Analysis
-
max time kernel
161s -
max time network
143s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 15:25
Static task
static1
Behavioral task
behavioral1
Sample
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe
-
Size
669KB
-
MD5
4b5c296cf0ead00608c1b45998ad4765
-
SHA1
68a30a1fda9a3f4c978d921604e11ba9584b99e3
-
SHA256
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59
-
SHA512
43cad6af322370b8f4e2af8e56fe6a42defef571afc155359a945497d3bfd2d8bee7500559e8b0100d7979b32d51b80f2c80332d451c5b2e4a91df6d70868031
Score
10/10
Malware Config
Extracted
Path
\??\Z:\Boot\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">FFA2B4B61BECD337224FEA56801230BE0401DAF91FCE6D5077263EBE32D46B5788C9DC8CD1DAD3F5064EAC74069E9B06633AC414206D6E0430E0F70C85F2CB85<br>E9ADCFF0977E65AF1B8588EAFA6C3DB8688B013BDDD971DE07BFB4698A96F3C0AB3D0F9F654154048DBF4ABB0604BAF13ED64FE536BF93E73C06C8D081E2<br>ACFABA89EB698A0ABFB5408255F4A5007D076921A8782DF7AC9D0161EFA6D027DFA27DF82D57578DCB2E81DEFD59B6354D4297F05692970E6E9D08A89694<br>77C0BBAB3227544755897F7FC1697EC4D515B2F2DCC442B7F0001F29D1A6A0EA5862F016703C5E8C1DD604DBE153B538F10AF757D0900409CA3B1AB7488D<br>77EB919D588E3F2A3E00B61FDE97335C412A3119A377947C6622D6B572A92789778DB3E8DD6A53CAE3CB7AB624DE43EE1BA593BA6CD653336A64C518FCCC<br>AD9D1F414DB9181D3D1280F0902F355DBA4FAF42EDC7624B9AA6C06955EEB742D1D21227885995A01759CB67C9315AAD7150C090116E801A434E5DC7D0D9<br>80F815E27142CC88249E03E6EAAC6A35E77218123EAA84584DDDE689513B240506BB38E864639ED3B7047212EA8EE6DC51BE045B41ACC0811319AA70B12B<br>ADE5B58B2C23354EBC4E0BCDE3385EBBBF257F8D522C63F75F4D91B471EE8E590C48E2E1CCC3AF8260BD5672A591FFED087689CEEF79F736A36E860319F4<br>1AF9723622328A7FAA545D03D781</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>CONTACT US FOR PRICE (BITCOIN) AND GET DECRYPTION SOFTWARE.</b><br><br>
<a href="[email protected]">[email protected]</a><br>
<a href="[email protected]
?
">[email protected] </a> <hr>
</div>
<div class="text">
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x000700000001321e-55.dat family_medusalocker behavioral1/files/0x000700000001321e-56.dat family_medusalocker -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid Process 848 svhost.exe -
Processes:
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exedescription ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3846991908-3261386348-1409841751-1000\desktop.ini ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exedescription ioc Process File opened (read-only) \??\E: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\N: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\O: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\T: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\A: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\I: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\W: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\Y: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\Z: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\F: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\H: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\K: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\L: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\Q: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\R: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\S: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\U: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\B: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\G: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\J: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\M: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\P: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\V: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe File opened (read-only) \??\X: ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid Process 468 vssadmin.exe 432 vssadmin.exe 1924 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exepid Process 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
vssvc.exewmic.exewmic.exewmic.exedescription pid Process Token: SeBackupPrivilege 1724 vssvc.exe Token: SeRestorePrivilege 1724 vssvc.exe Token: SeAuditPrivilege 1724 vssvc.exe Token: SeIncreaseQuotaPrivilege 1756 wmic.exe Token: SeSecurityPrivilege 1756 wmic.exe Token: SeTakeOwnershipPrivilege 1756 wmic.exe Token: SeLoadDriverPrivilege 1756 wmic.exe Token: SeSystemProfilePrivilege 1756 wmic.exe Token: SeSystemtimePrivilege 1756 wmic.exe Token: SeProfSingleProcessPrivilege 1756 wmic.exe Token: SeIncBasePriorityPrivilege 1756 wmic.exe Token: SeCreatePagefilePrivilege 1756 wmic.exe Token: SeBackupPrivilege 1756 wmic.exe Token: SeRestorePrivilege 1756 wmic.exe Token: SeShutdownPrivilege 1756 wmic.exe Token: SeDebugPrivilege 1756 wmic.exe Token: SeSystemEnvironmentPrivilege 1756 wmic.exe Token: SeRemoteShutdownPrivilege 1756 wmic.exe Token: SeUndockPrivilege 1756 wmic.exe Token: SeManageVolumePrivilege 1756 wmic.exe Token: 33 1756 wmic.exe Token: 34 1756 wmic.exe Token: 35 1756 wmic.exe Token: SeIncreaseQuotaPrivilege 2000 wmic.exe Token: SeSecurityPrivilege 2000 wmic.exe Token: SeTakeOwnershipPrivilege 2000 wmic.exe Token: SeLoadDriverPrivilege 2000 wmic.exe Token: SeSystemProfilePrivilege 2000 wmic.exe Token: SeSystemtimePrivilege 2000 wmic.exe Token: SeProfSingleProcessPrivilege 2000 wmic.exe Token: SeIncBasePriorityPrivilege 2000 wmic.exe Token: SeCreatePagefilePrivilege 2000 wmic.exe Token: SeBackupPrivilege 2000 wmic.exe Token: SeRestorePrivilege 2000 wmic.exe Token: SeShutdownPrivilege 2000 wmic.exe Token: SeDebugPrivilege 2000 wmic.exe Token: SeSystemEnvironmentPrivilege 2000 wmic.exe Token: SeRemoteShutdownPrivilege 2000 wmic.exe Token: SeUndockPrivilege 2000 wmic.exe Token: SeManageVolumePrivilege 2000 wmic.exe Token: 33 2000 wmic.exe Token: 34 2000 wmic.exe Token: 35 2000 wmic.exe Token: SeIncreaseQuotaPrivilege 908 wmic.exe Token: SeSecurityPrivilege 908 wmic.exe Token: SeTakeOwnershipPrivilege 908 wmic.exe Token: SeLoadDriverPrivilege 908 wmic.exe Token: SeSystemProfilePrivilege 908 wmic.exe Token: SeSystemtimePrivilege 908 wmic.exe Token: SeProfSingleProcessPrivilege 908 wmic.exe Token: SeIncBasePriorityPrivilege 908 wmic.exe Token: SeCreatePagefilePrivilege 908 wmic.exe Token: SeBackupPrivilege 908 wmic.exe Token: SeRestorePrivilege 908 wmic.exe Token: SeShutdownPrivilege 908 wmic.exe Token: SeDebugPrivilege 908 wmic.exe Token: SeSystemEnvironmentPrivilege 908 wmic.exe Token: SeRemoteShutdownPrivilege 908 wmic.exe Token: SeUndockPrivilege 908 wmic.exe Token: SeManageVolumePrivilege 908 wmic.exe Token: 33 908 wmic.exe Token: 34 908 wmic.exe Token: 35 908 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exetaskeng.exedescription pid Process procid_target PID 1920 wrote to memory of 468 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 27 PID 1920 wrote to memory of 468 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 27 PID 1920 wrote to memory of 468 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 27 PID 1920 wrote to memory of 468 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 27 PID 1920 wrote to memory of 1756 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 30 PID 1920 wrote to memory of 1756 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 30 PID 1920 wrote to memory of 1756 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 30 PID 1920 wrote to memory of 1756 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 30 PID 1920 wrote to memory of 432 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 32 PID 1920 wrote to memory of 432 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 32 PID 1920 wrote to memory of 432 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 32 PID 1920 wrote to memory of 432 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 32 PID 1920 wrote to memory of 2000 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 34 PID 1920 wrote to memory of 2000 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 34 PID 1920 wrote to memory of 2000 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 34 PID 1920 wrote to memory of 2000 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 34 PID 1920 wrote to memory of 1924 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 36 PID 1920 wrote to memory of 1924 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 36 PID 1920 wrote to memory of 1924 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 36 PID 1920 wrote to memory of 1924 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 36 PID 1920 wrote to memory of 908 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 38 PID 1920 wrote to memory of 908 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 38 PID 1920 wrote to memory of 908 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 38 PID 1920 wrote to memory of 908 1920 ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe 38 PID 1936 wrote to memory of 848 1936 taskeng.exe 43 PID 1936 wrote to memory of 848 1936 taskeng.exe 43 PID 1936 wrote to memory of 848 1936 taskeng.exe 43 PID 1936 wrote to memory of 848 1936 taskeng.exe 43 -
System policy modification 1 TTPs 3 IoCs
Processes:
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe"C:\Users\Admin\AppData\Local\Temp\ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59.exe"1⤵
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1920 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:468
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:432
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1924
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:908
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
C:\Windows\system32\taskeng.exetaskeng.exe {04CE2203-62DD-48A6-9616-25270580AA1F} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:848
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
4b5c296cf0ead00608c1b45998ad4765
SHA168a30a1fda9a3f4c978d921604e11ba9584b99e3
SHA256ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59
SHA51243cad6af322370b8f4e2af8e56fe6a42defef571afc155359a945497d3bfd2d8bee7500559e8b0100d7979b32d51b80f2c80332d451c5b2e4a91df6d70868031
-
MD5
4b5c296cf0ead00608c1b45998ad4765
SHA168a30a1fda9a3f4c978d921604e11ba9584b99e3
SHA256ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59
SHA51243cad6af322370b8f4e2af8e56fe6a42defef571afc155359a945497d3bfd2d8bee7500559e8b0100d7979b32d51b80f2c80332d451c5b2e4a91df6d70868031