exorcist | ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097

Analysis

max time kernel
151s
max time network
166s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-05-2022 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Size

68KB
MD5

f269d24544e8bb4cb82680bb396a5f1b
SHA1

8283f4266a7782308b04a3d03c8b13a38eefaa61
SHA256

ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097
SHA512

c22f51697316c4d29e4b4ef817a1c73d4681fc02b0a2b0fee01e2aaf065d6a3aa04b7defc366cea012a723e600bd80a12083d54bb0907fa0b4cf6f12c41e68d1

Score

10^/10

exorcist ransomware suricata

Malware Config

Signatures

Exorcist Ransomware
Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.
ransomware exorcist
suricata: ET MALWARE Exorcist 2.0 Ransomware CnC Activity
suricata: ET MALWARE Exorcist 2.0 Ransomware CnC Activity
suricata
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-18\desktop.ini	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\Z:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\W:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\N:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\H:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\G:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\F:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\E:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\A:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\T:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\Q:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\I:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\R:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\P:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\O:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\J:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\B:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\X:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\V:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\S:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\K:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\D:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\Y:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\U:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File opened (read-only)	\??\M:	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1388	vssadmin.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 097704a8f338df80604bda7fb4b1f9b56855731e9d2c2e2854480d55aef11ece	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 2c14ae106c67c7b6e6c99beedc2c015d167fde755539aab22792dde298d3679f	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{4dec7ee4-bc57-11ec-99ec-806e6f6e6963}\NukeOnDelete = "0"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = 8c04000040587ace9365d801	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-e9-2f-ee-c6-fb	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 1acab9c98a3c94b9cb392687441288a2e2132971f18185c0f6eea3917aba90fb	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{4dec7ee4-bc57-11ec-99ec-806e6f6e6963}\MaxCapacity = "15140"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{4dec7ee3-bc57-11ec-99ec-806e6f6e6963}\MaxCapacity = "29"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6DFD0C0D-0BD1-4743-97A4-BC640693C51B}\WpadDecisionReason = "1"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = f0ae21b9e9b50714c64a3ba597558a09c872cbd25d3525a0b17b1f10f7e6c269	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{4dec7ee4-bc57-11ec-99ec-806e6f6e6963}	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 5d4c8665c0296f89081e4bfb8cde7ccc12096d64250036632b6848e7574b21bf	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{4dec7ee3-bc57-11ec-99ec-806e6f6e6963}	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{4dec7ee3-bc57-11ec-99ec-806e6f6e6963}\NukeOnDelete = "0"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6DFD0C0D-0BD1-4743-97A4-BC640693C51B}\WpadDecision = "0"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-e9-2f-ee-c6-fb\WpadDecisionTime = a0bb9fd69365d801	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = bcc0b20cc74f053b82e6ed1a08efc468a9d947f27f6d2f41fc6a5a0fe77c457d	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = f1e56336f9d2ea793b008266107374e4c9716d3ffd8caa0cfea082c9b38ed0fe	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 86eff7eefb3a9582cb45e17391fc60d77dddd45fb523e91f85451127746f07a2	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 68567ae2cb5f11932ae44f4e36581f801456d40f27eb601f9af6c43db8a480cf	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6DFD0C0D-0BD1-4743-97A4-BC640693C51B}\WpadNetworkName = "Network 3"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-e9-2f-ee-c6-fb\WpadDecisionReason = "1"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0041006400640043006f006e0076006500720074002e00610069006600630000000000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0043006f006e00740061006300740073005c00410064006d0069006e002e0063006f006e00740061006300740000000000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c006400650070006c006f0079006d0065006e0074002e00700072006f00700065007200740069006500730000000000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00340064006500630037006500650034002d0062006300350037002d0031003100650063002d0039003900650063002d003800300036006500360066003600650036003900360033007d0000000000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c005200650063006f0076006500720079005c00610034003000370039006300380032002d0062006300350066002d0031003100650063002d0062006600620030002d003800650039003100640063003400350062006600650065005c00570069006e00720065002e00770069006d0000000000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-e9-2f-ee-c6-fb\WpadDecision = "0"	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0043006f006e00760065007200740043006f006d0070006c006500740065002e006f006400700000000000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6DFD0C0D-0BD1-4743-97A4-BC640693C51B}\WpadDecisionTime = a0bb9fd69365d801	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 74f6dcc3ee1eb6e8a20216a946ff92a30a85e34e3ffaf377fe724ed56d72d697	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0043006c006500610072004c0069006d00690074002e0077006d00610000000000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c005200650063006f0076006500720079005c00610034003000370039006300380032002d0062006300350066002d0031003100650063002d0062006600620030002d003800650039003100640063003400350062006600650065005c0062006f006f0074002e0073006400690000000000	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 4f08e16f27db01d103dba361836fdb58dcd46342f48f8c5e14e70cb36e8f5587	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6DFD0C0D-0BD1-4743-97A4-BC640693C51B}	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 3be0d859f563b4f54f774a0cdefd3637f92611cd2d52ec008387c5d2904ce50d	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\LY4jd2\windows.sys:lyhxozmopp	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\zn7LoW\windows.sys:ymiuwsmgitpdtbmh	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\LY4jd2\windows.sys:lyhxozmopp	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\Nx42wp\windows.sys:yoglygxpztqveikkj	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Token: SeRestorePrivilege	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Token: SeDebugPrivilege	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Token: SeSecurityPrivilege	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Token: SeRestorePrivilege	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Token: SeDebugPrivilege	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Token: SeBackupPrivilege	1432	vssvc.exe
Token: SeRestorePrivilege	1432	vssvc.exe
Token: SeAuditPrivilege	1432	vssvc.exe
Token: SeIncreaseQuotaPrivilege	916	WMIC.exe
Token: SeSecurityPrivilege	916	WMIC.exe
Token: SeTakeOwnershipPrivilege	916	WMIC.exe
Token: SeLoadDriverPrivilege	916	WMIC.exe
Token: SeSystemProfilePrivilege	916	WMIC.exe
Token: SeSystemtimePrivilege	916	WMIC.exe
Token: SeProfSingleProcessPrivilege	916	WMIC.exe
Token: SeIncBasePriorityPrivilege	916	WMIC.exe
Token: SeCreatePagefilePrivilege	916	WMIC.exe
Token: SeBackupPrivilege	916	WMIC.exe
Token: SeRestorePrivilege	916	WMIC.exe
Token: SeShutdownPrivilege	916	WMIC.exe
Token: SeDebugPrivilege	916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	916	WMIC.exe
Token: SeRemoteShutdownPrivilege	916	WMIC.exe
Token: SeUndockPrivilege	916	WMIC.exe
Token: SeManageVolumePrivilege	916	WMIC.exe
Token: 33	916	WMIC.exe
Token: 34	916	WMIC.exe
Token: 35	916	WMIC.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1508	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	27
PID 1164 wrote to memory of 1508	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	27
PID 1164 wrote to memory of 1508	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	27
PID 1164 wrote to memory of 1508	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	27
PID 1508 wrote to memory of 1388	1508	cmd.exe	29
PID 1508 wrote to memory of 1388	1508	cmd.exe	29
PID 1508 wrote to memory of 1388	1508	cmd.exe	29
PID 1508 wrote to memory of 1388	1508	cmd.exe	29
PID 1164 wrote to memory of 1768	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	31
PID 1164 wrote to memory of 1768	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	31
PID 1164 wrote to memory of 1768	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	31
PID 1164 wrote to memory of 1768	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	31
PID 1164 wrote to memory of 524	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	33
PID 1164 wrote to memory of 524	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	33
PID 1164 wrote to memory of 524	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	33
PID 1164 wrote to memory of 524	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	33
PID 1164 wrote to memory of 1504	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	35
PID 1164 wrote to memory of 1504	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	35
PID 1164 wrote to memory of 1504	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	35
PID 1164 wrote to memory of 1504	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	35
PID 1164 wrote to memory of 1808	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	37
PID 1164 wrote to memory of 1808	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	37
PID 1164 wrote to memory of 1808	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	37
PID 1164 wrote to memory of 1808	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	37
PID 1164 wrote to memory of 808	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	39
PID 1164 wrote to memory of 808	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	39
PID 1164 wrote to memory of 808	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	39
PID 1164 wrote to memory of 808	1164	ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe	39
PID 808 wrote to memory of 916	808	cmd.exe	41
PID 808 wrote to memory of 916	808	cmd.exe	41
PID 808 wrote to memory of 916	808	cmd.exe	41
PID 808 wrote to memory of 916	808	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
"C:\Users\Admin\AppData\Local\Temp\ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\cmd.exe
  cmd /C vssadmin Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1388
- C:\Windows\SysWOW64\cmd.exe
  cmd /C bcdedit /set {default} recoveryenabled No
  2⤵
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  cmd /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:524
- C:\Windows\SysWOW64\cmd.exe
  cmd /C wbadmin DELETE SYSTEMSTATEBACKUP
  2⤵
  PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
  2⤵
  PID:1808
- C:\Windows\SysWOW64\cmd.exe
  cmd /C wmic SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic SHADOWCOPY /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1164-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download