Analysis
-
max time kernel
159s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-05-2022 15:06
Static task
static1
Behavioral task
behavioral1
Sample
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe
Resource
win10v2004-20220414-en
General
-
Target
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe
-
Size
174KB
-
MD5
c303d6dbdf135c20cdf95f6e6f3c6bac
-
SHA1
62b370fcfbb7799db5a94852e9906bc0f5d022bc
-
SHA256
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338
-
SHA512
a10710f8db1a112c367c5890946f514e3fb74194168f249715ab7b714b62b6e7b5495c39ea180c5835378cff36f4a583d775a4fed041e6b78ce1cae43b2dff03
Malware Config
Extracted
C:\odt\Restore-My-Files.txt
lockbit
http://lockbit-decryptor.top/?DFB941278EE2558CAFF23A13E7009C60
http://lockbitks2tvnmwk.onion/?DFB941278EE2558CAFF23A13E7009C60
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe\"" 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exepid process 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe -
Drops file in Program Files directory 64 IoCs
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exedescription ioc process File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_ko.properties 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaBrightDemiItalic.ttf 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\java.security 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ja_JP.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-compat.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-cli.xml 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\calendars.properties 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\platform.xml 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File created C:\Program Files\Restore-My-Files.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCalls.c 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunec.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\LINEAR_RGB.pf 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\org-openide-modules.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exepid process 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exedescription pid process Token: SeTakeOwnershipPrivilege 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe Token: SeDebugPrivilege 4044 6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe"C:\Users\Admin\AppData\Local\Temp\6ceea39b7ac9ae4c9560e9fa6a6174da4f17b83e33896ddbb54d2bcd9b163338.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken