Analysis
-
max time kernel
176s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
01/02/2022, 15:30
Static task
static1
Behavioral task
behavioral1
Sample
bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe
-
Size
657KB
-
MD5
3e2453e67ae1eead725a627adba9ae2e
-
SHA1
7a6ffc2da7d2ccd87e80c5c5c829bf0a5f1fda51
-
SHA256
bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44
-
SHA512
1fc6356638a3964c1715a83d35b08c46ca503af3ce2b3df108e4f41361d12c22c490af96e7c7086c32a898bedccb89b695f9129313cfebe08d061e80ae3badf7
Score
10/10
Malware Config
Extracted
Path
C:\INSTRUCTIONS.html
Ransom Note
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=Edge">
<meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, user-scalable=yes">
<title>Title</title>
<style>
html, body, div, span, applet, object, iframe,
h1, h2, h3, h4, h5, h6, p, blockquote, pre,
a, abbr, acronym, address, big, cite, code,
del, dfn, em, img, ins, kbd, q, s, samp,
small, strike, strong, sub, sup, tt, var,
b, u, i, center,
dl, dt, dd, ol, ul, li,
fieldset, form, label, legend,
table, caption, tbody, tfoot, thead, tr, th, td,
article, aside, canvas, details, embed,
figure, figcaption, footer, header, hgroup,
menu, nav, output, ruby, section, summary,
time, mark, audio, video {
margin: 0;
padding: 0;
border: 0;
font-size: 100%;
font: inherit;
vertical-align: baseline; }
/* HTML5 display-role reset for older browsers */
article, aside, details, figcaption, figure,
footer, header, hgroup, menu, nav, section {
display: block; }
body {
font-family: Tahoma, Arial;
background: #717798; }
.all {
max-width: 1170px;
margin: auto;
background: #000;
min-height: 100px;
border-radius: 10px; }
.tl {
text-align: center;
color: #e03930;
font-family: Tahoma;
font-size: 28px;
font-weight: 700;
position: relative;
height: 60px;
line-height: 60px;
}
.close {
padding: 15px;
width: 36px;
height: 36px;
position: absolute;
right: 15px;
top:0;
}
.bg {
background: #252a42;
text-align: center;
color: #ffffff;
padding: 25px 15px;
font-size: 18px;
font-weight: 400;
line-height: 20px; }
.bg span {
color: #f25252; }
.bg a {
color: #9676fd;
font-size: 20px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.bg c {
color: #f25252;
font-weight: 500;
font-size: 20px;
line-height: 35px;}
.footer {
padding: 15px 0;}
.tl2 {
text-align: center;
color: #e03930;
font-size: 25px;
font-weight: 500;
line-height: 32px;
text-decoration: underline;
padding-bottom: 15px; }
.text {
min-height: 192px;
color: #ffffff;
font-size: 16px;
font-weight: 500;
line-height: 24px; }
.text div {
padding-right: 50px;
padding-left: 50px; }
@media (max-width: 767px) {
.tl {
height: auto;
padding-right: 50px;
line-height: 1.5;
}
.text div {
padding: 0 15px; }
.footer {
background: none; } }
</style>
</head>
<body>
<div class="all">
<div class="container">
<div class="tl">All your data are encrypted!
<div class="close"></div></div>
<div class="bg">
<c>What happened?</c> <br>
Your files are encrypted, and currently unavailable. <br>
You can check it: all files on you computer has new expansion.<br>
By the way, everything is possible to recover (restore), but you need to buy a unique decryptor. <br>
Otherwise, you never cant return your data.<br>
<br>
<c>For purchasing a decryptor contact us by email: </c><br>
<a href="mailto:[email protected]">[email protected]</a><br>
If you will get no answer within 24 hours contact us by our alternate emails: <br>
<a href="mailto:[email protected]">[email protected]</a> <br>
<br>
<c>What guarantees?</c> <br>
Its just a business. If we do not do our work and liabilities - nobody will not cooperate with us.<br>
To verify the possibility of the recovery of your files we can decrypted 1 file for free. <br>
Attach 1 file to the letter (no more than 10Mb). Indicate your <b>personal ID</b> on the letter:<br>
<span style="width:800px; word-wrap:break-word; display:inline-block; color: #ffffff; font-size: 10px;">C310684FA1895DDE7BE7B3CD7515CF4FE7BD65F0DD7249356FC36F5269C9C01D3C29BADDFEE6FA317EAC4FBE5CE8E709EE6E1E5BE02884C613E0747D116EEC57<br>AA8AC0223C62605DFED599986051AAA0FDB49FCE93FE5AC371E44455067BE2877851D107313AB78D8FD6A94161C81B85D1124B3BFF1430E218746DBA0B69<br>3B2B68D89436F521E5024C1D90DD09C2B2075A74FFCA2ED60973664934A76C07B0F7A56ADFD531643D48794792B31AA1C31EB14578D91CE24E6584316D05<br>0E793CBC7524AB9DEBA6C853F8E5D7C2E9B03130E212B119F7A6C915586F2E8643DF6C47A3C5F8FC6810B3394918A3694F004701CC6EBFCC409B1836414D<br>D58EAC5F6C399B5D24C3507591E8EAE4440A8792BC0C6653E5A7E557D2DF763DE387778A82A1F3BC65DBC65CDF182788D36DD45B03CA97969E68B66019FC<br>091545B81C6E677B2A016D7C627440514437F5ADDC1ED947B82EFD34B4B450DE9AA5C83D08788A545EF803C89B9CCD17CBEE7A522D7084B34E205B109EEF<br>0B59EAFBBCA0C7503AE05A393B7816659BD843E2BE98129FA06AEEEDF1B33D67363C340A1C343C70B0E4AE8E5E4CAC9B87D48E915DF35C541AD17602886B<br>C05AF1C51B0043189AC58AFD3C196A788EBAE3E72C535459FD43A7A7FABDEE7694254A7A65C906C58D3C95C03D37E31120A2E03E850103F8A9A1D1B4510A<br>0C6BE884014A2CAADC2ADC2EE86B</span>
<br>
</div>
<div class="footer">
<div class="tl2">
Attention!
</div>
<div class="bg2">
<div class="text">
<div>
- Attempts of change files by yourself will result in a loose of data. <br>
- Our e-mail can be blocked over time. Write now, loss of contact with us will result in a loose of data.<br>
- Use any third party software for restoring your data or antivirus solutions will result in a loose of data. <br>
- Decryptors of other users are unique and will not fit your files and use of those will result in a loose of data.<br>
- If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key.
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]">[email protected]</a>
URLs
http-equiv="X-UA-Compatible"
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
Sets service image path in registry 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe" bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-1346565761-3498240568-4147300184-1000\desktop.ini bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\G: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\M: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\O: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\R: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\S: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\X: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\I: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\J: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\K: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\L: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\Q: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\Y: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\Z: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\E: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\H: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\U: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\V: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\W: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\B: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\F: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\N: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\P: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe File opened (read-only) \??\T: bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1860 wmic.exe Token: SeSecurityPrivilege 1860 wmic.exe Token: SeTakeOwnershipPrivilege 1860 wmic.exe Token: SeLoadDriverPrivilege 1860 wmic.exe Token: SeSystemProfilePrivilege 1860 wmic.exe Token: SeSystemtimePrivilege 1860 wmic.exe Token: SeProfSingleProcessPrivilege 1860 wmic.exe Token: SeIncBasePriorityPrivilege 1860 wmic.exe Token: SeCreatePagefilePrivilege 1860 wmic.exe Token: SeBackupPrivilege 1860 wmic.exe Token: SeRestorePrivilege 1860 wmic.exe Token: SeShutdownPrivilege 1860 wmic.exe Token: SeDebugPrivilege 1860 wmic.exe Token: SeSystemEnvironmentPrivilege 1860 wmic.exe Token: SeRemoteShutdownPrivilege 1860 wmic.exe Token: SeUndockPrivilege 1860 wmic.exe Token: SeManageVolumePrivilege 1860 wmic.exe Token: 33 1860 wmic.exe Token: 34 1860 wmic.exe Token: 35 1860 wmic.exe Token: 36 1860 wmic.exe Token: SeIncreaseQuotaPrivilege 3632 wmic.exe Token: SeSecurityPrivilege 3632 wmic.exe Token: SeTakeOwnershipPrivilege 3632 wmic.exe Token: SeLoadDriverPrivilege 3632 wmic.exe Token: SeSystemProfilePrivilege 3632 wmic.exe Token: SeSystemtimePrivilege 3632 wmic.exe Token: SeProfSingleProcessPrivilege 3632 wmic.exe Token: SeIncBasePriorityPrivilege 3632 wmic.exe Token: SeCreatePagefilePrivilege 3632 wmic.exe Token: SeBackupPrivilege 3632 wmic.exe Token: SeRestorePrivilege 3632 wmic.exe Token: SeShutdownPrivilege 3632 wmic.exe Token: SeDebugPrivilege 3632 wmic.exe Token: SeSystemEnvironmentPrivilege 3632 wmic.exe Token: SeRemoteShutdownPrivilege 3632 wmic.exe Token: SeUndockPrivilege 3632 wmic.exe Token: SeManageVolumePrivilege 3632 wmic.exe Token: 33 3632 wmic.exe Token: 34 3632 wmic.exe Token: 35 3632 wmic.exe Token: 36 3632 wmic.exe Token: SeIncreaseQuotaPrivilege 4852 wmic.exe Token: SeSecurityPrivilege 4852 wmic.exe Token: SeTakeOwnershipPrivilege 4852 wmic.exe Token: SeLoadDriverPrivilege 4852 wmic.exe Token: SeSystemProfilePrivilege 4852 wmic.exe Token: SeSystemtimePrivilege 4852 wmic.exe Token: SeProfSingleProcessPrivilege 4852 wmic.exe Token: SeIncBasePriorityPrivilege 4852 wmic.exe Token: SeCreatePagefilePrivilege 4852 wmic.exe Token: SeBackupPrivilege 4852 wmic.exe Token: SeRestorePrivilege 4852 wmic.exe Token: SeShutdownPrivilege 4852 wmic.exe Token: SeDebugPrivilege 4852 wmic.exe Token: SeSystemEnvironmentPrivilege 4852 wmic.exe Token: SeRemoteShutdownPrivilege 4852 wmic.exe Token: SeUndockPrivilege 4852 wmic.exe Token: SeManageVolumePrivilege 4852 wmic.exe Token: 33 4852 wmic.exe Token: 34 4852 wmic.exe Token: 35 4852 wmic.exe Token: 36 4852 wmic.exe Token: SeShutdownPrivilege 644 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4864 wrote to memory of 1860 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 86 PID 4864 wrote to memory of 1860 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 86 PID 4864 wrote to memory of 1860 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 86 PID 4864 wrote to memory of 3632 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 89 PID 4864 wrote to memory of 3632 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 89 PID 4864 wrote to memory of 3632 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 89 PID 4864 wrote to memory of 4852 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 91 PID 4864 wrote to memory of 4852 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 91 PID 4864 wrote to memory of 4852 4864 bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe 91 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe"C:\Users\Admin\AppData\Local\Temp\bb4d0f67360858a27da21d79bf93b5c628045883712c3c2e10917bebf6771c44.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4864 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 0dabb4c6a72260fd6a2bb429f77f17fe b6eUj2fH2UaHpG6f1e9LbA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:4488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:644