Analysis
-
max time kernel
174s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
01-02-2022 15:24
Static task
static1
Behavioral task
behavioral1
Sample
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe
-
Size
669KB
-
MD5
f3519df44f546606b256d13a209675b5
-
SHA1
e386497b7005b133226ecb7f786943f6e77641d2
-
SHA256
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9
-
SHA512
d514809c2faaee6086713651f32d19b923275dd822d43dac4e8a1d787230342ba13c31c32080e8d5b4c0a21f456d41e75a7b07120775e305ebc17d43564c5d76
Score
10/10
Malware Config
Extracted
Path
C:\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">5A871C3A4A06D23FE3477E1D26A0617C2E3092B213AFAF9B32396C0E4C84AEB246854778E285C27780A2425BCB7A34DF11E005D58E6912960132E5CEE21E8353<br>79E35C6C62FEFECBE59F8C69EF65766B7A91C0A057DEFFCC20F3DEF6F4E12BD901E67E379628A92F1E2D594EEE7CA50FC52A6B886EEB0EE3732F3CC41635<br>D3915F28DAFFE9662A208C6AA4D1766292AE381A1DD85A9BCDA0C3F1E6AA48DFF4F162C7B33CD6E36FC9B1654D9BFA1AE2967A6E496103D075A163C6AF43<br>51C4BE73D2D905CB27523ADC406434A7D6D1AC4BF7D0EC66C4A951590B3895D898690BA149C3EC0C8F2E6C2C85F785341DE7DE8859A99111566A78EBC0F1<br>5178222E44204422FD8E61C00168EE773AC8D6A5FC6ABF6349978D1324513BB5F4633C521C14AD2527FD79074AABF417BEC353825F79E6F6CE1381A1AE03<br>40EF0DE62AF8D778A056AF229236ADB4DB20F90668D361988E36CBB4AD3D4E06DF023EE7A4688FD3C536DBB08F96A1D6C8FAA3180E66D7F1FCD01844EC18<br>5947124788F4FDA4FA8E90CD95BB0A9B5923BEA88A0B2BE107921BC9F65D4D68F4336C9811F938901F0E7212077851117D927A5D5393EB1A548CAD3047A0<br>3A53681869B7D9BCC12D262232CCDEF3EDEA7810665CE7CDD2703F877517B2515029E15CF5AB0F000946AB6DA95AC337F45034744CC1BD5E7D45B19841AB<br>8F225A068E689452D33E597A6985</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>CONTACT US FOR PRICE (BITCOIN) AND GET DECRYPTION SOFTWARE.</b><br><br>
<a href="mailto:[email protected]">[email protected]</a><br>
<a href="mailto:[email protected]
?
">[email protected]</a> <hr>
</div>
<div class="text">
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]
">[email protected]</a>
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x0009000000021835-130.dat family_medusalocker behavioral2/files/0x0009000000021835-131.dat family_medusalocker -
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid Process 4016 svhost.exe -
Processes:
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exedescription ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-790714498-1549421491-1643397139-1000\desktop.ini e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exedescription ioc Process File opened (read-only) \??\B: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\I: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\K: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\Q: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\T: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\J: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\M: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\N: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\P: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\U: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\V: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\A: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\E: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\G: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\L: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\O: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\R: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\W: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\F: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\H: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\S: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\X: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\Y: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe File opened (read-only) \??\Z: e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exepid Process 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
wmic.exewmic.exewmic.exedescription pid Process Token: SeIncreaseQuotaPrivilege 3632 wmic.exe Token: SeSecurityPrivilege 3632 wmic.exe Token: SeTakeOwnershipPrivilege 3632 wmic.exe Token: SeLoadDriverPrivilege 3632 wmic.exe Token: SeSystemProfilePrivilege 3632 wmic.exe Token: SeSystemtimePrivilege 3632 wmic.exe Token: SeProfSingleProcessPrivilege 3632 wmic.exe Token: SeIncBasePriorityPrivilege 3632 wmic.exe Token: SeCreatePagefilePrivilege 3632 wmic.exe Token: SeBackupPrivilege 3632 wmic.exe Token: SeRestorePrivilege 3632 wmic.exe Token: SeShutdownPrivilege 3632 wmic.exe Token: SeDebugPrivilege 3632 wmic.exe Token: SeSystemEnvironmentPrivilege 3632 wmic.exe Token: SeRemoteShutdownPrivilege 3632 wmic.exe Token: SeUndockPrivilege 3632 wmic.exe Token: SeManageVolumePrivilege 3632 wmic.exe Token: 33 3632 wmic.exe Token: 34 3632 wmic.exe Token: 35 3632 wmic.exe Token: 36 3632 wmic.exe Token: SeIncreaseQuotaPrivilege 1008 wmic.exe Token: SeSecurityPrivilege 1008 wmic.exe Token: SeTakeOwnershipPrivilege 1008 wmic.exe Token: SeLoadDriverPrivilege 1008 wmic.exe Token: SeSystemProfilePrivilege 1008 wmic.exe Token: SeSystemtimePrivilege 1008 wmic.exe Token: SeProfSingleProcessPrivilege 1008 wmic.exe Token: SeIncBasePriorityPrivilege 1008 wmic.exe Token: SeCreatePagefilePrivilege 1008 wmic.exe Token: SeBackupPrivilege 1008 wmic.exe Token: SeRestorePrivilege 1008 wmic.exe Token: SeShutdownPrivilege 1008 wmic.exe Token: SeDebugPrivilege 1008 wmic.exe Token: SeSystemEnvironmentPrivilege 1008 wmic.exe Token: SeRemoteShutdownPrivilege 1008 wmic.exe Token: SeUndockPrivilege 1008 wmic.exe Token: SeManageVolumePrivilege 1008 wmic.exe Token: 33 1008 wmic.exe Token: 34 1008 wmic.exe Token: 35 1008 wmic.exe Token: 36 1008 wmic.exe Token: SeIncreaseQuotaPrivilege 3100 wmic.exe Token: SeSecurityPrivilege 3100 wmic.exe Token: SeTakeOwnershipPrivilege 3100 wmic.exe Token: SeLoadDriverPrivilege 3100 wmic.exe Token: SeSystemProfilePrivilege 3100 wmic.exe Token: SeSystemtimePrivilege 3100 wmic.exe Token: SeProfSingleProcessPrivilege 3100 wmic.exe Token: SeIncBasePriorityPrivilege 3100 wmic.exe Token: SeCreatePagefilePrivilege 3100 wmic.exe Token: SeBackupPrivilege 3100 wmic.exe Token: SeRestorePrivilege 3100 wmic.exe Token: SeShutdownPrivilege 3100 wmic.exe Token: SeDebugPrivilege 3100 wmic.exe Token: SeSystemEnvironmentPrivilege 3100 wmic.exe Token: SeRemoteShutdownPrivilege 3100 wmic.exe Token: SeUndockPrivilege 3100 wmic.exe Token: SeManageVolumePrivilege 3100 wmic.exe Token: 33 3100 wmic.exe Token: 34 3100 wmic.exe Token: 35 3100 wmic.exe Token: 36 3100 wmic.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exedescription pid Process procid_target PID 3228 wrote to memory of 3632 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 56 PID 3228 wrote to memory of 3632 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 56 PID 3228 wrote to memory of 3632 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 56 PID 3228 wrote to memory of 1008 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 60 PID 3228 wrote to memory of 1008 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 60 PID 3228 wrote to memory of 1008 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 60 PID 3228 wrote to memory of 3100 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 62 PID 3228 wrote to memory of 3100 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 62 PID 3228 wrote to memory of 3100 3228 e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe 62 -
System policy modification 1 TTPs 3 IoCs
Processes:
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe"C:\Users\Admin\AppData\Local\Temp\e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9.exe"1⤵
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3228 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
PID:4016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
f3519df44f546606b256d13a209675b5
SHA1e386497b7005b133226ecb7f786943f6e77641d2
SHA256e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9
SHA512d514809c2faaee6086713651f32d19b923275dd822d43dac4e8a1d787230342ba13c31c32080e8d5b4c0a21f456d41e75a7b07120775e305ebc17d43564c5d76
-
MD5
f3519df44f546606b256d13a209675b5
SHA1e386497b7005b133226ecb7f786943f6e77641d2
SHA256e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9
SHA512d514809c2faaee6086713651f32d19b923275dd822d43dac4e8a1d787230342ba13c31c32080e8d5b4c0a21f456d41e75a7b07120775e305ebc17d43564c5d76