Analysis
-
max time kernel
157s -
max time network
137s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01/02/2022, 15:50
Static task
static1
Behavioral task
behavioral1
Sample
1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe
-
Size
662KB
-
MD5
9148e0f611793ed63f4348501b3f3f9d
-
SHA1
47b8bf8860f7c5d4c25cad24de6ab6cf525fa74f
-
SHA256
1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f
-
SHA512
4f78d1dbbf70c044e86d979d646df26d4868297ffe7d59e2769bbd291c9b41a344e1d97b65bfbf74b012b39aa7cc41e0cd19003ca04e05a6572f7185023386ad
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">3FB10C25713CBE4CC8D318FC8B2B6A200205296F61E14C51AB069BAD32A201D19F6700EF5D2784A71D839C00CDAA28D14941AC6101658B83060417049DCCFD80<br>EB36BED4C7E3978C2722401D121935DD0BAF7252D3E7564AF8ACF9473131ADC4208D34273698238C13162BDD4853671CD0FAD5D5A02A1967EA3806F00187<br>393F6E0576ED850FE488498C559D68FE33ABE931CABEABD143C9149E2C28B4BFF284CEBA1955DEC596497285C63C1124E8CECB574494E2DF09FB08FF18A7<br>BFC4F9B90C27884D9330A858F089651F1227F5B111E0DD4269C8B72DF5276F38DDF3471ED883CCBF1FCFE056CAF814B3BE693A7DB8861D981926EA88F67A<br>A20921032B7E4C9526DFDC8FB841006D409B016DB32E4CBACD43E0106B75922AD7A2C18545D63E7E1A05756127117720E4B4F220857BD6107BE6916FA6BF<br>E58F5CA17182A635E5CEC550C7B62461E51AC45BDA2012DDD56A81CDF2B94B9F29D3E967E2120005E0DEE855891C6D03CE7D9B129C77EFB5944D460F92C3<br>1CB2AF4262FBF86BCA0DD0FA2065D9F340585EC5D033990E790CAA83F13CDB673257D52CDE9946BB3003834F6CDE03975685CFF653DD47320D2A7AE1323F<br>5A93F36633B7D243AB2283E190953F16D4707637788192DD6764C5C13B24EAB38B8B180A1FA3F7D6298F6C5F67621165C73EBBF65A5F4195B04612D7D76A<br>E1AF78132DD00175C2ED07831792</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>http://gvlay6u4g53rxdi5.onion/21-rmPFli0sjNORRCfXRDZs02u7XwAsjS9b-Cp0y5kQ8uHFPpVb8xsPdg94NHSPiE4l6</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected]">[email protected]</a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>Make contact as soon as possible. Your private key (decryption key) <br>
is only stored temporarily.<br><br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\PushUnregister.raw => C:\Users\Admin\Pictures\PushUnregister.raw.lockfiles 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File renamed C:\Users\Admin\Pictures\UpdateGet.tiff => C:\Users\Admin\Pictures\UpdateGet.tiff.lockfiles 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File renamed C:\Users\Admin\Pictures\MountGrant.raw => C:\Users\Admin\Pictures\MountGrant.raw.lockfiles 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened for modification C:\Users\Admin\Pictures\ShowGrant.tiff 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File renamed C:\Users\Admin\Pictures\ShowGrant.tiff => C:\Users\Admin\Pictures\ShowGrant.tiff.lockfiles 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened for modification C:\Users\Admin\Pictures\StopSet.tiff 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File renamed C:\Users\Admin\Pictures\StopSet.tiff => C:\Users\Admin\Pictures\StopSet.tiff.lockfiles 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File renamed C:\Users\Admin\Pictures\UnblockExit.tif => C:\Users\Admin\Pictures\UnblockExit.tif.lockfiles 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened for modification C:\Users\Admin\Pictures\UpdateGet.tiff 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File renamed C:\Users\Admin\Pictures\ExpandGet.png => C:\Users\Admin\Pictures\ExpandGet.png.lockfiles 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe" 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3846991908-3261386348-1409841751-1000\desktop.ini 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\E: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\F: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\I: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\J: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\L: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\S: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\Z: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\M: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\N: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\Q: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\R: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\U: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\Y: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\G: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\H: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\O: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\T: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\V: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\W: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\A: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\K: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\P: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe File opened (read-only) \??\X: 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1188 vssadmin.exe 2024 vssadmin.exe 696 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 1336 vssvc.exe Token: SeRestorePrivilege 1336 vssvc.exe Token: SeAuditPrivilege 1336 vssvc.exe Token: SeIncreaseQuotaPrivilege 336 wmic.exe Token: SeSecurityPrivilege 336 wmic.exe Token: SeTakeOwnershipPrivilege 336 wmic.exe Token: SeLoadDriverPrivilege 336 wmic.exe Token: SeSystemProfilePrivilege 336 wmic.exe Token: SeSystemtimePrivilege 336 wmic.exe Token: SeProfSingleProcessPrivilege 336 wmic.exe Token: SeIncBasePriorityPrivilege 336 wmic.exe Token: SeCreatePagefilePrivilege 336 wmic.exe Token: SeBackupPrivilege 336 wmic.exe Token: SeRestorePrivilege 336 wmic.exe Token: SeShutdownPrivilege 336 wmic.exe Token: SeDebugPrivilege 336 wmic.exe Token: SeSystemEnvironmentPrivilege 336 wmic.exe Token: SeRemoteShutdownPrivilege 336 wmic.exe Token: SeUndockPrivilege 336 wmic.exe Token: SeManageVolumePrivilege 336 wmic.exe Token: 33 336 wmic.exe Token: 34 336 wmic.exe Token: 35 336 wmic.exe Token: SeIncreaseQuotaPrivilege 1036 wmic.exe Token: SeSecurityPrivilege 1036 wmic.exe Token: SeTakeOwnershipPrivilege 1036 wmic.exe Token: SeLoadDriverPrivilege 1036 wmic.exe Token: SeSystemProfilePrivilege 1036 wmic.exe Token: SeSystemtimePrivilege 1036 wmic.exe Token: SeProfSingleProcessPrivilege 1036 wmic.exe Token: SeIncBasePriorityPrivilege 1036 wmic.exe Token: SeCreatePagefilePrivilege 1036 wmic.exe Token: SeBackupPrivilege 1036 wmic.exe Token: SeRestorePrivilege 1036 wmic.exe Token: SeShutdownPrivilege 1036 wmic.exe Token: SeDebugPrivilege 1036 wmic.exe Token: SeSystemEnvironmentPrivilege 1036 wmic.exe Token: SeRemoteShutdownPrivilege 1036 wmic.exe Token: SeUndockPrivilege 1036 wmic.exe Token: SeManageVolumePrivilege 1036 wmic.exe Token: 33 1036 wmic.exe Token: 34 1036 wmic.exe Token: 35 1036 wmic.exe Token: SeIncreaseQuotaPrivilege 1676 wmic.exe Token: SeSecurityPrivilege 1676 wmic.exe Token: SeTakeOwnershipPrivilege 1676 wmic.exe Token: SeLoadDriverPrivilege 1676 wmic.exe Token: SeSystemProfilePrivilege 1676 wmic.exe Token: SeSystemtimePrivilege 1676 wmic.exe Token: SeProfSingleProcessPrivilege 1676 wmic.exe Token: SeIncBasePriorityPrivilege 1676 wmic.exe Token: SeCreatePagefilePrivilege 1676 wmic.exe Token: SeBackupPrivilege 1676 wmic.exe Token: SeRestorePrivilege 1676 wmic.exe Token: SeShutdownPrivilege 1676 wmic.exe Token: SeDebugPrivilege 1676 wmic.exe Token: SeSystemEnvironmentPrivilege 1676 wmic.exe Token: SeRemoteShutdownPrivilege 1676 wmic.exe Token: SeUndockPrivilege 1676 wmic.exe Token: SeManageVolumePrivilege 1676 wmic.exe Token: 33 1676 wmic.exe Token: 34 1676 wmic.exe Token: 35 1676 wmic.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1884 wrote to memory of 696 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 27 PID 1884 wrote to memory of 696 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 27 PID 1884 wrote to memory of 696 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 27 PID 1884 wrote to memory of 696 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 27 PID 1884 wrote to memory of 336 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 30 PID 1884 wrote to memory of 336 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 30 PID 1884 wrote to memory of 336 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 30 PID 1884 wrote to memory of 336 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 30 PID 1884 wrote to memory of 1188 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 32 PID 1884 wrote to memory of 1188 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 32 PID 1884 wrote to memory of 1188 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 32 PID 1884 wrote to memory of 1188 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 32 PID 1884 wrote to memory of 1036 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 34 PID 1884 wrote to memory of 1036 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 34 PID 1884 wrote to memory of 1036 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 34 PID 1884 wrote to memory of 1036 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 34 PID 1884 wrote to memory of 2024 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 36 PID 1884 wrote to memory of 2024 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 36 PID 1884 wrote to memory of 2024 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 36 PID 1884 wrote to memory of 2024 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 36 PID 1884 wrote to memory of 1676 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 38 PID 1884 wrote to memory of 1676 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 38 PID 1884 wrote to memory of 1676 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 38 PID 1884 wrote to memory of 1676 1884 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe 38 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe"C:\Users\Admin\AppData\Local\Temp\1e406ec30ce6ff9998b5b1ad72232713832889e32cc890c807386831ee8dea9f.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1884 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:696
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:336
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1188
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2024
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1336