Analysis
-
max time kernel
153s -
max time network
82s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-04-2022 17:57
Behavioral task
behavioral1
Sample
f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe
Resource
win10v2004-20220414-en
General
-
Target
f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe
-
Size
629KB
-
MD5
76ca564f3c799e482b7dbc6f22e50dd6
-
SHA1
0802cc3009a1b7a1f9b12139340d718f7eb47d8c
-
SHA256
f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196
-
SHA512
678c09f9984495651a6c4c0af40bc38e44075e397325370dc5750922ee3abdbd8f15de66abf370f8e873d2a69b23c21d9980de004f12822776b281c0353a5587
Malware Config
Extracted
C:\Program Files\7-Zip\Restore-My-Files.txt
lockbit
http://lockbit-decryptor.top/?9B7FDA8D33FEC3F99DBCBD73DB1675CC
http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F99DBCBD73DB1675CC
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2848 bcdedit.exe 2860 bcdedit.exe -
Processes:
wbadmin.exepid process 2872 wbadmin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe\"" f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exepid process 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe -
Drops file in Program Files directory 64 IoCs
Processes:
f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\Restore-My-Files.txt f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\Restore-My-Files.txt f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\Restore-My-Files.txt f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\Filters.xml f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\Restore-My-Files.txt f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\Restore-My-Files.txt f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File created C:\Program Files\7-Zip\Lang\Restore-My-Files.txt f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1580 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exepid process 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeTakeOwnershipPrivilege 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe Token: SeDebugPrivilege 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe Token: SeBackupPrivilege 1928 vssvc.exe Token: SeRestorePrivilege 1928 vssvc.exe Token: SeAuditPrivilege 1928 vssvc.exe Token: SeIncreaseQuotaPrivilege 2764 WMIC.exe Token: SeSecurityPrivilege 2764 WMIC.exe Token: SeTakeOwnershipPrivilege 2764 WMIC.exe Token: SeLoadDriverPrivilege 2764 WMIC.exe Token: SeSystemProfilePrivilege 2764 WMIC.exe Token: SeSystemtimePrivilege 2764 WMIC.exe Token: SeProfSingleProcessPrivilege 2764 WMIC.exe Token: SeIncBasePriorityPrivilege 2764 WMIC.exe Token: SeCreatePagefilePrivilege 2764 WMIC.exe Token: SeBackupPrivilege 2764 WMIC.exe Token: SeRestorePrivilege 2764 WMIC.exe Token: SeShutdownPrivilege 2764 WMIC.exe Token: SeDebugPrivilege 2764 WMIC.exe Token: SeSystemEnvironmentPrivilege 2764 WMIC.exe Token: SeRemoteShutdownPrivilege 2764 WMIC.exe Token: SeUndockPrivilege 2764 WMIC.exe Token: SeManageVolumePrivilege 2764 WMIC.exe Token: 33 2764 WMIC.exe Token: 34 2764 WMIC.exe Token: 35 2764 WMIC.exe Token: SeIncreaseQuotaPrivilege 2764 WMIC.exe Token: SeSecurityPrivilege 2764 WMIC.exe Token: SeTakeOwnershipPrivilege 2764 WMIC.exe Token: SeLoadDriverPrivilege 2764 WMIC.exe Token: SeSystemProfilePrivilege 2764 WMIC.exe Token: SeSystemtimePrivilege 2764 WMIC.exe Token: SeProfSingleProcessPrivilege 2764 WMIC.exe Token: SeIncBasePriorityPrivilege 2764 WMIC.exe Token: SeCreatePagefilePrivilege 2764 WMIC.exe Token: SeBackupPrivilege 2764 WMIC.exe Token: SeRestorePrivilege 2764 WMIC.exe Token: SeShutdownPrivilege 2764 WMIC.exe Token: SeDebugPrivilege 2764 WMIC.exe Token: SeSystemEnvironmentPrivilege 2764 WMIC.exe Token: SeRemoteShutdownPrivilege 2764 WMIC.exe Token: SeUndockPrivilege 2764 WMIC.exe Token: SeManageVolumePrivilege 2764 WMIC.exe Token: 33 2764 WMIC.exe Token: 34 2764 WMIC.exe Token: 35 2764 WMIC.exe Token: SeBackupPrivilege 2932 wbengine.exe Token: SeRestorePrivilege 2932 wbengine.exe Token: SeSecurityPrivilege 2932 wbengine.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.execmd.exedescription pid process target process PID 1392 wrote to memory of 2036 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe cmd.exe PID 1392 wrote to memory of 2036 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe cmd.exe PID 1392 wrote to memory of 2036 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe cmd.exe PID 1392 wrote to memory of 2036 1392 f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe cmd.exe PID 2036 wrote to memory of 1580 2036 cmd.exe vssadmin.exe PID 2036 wrote to memory of 1580 2036 cmd.exe vssadmin.exe PID 2036 wrote to memory of 1580 2036 cmd.exe vssadmin.exe PID 2036 wrote to memory of 2764 2036 cmd.exe WMIC.exe PID 2036 wrote to memory of 2764 2036 cmd.exe WMIC.exe PID 2036 wrote to memory of 2764 2036 cmd.exe WMIC.exe PID 2036 wrote to memory of 2848 2036 cmd.exe bcdedit.exe PID 2036 wrote to memory of 2848 2036 cmd.exe bcdedit.exe PID 2036 wrote to memory of 2848 2036 cmd.exe bcdedit.exe PID 2036 wrote to memory of 2860 2036 cmd.exe bcdedit.exe PID 2036 wrote to memory of 2860 2036 cmd.exe bcdedit.exe PID 2036 wrote to memory of 2860 2036 cmd.exe bcdedit.exe PID 2036 wrote to memory of 2872 2036 cmd.exe wbadmin.exe PID 2036 wrote to memory of 2872 2036 cmd.exe wbadmin.exe PID 2036 wrote to memory of 2872 2036 cmd.exe wbadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe"C:\Users\Admin\AppData\Local\Temp\f34ea09ea668ecdef11cc67781a9e43549913252190d49104d98c33822fd2196.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1392-54-0x0000000075951000-0x0000000075953000-memory.dmpFilesize
8KB
-
memory/1392-55-0x0000000000220000-0x0000000000246000-memory.dmpFilesize
152KB
-
memory/1392-56-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/1580-58-0x0000000000000000-mapping.dmp
-
memory/2036-57-0x0000000000000000-mapping.dmp
-
memory/2764-59-0x0000000000000000-mapping.dmp
-
memory/2848-60-0x0000000000000000-mapping.dmp
-
memory/2860-61-0x0000000000000000-mapping.dmp
-
memory/2872-62-0x0000000000000000-mapping.dmp
-
memory/2872-63-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmpFilesize
8KB