Analysis
-
max time kernel
83s -
max time network
82s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-05-2022 12:17
Static task
static1
Behavioral task
behavioral1
Sample
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe
Resource
win10v2004-20220414-en
General
-
Target
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe
-
Size
959KB
-
MD5
e2d006ac5e8d76856b516746a50c2a58
-
SHA1
83b6e55dc61a6813dbc992c0b55379e5851d2825
-
SHA256
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72
-
SHA512
32b9d944c1f6700e58231512cb40de5dc2d2f29090ac5ec6900c785ee24d6f8d1614ca05d8172328d9ed47ec32ec9049cb40be03514f3df6f513ce401c9c7101
Malware Config
Extracted
C:\program files\7-zip\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2292 bcdedit.exe 2332 bcdedit.exe -
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exedescription ioc process File opened for modification C:\users\admin\pictures\enablepush.tiff 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File renamed C:\Users\Admin\Pictures\DebugSelect.raw => C:\users\admin\pictures\debugselect.raw.lockbit 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File renamed C:\Users\Admin\Pictures\EnablePush.tiff => C:\users\admin\pictures\enablepush.tiff.lockbit 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File renamed C:\Users\Admin\Pictures\ExitSync.crw => C:\users\admin\pictures\exitsync.crw.lockbit 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File renamed C:\Users\Admin\Pictures\SelectReceive.tif => C:\users\admin\pictures\selectreceive.tif.lockbit 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File renamed C:\Users\Admin\Pictures\SuspendTest.tif => C:\users\admin\pictures\suspendtest.tif.lockbit 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File renamed C:\Users\Admin\Pictures\UseStop.raw => C:\users\admin\pictures\usestop.raw.lockbit 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\{AA7DFFDE-6262-7906-C463-C4C855FECD29} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe\"" 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe -
Drops file in System32 directory 2 IoCs
Processes:
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exedescription ioc process File created C:\windows\SysWOW64\3B7D11.ico 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
Processes:
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exepid process 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exedescription ioc process File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\in00118_.wmf 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File created C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\meta-inf\Restore-My-Files.txt 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\undocked_gray_few-showers.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\picturepuzzle.gadget\images\8.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File created C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\Restore-My-Files.txt 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\windows sidebar\gadgets\currency.gadget\fr-fr\currency.html 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0281630.wmf 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\bullets\bd21399_.gif 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\lines\bd10307_.gif 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\eadocumentapproval_init.xsn 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubftscm\scheme07.css 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\huecycle\15x15dot.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\meta-index 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\dawson 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\office14\forms\1033\infomail.cfg 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\office14\pagesize\pglbl020.xml 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\dgpunct.dpv 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\na00798_.wmf 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\so00479_.wmf 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\picturepuzzle.gadget\fr-fr\js\settings.js 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jre7\lib\zi\america\blanc-sablon 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\de-de\picturepuzzle.html 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formsviewattachmenticons.jpg 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0107308.wmf 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File created C:\program files (x86)\microsoft office\office14\groove\toolbmps\Restore-My-Files.txt 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\bullets\bd21300_.gif 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\windows mail\it-it\msoeres.dll.mui 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\rssfeeds.gadget\es-es\settings.html 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File created C:\program files\java\jre7\lib\cmm\Restore-My-Files.txt 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\windows sidebar\gadgets\clock.gadget\images\modern_s.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\pe00049_.wmf 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0105504.wmf 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\windows sidebar\gadgets\clock.gadget\images\cronometer.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\zpdir4f.gif 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\picturepuzzle.gadget\images\settings_right_hover.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\adobe\reader 9.0\reader\tracker\review_same_reviewers.gif 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\vignette\navigationleft_selectionsubpicture.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\de-de\js\picturepuzzle.js 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0099188.jpg 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\zpdir51f.gif 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\re00006_.wmf 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\clock.gadget\it-it\js\timezones.js 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\cpu.gadget\logo.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\7-zip\lang\ky.txt 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jdk1.7.0_80\include\jawt.h 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\deploy\splash.gif 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\windows sidebar\gadgets\clock.gadget\images\settings_corner_top_right.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\commondata\unreadicon.jpg 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jre7\lib\zi\america\los_angeles 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\dd01145_.wmf 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File created C:\program files (x86)\microsoft office\document themes 14\theme fonts\Restore-My-Files.txt 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File created C:\program files\videolan\vlc\locale\lt\lc_messages\Restore-My-Files.txt 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files (x86)\microsoft office\office14\pagesize\pglbl078.xml 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\navigationup_selectionsubpicture.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File created C:\program files\java\jdk1.7.0_80\include\Restore-My-Files.txt 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\images\timer_over.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jdk1.7.0_80\include\classfile_constants.h 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macgrey.png 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe File created C:\program files\videolan\vlc\locale\tr\lc_messages\Restore-My-Files.txt 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2104 vssadmin.exe -
Modifies registry class 3 IoCs
Processes:
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exedescription ioc process Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\3B7D11.ico" 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe Key created \Registry\Machine\Software\Classes\.lockbit 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exepid process 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exevssvc.exeWMIC.exedescription pid process Token: SeTakeOwnershipPrivilege 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe Token: SeDebugPrivilege 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe Token: SeBackupPrivilege 2140 vssvc.exe Token: SeRestorePrivilege 2140 vssvc.exe Token: SeAuditPrivilege 2140 vssvc.exe Token: SeIncreaseQuotaPrivilege 1036 WMIC.exe Token: SeSecurityPrivilege 1036 WMIC.exe Token: SeTakeOwnershipPrivilege 1036 WMIC.exe Token: SeLoadDriverPrivilege 1036 WMIC.exe Token: SeSystemProfilePrivilege 1036 WMIC.exe Token: SeSystemtimePrivilege 1036 WMIC.exe Token: SeProfSingleProcessPrivilege 1036 WMIC.exe Token: SeIncBasePriorityPrivilege 1036 WMIC.exe Token: SeCreatePagefilePrivilege 1036 WMIC.exe Token: SeBackupPrivilege 1036 WMIC.exe Token: SeRestorePrivilege 1036 WMIC.exe Token: SeShutdownPrivilege 1036 WMIC.exe Token: SeDebugPrivilege 1036 WMIC.exe Token: SeSystemEnvironmentPrivilege 1036 WMIC.exe Token: SeRemoteShutdownPrivilege 1036 WMIC.exe Token: SeUndockPrivilege 1036 WMIC.exe Token: SeManageVolumePrivilege 1036 WMIC.exe Token: 33 1036 WMIC.exe Token: 34 1036 WMIC.exe Token: 35 1036 WMIC.exe Token: SeIncreaseQuotaPrivilege 1036 WMIC.exe Token: SeSecurityPrivilege 1036 WMIC.exe Token: SeTakeOwnershipPrivilege 1036 WMIC.exe Token: SeLoadDriverPrivilege 1036 WMIC.exe Token: SeSystemProfilePrivilege 1036 WMIC.exe Token: SeSystemtimePrivilege 1036 WMIC.exe Token: SeProfSingleProcessPrivilege 1036 WMIC.exe Token: SeIncBasePriorityPrivilege 1036 WMIC.exe Token: SeCreatePagefilePrivilege 1036 WMIC.exe Token: SeBackupPrivilege 1036 WMIC.exe Token: SeRestorePrivilege 1036 WMIC.exe Token: SeShutdownPrivilege 1036 WMIC.exe Token: SeDebugPrivilege 1036 WMIC.exe Token: SeSystemEnvironmentPrivilege 1036 WMIC.exe Token: SeRemoteShutdownPrivilege 1036 WMIC.exe Token: SeUndockPrivilege 1036 WMIC.exe Token: SeManageVolumePrivilege 1036 WMIC.exe Token: 33 1036 WMIC.exe Token: 34 1036 WMIC.exe Token: 35 1036 WMIC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.execmd.exedescription pid process target process PID 1684 wrote to memory of 2052 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe cmd.exe PID 1684 wrote to memory of 2052 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe cmd.exe PID 1684 wrote to memory of 2052 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe cmd.exe PID 1684 wrote to memory of 2052 1684 3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe cmd.exe PID 2052 wrote to memory of 2104 2052 cmd.exe vssadmin.exe PID 2052 wrote to memory of 2104 2052 cmd.exe vssadmin.exe PID 2052 wrote to memory of 2104 2052 cmd.exe vssadmin.exe PID 2052 wrote to memory of 1036 2052 cmd.exe WMIC.exe PID 2052 wrote to memory of 1036 2052 cmd.exe WMIC.exe PID 2052 wrote to memory of 1036 2052 cmd.exe WMIC.exe PID 2052 wrote to memory of 2292 2052 cmd.exe bcdedit.exe PID 2052 wrote to memory of 2292 2052 cmd.exe bcdedit.exe PID 2052 wrote to memory of 2292 2052 cmd.exe bcdedit.exe PID 2052 wrote to memory of 2332 2052 cmd.exe bcdedit.exe PID 2052 wrote to memory of 2332 2052 cmd.exe bcdedit.exe PID 2052 wrote to memory of 2332 2052 cmd.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe"C:\Users\Admin\AppData\Local\Temp\3f2accb371da418d3b7f0ee689c2cca064cce542a72948fc7793285a43476d72.bin.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1036-57-0x0000000000000000-mapping.dmp
-
memory/1684-54-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB
-
memory/2052-55-0x0000000000000000-mapping.dmp
-
memory/2104-56-0x0000000000000000-mapping.dmp
-
memory/2292-58-0x0000000000000000-mapping.dmp
-
memory/2332-59-0x0000000000000000-mapping.dmp