Analysis
- max time kernel
127s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
08/04/2022, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe
Resource
win10v2004-20220331-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe
- Size 669KB
- Sample220408-pb5vxacfg5
- SHA256 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13
- MD5 3a43bb428e23e8059c9a3fbde9707de2
- SHA1 edbca9b297c2ce981bcb6c8a20107c204045d523
- SHA512 c02648de56128a758873952ffcac982bf4463bc9c7cab9605e2f0cf77eb4304e39a9076494f4127718356e4d5250084353b27459c40ae8f30ac7cb5150f2ae1e
- MD5 SHA1 SHA512
Malware Config
Extracted
Path
-
C:\HOW_TO_RECOVER_DATA.html
Ransom Note
- <html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">E11BBAA6C600A83FE1707B42E8D86997774FEE57D3B80A480CABEF2171D4C249A16357C7725E4EC21C7E4B8F1793C1BA941258D2EDA7B8726F9F4FEF00C6191F<br>8C96586803FDDD675A6BDB16BFC0F76D550977C850A5167C4C379CD98DE59AF2227BFF79D806E1A95F4154F5C5E2496857CF0D9081B50FE27FDFA125E06D<br>8E8E69812F43EEA3408822651D8508BA758EC9D92521F322D908E4AC38DE9B5C0D1A06273474D4B2F8903EF396E1170CD57624D5DA2F2BDC143297C180FD<br>D243D9226FA89E74A0DB173F933F94BB336155778C84AA1DF8C9E201346BC3BBDB932B8BD08B64A1E28DB3E6DB40576FDC1093852A7BEC7A1C648F25F059<br>DDC40D37417CBB0EEC75CF7B68481D5598A660A9C7D6B8C39AB3F122BEC12BB40F4DA12934B6819E30370CBAC457A1F70FCBFF94CC0A8C89D15897CDEB13<br>9CB376F39EEEC195E4941BEFFB5EA7F3EEABCAF0D892E6E0F66BC80168065B5EE46C56E8AB53FC276FC7A499E6355E612834256FB0EBE47150FD6EA9AF75<br>17DF187B0ADE95156FE18C3FF2ACC99AF531DC3BE2D096C6BFCC7FB89E01028BC0F3E20313F1DBEF53BC17B70215F12A490F82C29A85CBEDD76E899AC435<br>2E324FA2891A3A3AB587D1265BA2CA0E194C8DD42F8252C5B22347349BCAA83326C261178ED83E8BC6D44304395FB995CC0A1A20073ECD546D195C9C5A58<br>DA827F1943C613988879D74F9618</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>
Emails
-
href="[email protected]
-
href="[email protected]
Signatures
- MedusaLocker
Ransomware with several variants first seen in September 2019.
- MedusaLocker Payload 2 IoCs
resource yara_rule behavioral2/files/0x0006000000021e42-127.dat family_medusalocker behavioral2/files/0x0006000000021e42-128.dat family_medusalocker - Executes dropped EXE 1 IoCs
pid Process 2248 svhost.exe - Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\UnregisterPop.crw => C:\Users\Admin\Pictures\UnregisterPop.crw.marlock011 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File renamed C:\Users\Admin\Pictures\DismountHide.crw => C:\Users\Admin\Pictures\DismountHide.crw.marlock011 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File renamed C:\Users\Admin\Pictures\JoinAssert.png => C:\Users\Admin\Pictures\JoinAssert.png.marlock011 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened for modification C:\Users\Admin\Pictures\ReadRegister.tiff dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File renamed C:\Users\Admin\Pictures\ReadRegister.tiff => C:\Users\Admin\Pictures\ReadRegister.tiff.marlock011 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File renamed C:\Users\Admin\Pictures\RestoreImport.crw => C:\Users\Admin\Pictures\RestoreImport.crw.marlock011 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File renamed C:\Users\Admin\Pictures\SuspendSubmit.raw => C:\Users\Admin\Pictures\SuspendSubmit.raw.marlock011 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-157025953-3125636059-437143553-1000\desktop.ini dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\O: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\Q: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\R: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\V: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\F: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\L: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\U: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\X: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\Z: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\B: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\G: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\H: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\I: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\J: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\K: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\S: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\T: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\A: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\E: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\W: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\Y: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\N: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe File opened (read-only) \??\P: dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1916 wmic.exe Token: SeSecurityPrivilege 1916 wmic.exe Token: SeTakeOwnershipPrivilege 1916 wmic.exe Token: SeLoadDriverPrivilege 1916 wmic.exe Token: SeSystemProfilePrivilege 1916 wmic.exe Token: SeSystemtimePrivilege 1916 wmic.exe Token: SeProfSingleProcessPrivilege 1916 wmic.exe Token: SeIncBasePriorityPrivilege 1916 wmic.exe Token: SeCreatePagefilePrivilege 1916 wmic.exe Token: SeBackupPrivilege 1916 wmic.exe Token: SeRestorePrivilege 1916 wmic.exe Token: SeShutdownPrivilege 1916 wmic.exe Token: SeDebugPrivilege 1916 wmic.exe Token: SeSystemEnvironmentPrivilege 1916 wmic.exe Token: SeRemoteShutdownPrivilege 1916 wmic.exe Token: SeUndockPrivilege 1916 wmic.exe Token: SeManageVolumePrivilege 1916 wmic.exe Token: 33 1916 wmic.exe Token: 34 1916 wmic.exe Token: 35 1916 wmic.exe Token: 36 1916 wmic.exe Token: SeIncreaseQuotaPrivilege 440 wmic.exe Token: SeSecurityPrivilege 440 wmic.exe Token: SeTakeOwnershipPrivilege 440 wmic.exe Token: SeLoadDriverPrivilege 440 wmic.exe Token: SeSystemProfilePrivilege 440 wmic.exe Token: SeSystemtimePrivilege 440 wmic.exe Token: SeProfSingleProcessPrivilege 440 wmic.exe Token: SeIncBasePriorityPrivilege 440 wmic.exe Token: SeCreatePagefilePrivilege 440 wmic.exe Token: SeBackupPrivilege 440 wmic.exe Token: SeRestorePrivilege 440 wmic.exe Token: SeShutdownPrivilege 440 wmic.exe Token: SeDebugPrivilege 440 wmic.exe Token: SeSystemEnvironmentPrivilege 440 wmic.exe Token: SeRemoteShutdownPrivilege 440 wmic.exe Token: SeUndockPrivilege 440 wmic.exe Token: SeManageVolumePrivilege 440 wmic.exe Token: 33 440 wmic.exe Token: 34 440 wmic.exe Token: 35 440 wmic.exe Token: 36 440 wmic.exe Token: SeIncreaseQuotaPrivilege 444 wmic.exe Token: SeSecurityPrivilege 444 wmic.exe Token: SeTakeOwnershipPrivilege 444 wmic.exe Token: SeLoadDriverPrivilege 444 wmic.exe Token: SeSystemProfilePrivilege 444 wmic.exe Token: SeSystemtimePrivilege 444 wmic.exe Token: SeProfSingleProcessPrivilege 444 wmic.exe Token: SeIncBasePriorityPrivilege 444 wmic.exe Token: SeCreatePagefilePrivilege 444 wmic.exe Token: SeBackupPrivilege 444 wmic.exe Token: SeRestorePrivilege 444 wmic.exe Token: SeShutdownPrivilege 444 wmic.exe Token: SeDebugPrivilege 444 wmic.exe Token: SeSystemEnvironmentPrivilege 444 wmic.exe Token: SeRemoteShutdownPrivilege 444 wmic.exe Token: SeUndockPrivilege 444 wmic.exe Token: SeManageVolumePrivilege 444 wmic.exe Token: 33 444 wmic.exe Token: 34 444 wmic.exe Token: 35 444 wmic.exe Token: 36 444 wmic.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4088 wrote to memory of 1916 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 83 PID 4088 wrote to memory of 1916 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 83 PID 4088 wrote to memory of 1916 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 83 PID 4088 wrote to memory of 440 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 85 PID 4088 wrote to memory of 440 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 85 PID 4088 wrote to memory of 440 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 85 PID 4088 wrote to memory of 444 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 87 PID 4088 wrote to memory of 444 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 87 PID 4088 wrote to memory of 444 4088 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe 87 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe"C:\Users\Admin\AppData\Local\Temp\dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe"1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4088 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:440
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:444
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
PID:2248
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\svhost.exe
- Size 669KB
- SHA256 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13
- MD5 3a43bb428e23e8059c9a3fbde9707de2
- SHA1 edbca9b297c2ce981bcb6c8a20107c204045d523
- SHA512 c02648de56128a758873952ffcac982bf4463bc9c7cab9605e2f0cf77eb4304e39a9076494f4127718356e4d5250084353b27459c40ae8f30ac7cb5150f2ae1e
- SSDEEP 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DdKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWAKrKe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\svhost.exe
- Size 669KB
- SHA256 dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13
- MD5 3a43bb428e23e8059c9a3fbde9707de2
- SHA1 edbca9b297c2ce981bcb6c8a20107c204045d523
- SHA512 c02648de56128a758873952ffcac982bf4463bc9c7cab9605e2f0cf77eb4304e39a9076494f4127718356e4d5250084353b27459c40ae8f30ac7cb5150f2ae1e
- SSDEEP 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DdKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWAKrKe
- MD5 SHA1 SHA512 SSDEEP