Analysis
-
max time kernel
4294221s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
16-03-2022 07:43
Behavioral task
behavioral1
Sample
6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe
Resource
win10v2004-20220310-en
General
-
Target
6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe
-
Size
627KB
-
MD5
1234951c81c9f0950d7ebccf5c0da425
-
SHA1
c51df34b23cc7bfdf58ebdc21df84deab9688f8d
-
SHA256
6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852
-
SHA512
e69fa50b6ff651c2bb916e715e5100946c0be58e78e5867a56345383d0128b25da7a81d8dfa97aef7961f6e2ec1e74b4af903f4b10671face36f3c9cfaf50236
Malware Config
Extracted
C:\Program Files\7-Zip\Restore-My-Files.txt
lockbit
http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9B9F589BED020CFC6
http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9B9F589BED020CFC6
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe\"" 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exepid process 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe -
Drops file in Program Files directory 64 IoCs
Processes:
6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\ApproveExport.wmv 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\Restore-My-Files.txt 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\Restore-My-Files.txt 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1320 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exepid process 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exevssvc.exedescription pid process Token: SeTakeOwnershipPrivilege 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe Token: SeDebugPrivilege 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe Token: SeBackupPrivilege 1568 vssvc.exe Token: SeRestorePrivilege 1568 vssvc.exe Token: SeAuditPrivilege 1568 vssvc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.execmd.exedescription pid process target process PID 1828 wrote to memory of 1988 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe cmd.exe PID 1828 wrote to memory of 1988 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe cmd.exe PID 1828 wrote to memory of 1988 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe cmd.exe PID 1828 wrote to memory of 1988 1828 6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe cmd.exe PID 1988 wrote to memory of 1320 1988 cmd.exe vssadmin.exe PID 1988 wrote to memory of 1320 1988 cmd.exe vssadmin.exe PID 1988 wrote to memory of 1320 1988 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe"C:\Users\Admin\AppData\Local\Temp\6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken