Analysis
-
max time kernel
4294223s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
15-03-2022 17:22
Behavioral task
behavioral1
Sample
a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe
Resource
win10v2004-20220310-en
General
-
Target
a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe
-
Size
629KB
-
MD5
551d134c5769726aa49edcf2881e3ab6
-
SHA1
fbe0582e76999e1cb36c4fc330f60cbafa65081a
-
SHA256
a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49
-
SHA512
e13d966b7bccc7cf2a5b2043323a53c5c766dd7fc30b3633d2d34ae7efe2cdd75817aba78d39bcb128a02717224536ee24356ef5021171121d5966d3d275d6a2
Malware Config
Extracted
C:\Program Files\7-Zip\Restore-My-Files.txt
lockbit
http://lockbit-decryptor.top/?9B7FDA8D33FEC3F99DE5A3FAC03EF9BB
http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F99DE5A3FAC03EF9BB
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe\"" a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exepid process 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe -
Drops file in Program Files directory 64 IoCs
Processes:
a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\Restore-My-Files.txt a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\FindPing.gif a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\Restore-My-Files.txt a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\Restore-My-Files.txt a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\Restore-My-Files.txt a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\Restore-My-Files.txt a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2676 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exepid process 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exevssvc.exedescription pid process Token: SeTakeOwnershipPrivilege 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe Token: SeDebugPrivilege 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe Token: SeBackupPrivilege 2704 vssvc.exe Token: SeRestorePrivilege 2704 vssvc.exe Token: SeAuditPrivilege 2704 vssvc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.execmd.exedescription pid process target process PID 1824 wrote to memory of 2652 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe cmd.exe PID 1824 wrote to memory of 2652 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe cmd.exe PID 1824 wrote to memory of 2652 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe cmd.exe PID 1824 wrote to memory of 2652 1824 a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe cmd.exe PID 2652 wrote to memory of 2676 2652 cmd.exe vssadmin.exe PID 2652 wrote to memory of 2676 2652 cmd.exe vssadmin.exe PID 2652 wrote to memory of 2676 2652 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe"C:\Users\Admin\AppData\Local\Temp\a6d63a54b5be86d1874d96f25ef8e85c0683ea4d32796931f3241466589a3a49.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2676
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704