Analysis
-
max time kernel
161s -
max time network
138s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 15:21
Static task
static1
Behavioral task
behavioral1
Sample
fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe
-
Size
678KB
-
MD5
217b5b689dca5aa0026401bffc8d3079
-
SHA1
86d92fc3ba2b3536893b8e753da9cbae70063a50
-
SHA256
fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2
-
SHA512
4da6c584cde1eb4536c5a487dc12601bef711f8b9383c5a328d2d328c87f7b0ef597627749ec17466ddaf59a296af4117a70a772202ead7406a09944a6811fe4
Malware Config
Extracted
Path
\??\Z:\Boot\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">8FED51C0E307A9820EDF370571D692369A527D8DC2CB418FC27FA4818FC1A978EB6D90FCA01CF4C25F5E8AD2D6F52A79D091BBADA99EC44A27CF188CB0F9955A<br>2B681573BA0A2292581F4BE85EC127E30825F96A0332E3A6AA897D0AFF61FFE91D0711139662580B2822A4775E4BBD899AFDE216F506B5234D303FB03FBD<br>BD729A952AFA4D07151226D0E3286F1952BFD5BA503530D2A5FC478C12198B1B3CE33DE46EB5FB5404AFF91FFC8E7CFF8CFE4637A2F8E7ED8396E7DA3937<br>CC9D18526B2E1B613D645BDFA46D668082E7E7F04D26E92CE97397AE8F71BF4BA86B3C106563E89296053DA1F4E8ED1F85B49AFC2F5B5AB2207E3C3E1C6C<br>B097BE459476F2798F25DDEA1E5BDB9945F433589B3398EF7AEB6AE62FC6B650B3BFD9EC8A0B089F11A97EA25D90EAAEB5329C1CD1FAF514721A682F529A<br>307C069649D51CE454D20E079CAE4BE996355137AC59FF5C7F25A0BF90F75028011208B0A16A7396CF6052F205696787AA93B8E48EC8C4D76281497F5ECF<br>DF21D1C4BCE678B8D085D0A50652239D6751BBEA426CEDB99CF7B4F3DC46E64E37892B6F1B90D298DA5E45103180D6411C708B6546B5AA7864E89888523B<br>0F99976866CCBD2A385825112BF755681BFECF1DB62B90C4948A09EF99E0962DE548A9FA8B44B95E6F07AEDD96629A794D7ED0046C17FB54EA0D9F26011B<br>0000042C0F185DFD99F88D648A81</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a href="">http://gvlay6u4g53rxdi5.onion/21-DB8k8moqBCQTJrRBd08b2CryB0SEELdw-wE0lSCixNCtxS9slfqqELUuYeetP5m85</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<b>If you can't use the above link, use the email:</b><br>
<a href=" [email protected]
?
"> [email protected] </a> <hr>
<a href=" [email protected]
?
">[email protected] </a> <hr>
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x000700000001262d-55.dat family_medusalocker behavioral1/files/0x000700000001262d-56.dat family_medusalocker -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid Process 1968 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exedescription ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3846991908-3261386348-1409841751-1000\desktop.ini fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exedescription ioc Process File opened (read-only) \??\A: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\B: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\E: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\F: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\G: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\I: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\N: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\R: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\W: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\X: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\Y: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\H: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\K: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\L: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\T: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\V: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\M: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\P: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\Q: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\Z: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\J: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\O: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\S: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe File opened (read-only) \??\U: fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid Process 832 vssadmin.exe 1368 vssadmin.exe 848 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exepid Process 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
vssvc.exewmic.exewmic.exewmic.exedescription pid Process Token: SeBackupPrivilege 1280 vssvc.exe Token: SeRestorePrivilege 1280 vssvc.exe Token: SeAuditPrivilege 1280 vssvc.exe Token: SeIncreaseQuotaPrivilege 1040 wmic.exe Token: SeSecurityPrivilege 1040 wmic.exe Token: SeTakeOwnershipPrivilege 1040 wmic.exe Token: SeLoadDriverPrivilege 1040 wmic.exe Token: SeSystemProfilePrivilege 1040 wmic.exe Token: SeSystemtimePrivilege 1040 wmic.exe Token: SeProfSingleProcessPrivilege 1040 wmic.exe Token: SeIncBasePriorityPrivilege 1040 wmic.exe Token: SeCreatePagefilePrivilege 1040 wmic.exe Token: SeBackupPrivilege 1040 wmic.exe Token: SeRestorePrivilege 1040 wmic.exe Token: SeShutdownPrivilege 1040 wmic.exe Token: SeDebugPrivilege 1040 wmic.exe Token: SeSystemEnvironmentPrivilege 1040 wmic.exe Token: SeRemoteShutdownPrivilege 1040 wmic.exe Token: SeUndockPrivilege 1040 wmic.exe Token: SeManageVolumePrivilege 1040 wmic.exe Token: 33 1040 wmic.exe Token: 34 1040 wmic.exe Token: 35 1040 wmic.exe Token: SeIncreaseQuotaPrivilege 1164 wmic.exe Token: SeSecurityPrivilege 1164 wmic.exe Token: SeTakeOwnershipPrivilege 1164 wmic.exe Token: SeLoadDriverPrivilege 1164 wmic.exe Token: SeSystemProfilePrivilege 1164 wmic.exe Token: SeSystemtimePrivilege 1164 wmic.exe Token: SeProfSingleProcessPrivilege 1164 wmic.exe Token: SeIncBasePriorityPrivilege 1164 wmic.exe Token: SeCreatePagefilePrivilege 1164 wmic.exe Token: SeBackupPrivilege 1164 wmic.exe Token: SeRestorePrivilege 1164 wmic.exe Token: SeShutdownPrivilege 1164 wmic.exe Token: SeDebugPrivilege 1164 wmic.exe Token: SeSystemEnvironmentPrivilege 1164 wmic.exe Token: SeRemoteShutdownPrivilege 1164 wmic.exe Token: SeUndockPrivilege 1164 wmic.exe Token: SeManageVolumePrivilege 1164 wmic.exe Token: 33 1164 wmic.exe Token: 34 1164 wmic.exe Token: 35 1164 wmic.exe Token: SeIncreaseQuotaPrivilege 1720 wmic.exe Token: SeSecurityPrivilege 1720 wmic.exe Token: SeTakeOwnershipPrivilege 1720 wmic.exe Token: SeLoadDriverPrivilege 1720 wmic.exe Token: SeSystemProfilePrivilege 1720 wmic.exe Token: SeSystemtimePrivilege 1720 wmic.exe Token: SeProfSingleProcessPrivilege 1720 wmic.exe Token: SeIncBasePriorityPrivilege 1720 wmic.exe Token: SeCreatePagefilePrivilege 1720 wmic.exe Token: SeBackupPrivilege 1720 wmic.exe Token: SeRestorePrivilege 1720 wmic.exe Token: SeShutdownPrivilege 1720 wmic.exe Token: SeDebugPrivilege 1720 wmic.exe Token: SeSystemEnvironmentPrivilege 1720 wmic.exe Token: SeRemoteShutdownPrivilege 1720 wmic.exe Token: SeUndockPrivilege 1720 wmic.exe Token: SeManageVolumePrivilege 1720 wmic.exe Token: 33 1720 wmic.exe Token: 34 1720 wmic.exe Token: 35 1720 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exetaskeng.exedescription pid Process procid_target PID 952 wrote to memory of 832 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 27 PID 952 wrote to memory of 832 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 27 PID 952 wrote to memory of 832 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 27 PID 952 wrote to memory of 832 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 27 PID 952 wrote to memory of 1040 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 31 PID 952 wrote to memory of 1040 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 31 PID 952 wrote to memory of 1040 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 31 PID 952 wrote to memory of 1040 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 31 PID 952 wrote to memory of 1368 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 33 PID 952 wrote to memory of 1368 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 33 PID 952 wrote to memory of 1368 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 33 PID 952 wrote to memory of 1368 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 33 PID 952 wrote to memory of 1164 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 35 PID 952 wrote to memory of 1164 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 35 PID 952 wrote to memory of 1164 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 35 PID 952 wrote to memory of 1164 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 35 PID 952 wrote to memory of 848 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 37 PID 952 wrote to memory of 848 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 37 PID 952 wrote to memory of 848 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 37 PID 952 wrote to memory of 848 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 37 PID 952 wrote to memory of 1720 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 39 PID 952 wrote to memory of 1720 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 39 PID 952 wrote to memory of 1720 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 39 PID 952 wrote to memory of 1720 952 fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe 39 PID 1552 wrote to memory of 1968 1552 taskeng.exe 44 PID 1552 wrote to memory of 1968 1552 taskeng.exe 44 PID 1552 wrote to memory of 1968 1552 taskeng.exe 44 PID 1552 wrote to memory of 1968 1552 taskeng.exe 44 -
System policy modification 1 TTPs 3 IoCs
Processes:
fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe"C:\Users\Admin\AppData\Local\Temp\fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2.exe"1⤵
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:952 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:832
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1368
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:848
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1280
-
C:\Windows\system32\taskeng.exetaskeng.exe {62013E41-1ABC-41BD-92B4-086E23C4EC06} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:1968
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
217b5b689dca5aa0026401bffc8d3079
SHA186d92fc3ba2b3536893b8e753da9cbae70063a50
SHA256fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2
SHA5124da6c584cde1eb4536c5a487dc12601bef711f8b9383c5a328d2d328c87f7b0ef597627749ec17466ddaf59a296af4117a70a772202ead7406a09944a6811fe4
-
MD5
217b5b689dca5aa0026401bffc8d3079
SHA186d92fc3ba2b3536893b8e753da9cbae70063a50
SHA256fb07649497b39eee0a93598ff66f14a1f7625f2b6d4c30d8bb5c48de848cd4f2
SHA5124da6c584cde1eb4536c5a487dc12601bef711f8b9383c5a328d2d328c87f7b0ef597627749ec17466ddaf59a296af4117a70a772202ead7406a09944a6811fe4