Analysis
-
max time kernel
171s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
01-02-2022 15:29
Static task
static1
Behavioral task
behavioral1
Sample
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe
-
Size
669KB
-
MD5
187c968c9c7f70a8c65ebefac8e4f124
-
SHA1
b5ec574920e42f117024e60852968da4f0584ff0
-
SHA256
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e
-
SHA512
f4d21feb6518d2712e829f5b3e8209b76851ab7ae66e2673fef08545f085bf3ece191b37bcce14074eb2c3fc50de83339ac9bee92769a20b94886289554fa3f6
Score
10/10
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000400000001e7b7-130.dat family_medusalocker behavioral2/files/0x000400000001e7b7-131.dat family_medusalocker -
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid Process 400 svhost.exe -
Sets service image path in registry 2 TTPs
-
Processes:
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exedescription ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-1346565761-3498240568-4147300184-1000\desktop.ini c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exedescription ioc Process File opened (read-only) \??\P: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\Y: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\H: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\J: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\M: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\O: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\Q: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\S: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\B: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\F: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\W: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\X: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\T: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\V: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\G: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\I: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\K: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\N: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\R: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\U: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\A: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\E: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\Z: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe File opened (read-only) \??\L: c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe -
Drops file in Windows directory 6 IoCs
Processes:
svchost.exedescription ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exepid Process 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exewmic.exesvchost.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2444 wmic.exe Token: SeSecurityPrivilege 2444 wmic.exe Token: SeTakeOwnershipPrivilege 2444 wmic.exe Token: SeLoadDriverPrivilege 2444 wmic.exe Token: SeSystemProfilePrivilege 2444 wmic.exe Token: SeSystemtimePrivilege 2444 wmic.exe Token: SeProfSingleProcessPrivilege 2444 wmic.exe Token: SeIncBasePriorityPrivilege 2444 wmic.exe Token: SeCreatePagefilePrivilege 2444 wmic.exe Token: SeBackupPrivilege 2444 wmic.exe Token: SeRestorePrivilege 2444 wmic.exe Token: SeShutdownPrivilege 2444 wmic.exe Token: SeDebugPrivilege 2444 wmic.exe Token: SeSystemEnvironmentPrivilege 2444 wmic.exe Token: SeRemoteShutdownPrivilege 2444 wmic.exe Token: SeUndockPrivilege 2444 wmic.exe Token: SeManageVolumePrivilege 2444 wmic.exe Token: 33 2444 wmic.exe Token: 34 2444 wmic.exe Token: 35 2444 wmic.exe Token: 36 2444 wmic.exe Token: SeIncreaseQuotaPrivilege 1360 wmic.exe Token: SeSecurityPrivilege 1360 wmic.exe Token: SeTakeOwnershipPrivilege 1360 wmic.exe Token: SeLoadDriverPrivilege 1360 wmic.exe Token: SeSystemProfilePrivilege 1360 wmic.exe Token: SeSystemtimePrivilege 1360 wmic.exe Token: SeProfSingleProcessPrivilege 1360 wmic.exe Token: SeIncBasePriorityPrivilege 1360 wmic.exe Token: SeCreatePagefilePrivilege 1360 wmic.exe Token: SeBackupPrivilege 1360 wmic.exe Token: SeRestorePrivilege 1360 wmic.exe Token: SeShutdownPrivilege 1360 wmic.exe Token: SeDebugPrivilege 1360 wmic.exe Token: SeSystemEnvironmentPrivilege 1360 wmic.exe Token: SeRemoteShutdownPrivilege 1360 wmic.exe Token: SeUndockPrivilege 1360 wmic.exe Token: SeManageVolumePrivilege 1360 wmic.exe Token: 33 1360 wmic.exe Token: 34 1360 wmic.exe Token: 35 1360 wmic.exe Token: 36 1360 wmic.exe Token: SeIncreaseQuotaPrivilege 3160 wmic.exe Token: SeSecurityPrivilege 3160 wmic.exe Token: SeTakeOwnershipPrivilege 3160 wmic.exe Token: SeLoadDriverPrivilege 3160 wmic.exe Token: SeSystemProfilePrivilege 3160 wmic.exe Token: SeSystemtimePrivilege 3160 wmic.exe Token: SeProfSingleProcessPrivilege 3160 wmic.exe Token: SeIncBasePriorityPrivilege 3160 wmic.exe Token: SeCreatePagefilePrivilege 3160 wmic.exe Token: SeBackupPrivilege 3160 wmic.exe Token: SeRestorePrivilege 3160 wmic.exe Token: SeShutdownPrivilege 3160 wmic.exe Token: SeDebugPrivilege 3160 wmic.exe Token: SeSystemEnvironmentPrivilege 3160 wmic.exe Token: SeRemoteShutdownPrivilege 3160 wmic.exe Token: SeUndockPrivilege 3160 wmic.exe Token: SeManageVolumePrivilege 3160 wmic.exe Token: 33 3160 wmic.exe Token: 34 3160 wmic.exe Token: 35 3160 wmic.exe Token: 36 3160 wmic.exe Token: SeShutdownPrivilege 3876 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exedescription pid Process procid_target PID 4680 wrote to memory of 2444 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 87 PID 4680 wrote to memory of 2444 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 87 PID 4680 wrote to memory of 2444 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 87 PID 4680 wrote to memory of 1360 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 89 PID 4680 wrote to memory of 1360 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 89 PID 4680 wrote to memory of 1360 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 89 PID 4680 wrote to memory of 3160 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 91 PID 4680 wrote to memory of 3160 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 91 PID 4680 wrote to memory of 3160 4680 c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe 91 -
System policy modification 1 TTPs 3 IoCs
Processes:
c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe"C:\Users\Admin\AppData\Local\Temp\c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e.exe"1⤵
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4680 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
PID:400
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe f17a1497af8d2577519140c64a560f04 gXq2LNwVHkCCTneqKeABbQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3876
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
187c968c9c7f70a8c65ebefac8e4f124
SHA1b5ec574920e42f117024e60852968da4f0584ff0
SHA256c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e
SHA512f4d21feb6518d2712e829f5b3e8209b76851ab7ae66e2673fef08545f085bf3ece191b37bcce14074eb2c3fc50de83339ac9bee92769a20b94886289554fa3f6
-
MD5
187c968c9c7f70a8c65ebefac8e4f124
SHA1b5ec574920e42f117024e60852968da4f0584ff0
SHA256c632ce1dc34111c66efb817f608bf3b547fc9df5fed478d736b4c53a41ba193e
SHA512f4d21feb6518d2712e829f5b3e8209b76851ab7ae66e2673fef08545f085bf3ece191b37bcce14074eb2c3fc50de83339ac9bee92769a20b94886289554fa3f6