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">C465B41C894F9E47D88D08FC63A495CCF7125FD8BD68710065A0CBD6E956ED59EE8043B0AE15493B4A5FF075E67A7CA4F58A61AD17000A5D26CF85F4A3B04A13<br>6E466A4ADA4614121EF5D5C39C950C230C0978B127E3FED95E4699572E777ECF7FF7CF145702EA2959CFFC807C42C14B41A820AE1F120144C6116A33D711<br>21BA1034A75013BE92CFA99EEF08F70D81D15F30C464D5AD4638B947EBC5D63C38621BE062451F642C5867677C04022586D3895C3DE5BA08EA9B53C98374<br>4C45E3C30ACC7667B0B3DC1BEE593D74CB858A26EDB77E6418182F8D698F2026D770DC1AB859948A27B7FBC74513D6F1403CB8148AC7E07AD623460E5DBE<br>5DEE9DF4E4984E518927579884208F3830249E9FFDDC501F205A96CD52D4336C8051F27B3862421017477B2C624044478ABFC782C88221CB359F2FD27BC3<br>8FC39642FF54F03BDB2F96ADA570CFD7D95D1A8D3E35350C3BA79227F4D489064F0F796E12A104F418E77F67A2B58AE6EC5532121A637778C726CD95D660<br>AAEA2FA3E483707FF14B72C01C5D46CA1FBBF0F2CE1250758F55996F7E09B48378A0DAAEE050E38F2E595D1318F19D1FD3D1EB66D357BB10D6274153137F<br>9387EACF0225C54A13B387E2178DFA449775596A73D4B35FA7B20FC49624DB5714D95EF0F885640ADC363F4378A13C48E1BA1F085EE56A555CEAAA021C21<br>2D09BE8E3F74D382CDF8B786743D</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br> YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMENANTLY DESTROY YOUR FILE.<br> DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br> NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br> SOLUTION TO YOUR PROBLEM.<br><br> WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br> ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br> IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br> AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br> NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br> YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br> DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br> BACK.<br><br>  <hr> <b>CONTACT US FOR PRICE (BITCOIN) AND GET DECRYPTION SOFTWARE.</b><br><br> <a href="mailto:[email protected]">[email protected]</a><br> <a href="mailto:[email protected]">[email protected]</a> <hr> </div> <div class="text"> MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

href="mailto:[email protected]">[email protected]</a><br>

href="mailto:[email protected]">[email protected]</a>

Signatures

Detect Neshta Payload 1 IoCs

Processes:

resource	yara_rule
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE	family_neshta

MedusaLocker
Ransomware with several variants first seen in September 2019.
ransomware medusalocker

MedusaLocker Payload 6 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\3582-490\6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	family_medusalocker
C:\Users\Admin\AppData\Local\Temp\3582-490\6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	family_medusalocker
C:\Users\Admin\AppData\Local\Temp\3582-490\6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	family_medusalocker
C:\Users\Admin\AppData\Roaming\svhost.exe	family_medusalocker
C:\Users\Admin\AppData\Roaming\svhost.exe	family_medusalocker
\Users\Admin\AppData\Roaming\svhost.exe	family_medusalocker

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exesvhost.exe

pid process

1492 6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1316 svhost.exe

Loads dropped DLL 3 IoCs

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

pid	process
1692	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1692	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1692	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

description	ioc	process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-3846991908-3261386348-1409841751-1000\desktop.ini	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

description	ioc	process
File opened (read-only)	\??\H:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\R:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\S:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\M:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\O:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\P:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\Q:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\A:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\E:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\I:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\K:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\U:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\Y:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\X:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\Z:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\B:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\L:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\N:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\T:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\W:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\F:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\G:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\J:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened (read-only)	\??\V:	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

Drops file in Program Files directory 64 IoCs

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

Drops file in Windows directory 1 IoCs

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

description ioc process

File opened for modification C:\Windows\svchost.com 6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

740 vssadmin.exe
568 vssadmin.exe
1100 vssadmin.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

pid	process
740	vssadmin.exe
568	vssadmin.exe
1100	vssadmin.exe

Modifies registry class 1 IoCs

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

pid	process
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

vssvc.exewmic.exewmic.exewmic.exe

description	pid	process
Token: SeBackupPrivilege	532	vssvc.exe
Token: SeRestorePrivilege	532	vssvc.exe
Token: SeAuditPrivilege	532	vssvc.exe
Token: SeIncreaseQuotaPrivilege	364	wmic.exe
Token: SeSecurityPrivilege	364	wmic.exe
Token: SeTakeOwnershipPrivilege	364	wmic.exe
Token: SeLoadDriverPrivilege	364	wmic.exe
Token: SeSystemProfilePrivilege	364	wmic.exe
Token: SeSystemtimePrivilege	364	wmic.exe
Token: SeProfSingleProcessPrivilege	364	wmic.exe
Token: SeIncBasePriorityPrivilege	364	wmic.exe
Token: SeCreatePagefilePrivilege	364	wmic.exe
Token: SeBackupPrivilege	364	wmic.exe
Token: SeRestorePrivilege	364	wmic.exe
Token: SeShutdownPrivilege	364	wmic.exe
Token: SeDebugPrivilege	364	wmic.exe
Token: SeSystemEnvironmentPrivilege	364	wmic.exe
Token: SeRemoteShutdownPrivilege	364	wmic.exe
Token: SeUndockPrivilege	364	wmic.exe
Token: SeManageVolumePrivilege	364	wmic.exe
Token: 33	364	wmic.exe
Token: 34	364	wmic.exe
Token: 35	364	wmic.exe
Token: SeIncreaseQuotaPrivilege	2044	wmic.exe
Token: SeSecurityPrivilege	2044	wmic.exe
Token: SeTakeOwnershipPrivilege	2044	wmic.exe
Token: SeLoadDriverPrivilege	2044	wmic.exe
Token: SeSystemProfilePrivilege	2044	wmic.exe
Token: SeSystemtimePrivilege	2044	wmic.exe
Token: SeProfSingleProcessPrivilege	2044	wmic.exe
Token: SeIncBasePriorityPrivilege	2044	wmic.exe
Token: SeCreatePagefilePrivilege	2044	wmic.exe
Token: SeBackupPrivilege	2044	wmic.exe
Token: SeRestorePrivilege	2044	wmic.exe
Token: SeShutdownPrivilege	2044	wmic.exe
Token: SeDebugPrivilege	2044	wmic.exe
Token: SeSystemEnvironmentPrivilege	2044	wmic.exe
Token: SeRemoteShutdownPrivilege	2044	wmic.exe
Token: SeUndockPrivilege	2044	wmic.exe
Token: SeManageVolumePrivilege	2044	wmic.exe
Token: 33	2044	wmic.exe
Token: 34	2044	wmic.exe
Token: 35	2044	wmic.exe
Token: SeIncreaseQuotaPrivilege	1828	wmic.exe
Token: SeSecurityPrivilege	1828	wmic.exe
Token: SeTakeOwnershipPrivilege	1828	wmic.exe
Token: SeLoadDriverPrivilege	1828	wmic.exe
Token: SeSystemProfilePrivilege	1828	wmic.exe
Token: SeSystemtimePrivilege	1828	wmic.exe
Token: SeProfSingleProcessPrivilege	1828	wmic.exe
Token: SeIncBasePriorityPrivilege	1828	wmic.exe
Token: SeCreatePagefilePrivilege	1828	wmic.exe
Token: SeBackupPrivilege	1828	wmic.exe
Token: SeRestorePrivilege	1828	wmic.exe
Token: SeShutdownPrivilege	1828	wmic.exe
Token: SeDebugPrivilege	1828	wmic.exe
Token: SeSystemEnvironmentPrivilege	1828	wmic.exe
Token: SeRemoteShutdownPrivilege	1828	wmic.exe
Token: SeUndockPrivilege	1828	wmic.exe
Token: SeManageVolumePrivilege	1828	wmic.exe
Token: 33	1828	wmic.exe
Token: 34	1828	wmic.exe
Token: 35	1828	wmic.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exetaskeng.exe

description	pid	process	target process
PID 1692 wrote to memory of 1492	1692	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
PID 1692 wrote to memory of 1492	1692	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
PID 1692 wrote to memory of 1492	1692	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
PID 1692 wrote to memory of 1492	1692	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
PID 1492 wrote to memory of 568	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 568	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 568	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 568	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 364	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1492 wrote to memory of 364	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1492 wrote to memory of 364	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1492 wrote to memory of 364	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1492 wrote to memory of 1100	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 1100	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 1100	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 1100	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 2044	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1492 wrote to memory of 2044	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1492 wrote to memory of 2044	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1492 wrote to memory of 2044	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1492 wrote to memory of 740	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 740	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 740	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 740	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	vssadmin.exe
PID 1492 wrote to memory of 1828	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1492 wrote to memory of 1828	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1492 wrote to memory of 1828	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1492 wrote to memory of 1828	1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe	wmic.exe
PID 1576 wrote to memory of 1316	1576	taskeng.exe	svhost.exe
PID 1576 wrote to memory of 1316	1576	taskeng.exe	svhost.exe
PID 1576 wrote to memory of 1316	1576	taskeng.exe	svhost.exe
PID 1576 wrote to memory of 1316	1576	taskeng.exe	svhost.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe

C:\Users\Admin\AppData\Local\Temp\6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
"C:\Users\Admin\AppData\Local\Temp\6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1692

C:\Users\Admin\AppData\Local\Temp\3582-490\6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1492

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:568

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:364

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:1100

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:740

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:532

C:\Windows\system32\taskeng.exe
taskeng.exe {3DA76330-2CDC-4941-A2FA-5F5EE2A5A25B} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
2⤵
- Executes dropped EXE
PID:1316

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

File Deletion

Modify Registry

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
MD5
70e413d7ff7f9c2a7ab5fafebf3e4d4a

SHA1
0129ad15e2baf730306d578761da2e933359d78d

SHA256
27ae04d6e8a7d390742b4e9a472e8980a37f8ca7d3c19d0a06c9531f67e04c0b

SHA512
e47d9f6e354b02cf3b3560ec6ca6f33cb2910effd3cadc200d36781de63ff99037efb2c54b3886a7606e602c9ab24d3988f2ea39a9f9b8abfc308bbec1bfd3c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
MD5
72874d97065bbcebbd165f0c347910c8

SHA1
252f9105fe80f0167006569641a769c11c663787

SHA256
5aa810e4891538670cc0db6274b7276abe84e8ccbbaef1d3b1208b9ad419a9fa

SHA512
ccf5f128094bf83c37b4ad5116fe156edc47f3e584a2aa5db05a968a1fd6e37f93c5687e1ce2bee2978610f38b479e2b0d6ae4af12304b9a2d83a1d5fd6b1628

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
MD5
72874d97065bbcebbd165f0c347910c8

SHA1
252f9105fe80f0167006569641a769c11c663787

SHA256
5aa810e4891538670cc0db6274b7276abe84e8ccbbaef1d3b1208b9ad419a9fa

SHA512
ccf5f128094bf83c37b4ad5116fe156edc47f3e584a2aa5db05a968a1fd6e37f93c5687e1ce2bee2978610f38b479e2b0d6ae4af12304b9a2d83a1d5fd6b1628

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe
MD5
72874d97065bbcebbd165f0c347910c8

SHA1
252f9105fe80f0167006569641a769c11c663787

SHA256
5aa810e4891538670cc0db6274b7276abe84e8ccbbaef1d3b1208b9ad419a9fa

SHA512
ccf5f128094bf83c37b4ad5116fe156edc47f3e584a2aa5db05a968a1fd6e37f93c5687e1ce2bee2978610f38b479e2b0d6ae4af12304b9a2d83a1d5fd6b1628

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe
MD5
72874d97065bbcebbd165f0c347910c8

SHA1
252f9105fe80f0167006569641a769c11c663787

SHA256
5aa810e4891538670cc0db6274b7276abe84e8ccbbaef1d3b1208b9ad419a9fa

SHA512
ccf5f128094bf83c37b4ad5116fe156edc47f3e584a2aa5db05a968a1fd6e37f93c5687e1ce2bee2978610f38b479e2b0d6ae4af12304b9a2d83a1d5fd6b1628

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
MD5
72874d97065bbcebbd165f0c347910c8

SHA1
252f9105fe80f0167006569641a769c11c663787

SHA256
5aa810e4891538670cc0db6274b7276abe84e8ccbbaef1d3b1208b9ad419a9fa

SHA512
ccf5f128094bf83c37b4ad5116fe156edc47f3e584a2aa5db05a968a1fd6e37f93c5687e1ce2bee2978610f38b479e2b0d6ae4af12304b9a2d83a1d5fd6b1628

Download Submit
\Users\Admin\AppData\Roaming\svhost.exe
MD5
72874d97065bbcebbd165f0c347910c8

SHA1
252f9105fe80f0167006569641a769c11c663787

SHA256
5aa810e4891538670cc0db6274b7276abe84e8ccbbaef1d3b1208b9ad419a9fa

SHA512
ccf5f128094bf83c37b4ad5116fe156edc47f3e584a2aa5db05a968a1fd6e37f93c5687e1ce2bee2978610f38b479e2b0d6ae4af12304b9a2d83a1d5fd6b1628

Download Submit
memory/1692-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download

pid	process
1492	6b9ca4cbb68f23e164625614d9d074b7bb9e2c5aeb429034ed4d6440594ce64e.exe
1316	svhost.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads